diff options
author | H.J. Lu <hjl.tools@gmail.com> | 2019-02-04 08:55:52 -0800 |
---|---|---|
committer | H.J. Lu <hjl.tools@gmail.com> | 2019-02-04 12:27:04 -0800 |
commit | 726a78867b3144e9b9da10197bcf59bde3d8b2a4 (patch) | |
tree | 12fcceef9de6a07ef8ab4245a16320bceccc0736 /NEWS | |
parent | 86013ef5cea322b8f4b9c22f230c22cce369e947 (diff) | |
download | glibc-726a78867b3144e9b9da10197bcf59bde3d8b2a4.zip glibc-726a78867b3144e9b9da10197bcf59bde3d8b2a4.tar.gz glibc-726a78867b3144e9b9da10197bcf59bde3d8b2a4.tar.bz2 |
x86-64 memcmp: Use unsigned Jcc instructions on size [BZ #24155]
Since the size argument is unsigned. we should use unsigned Jcc
instructions, instead of signed, to check size.
Tested on x86-64 and x32, with and without --disable-multi-arch.
[BZ #24155]
CVE-2019-7309
* NEWS: Updated for CVE-2019-7309.
* sysdeps/x86_64/memcmp.S: Use RDX_LP for size. Clear the
upper 32 bits of RDX register for x32. Use unsigned Jcc
instructions, instead of signed.
* sysdeps/x86_64/x32/Makefile (tests): Add tst-size_t-memcmp-2.
* sysdeps/x86_64/x32/tst-size_t-memcmp-2.c: New test.
(cherry picked from commit 3f635fb43389b54f682fc9ed2acc0b2aaf4a923d)
Diffstat (limited to 'NEWS')
-rw-r--r-- | NEWS | 17 |
1 files changed, 17 insertions, 0 deletions
@@ -5,6 +5,23 @@ See the end for copying conditions. Please send GNU C library bug reports via <https://sourceware.org/bugzilla/> using `glibc' in the "product" field. +Version 2.29.1 + +The following bugs are resolved with this release: + + [24155] x32 memcmp can treat positive length as 0 (if sign bit in RDX is set) (CVE-2019-7309) + +Security related changes: + + CVE-2019-7309: x86-64 memcmp used signed Jcc instructions to check + size. For x86-64, memcmp on an object size larger than SSIZE_MAX + has undefined behavior. On x32, the size_t argument may be passed + in the lower 32 bits of the 64-bit RDX register with non-zero upper + 32 bits. When it happened with the sign bit of RDX register set, + memcmp gave the wrong result since it treated the size argument as + zero. Reported by H.J. Lu. + + Version 2.29 Major new features: |