2023-10-13 20:03:09 +00:00
<!doctype html>
< html lang = "en" class = "no-js" >
< head >
< meta charset = "utf-8" >
< meta name = "viewport" content = "width=device-width,initial-scale=1" >
< meta name = "description" content = "The wiki for the Rocky Linux Security Special Interest Group" >
< link rel = "canonical" href = "https://sig-security.rocky.page/packages/glibc/" >
2023-12-14 22:29:36 +00:00
< link rel = "prev" href = "../control/" >
2023-10-13 20:03:09 +00:00
2023-11-14 20:43:12 +00:00
< link rel = "next" href = "../hardened_malloc/" >
2023-10-13 20:03:09 +00:00
< link rel = "icon" href = "../../assets/images/favicon.png" >
2024-02-01 22:04:43 +00:00
< meta name = "generator" content = "mkdocs-1.5.3, mkdocs-material-9.5.6" >
2023-10-13 20:03:09 +00:00
< title > Override package: glibc - SIG/Security Wiki< / title >
2023-12-14 22:29:36 +00:00
< link rel = "stylesheet" href = "../../assets/stylesheets/main.50c56a3b.min.css" >
2023-10-13 20:03:09 +00:00
2023-12-14 22:29:36 +00:00
< link rel = "stylesheet" href = "../../assets/stylesheets/palette.06af60db.min.css" >
2023-10-13 20:03:09 +00:00
< link rel = "preconnect" href = "https://fonts.gstatic.com" crossorigin >
< link rel = "stylesheet" href = "https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback" >
< style > : root { --md-text-font : "Roboto" ; --md-code-font : "Roboto Mono" } < / style >
< script > _ _md _scope = new URL ( "../.." , location ) , _ _md _hash = e => [ ... e ] . reduce ( ( e , _ ) => ( e << 5 ) - e + _ . charCodeAt ( 0 ) , 0 ) , _ _md _get = ( e , _ = localStorage , t = _ _md _scope ) => JSON . parse ( _ . getItem ( t . pathname + "." + e ) ) , _ _md _set = ( e , _ , t = localStorage , a = _ _md _scope ) => { try { t . setItem ( a . pathname + "." + e , JSON . stringify ( _ ) ) } catch ( e ) { } } < / script >
< / head >
< body dir = "ltr" data-md-color-scheme = "default" data-md-color-primary = "teal" data-md-color-accent = "teal" >
< input class = "md-toggle" data-md-toggle = "drawer" type = "checkbox" id = "__drawer" autocomplete = "off" >
< input class = "md-toggle" data-md-toggle = "search" type = "checkbox" id = "__search" autocomplete = "off" >
< label class = "md-overlay" for = "__drawer" > < / label >
< div data-md-component = "skip" >
< a href = "#override-package-glibc" class = "md-skip" >
Skip to content
< / a >
< / div >
< div data-md-component = "announce" >
< / div >
< header class = "md-header md-header--shadow" data-md-component = "header" >
< nav class = "md-header__inner md-grid" aria-label = "Header" >
< a href = "../.." title = "SIG/Security Wiki" class = "md-header__button md-logo" aria-label = "SIG/Security Wiki" data-md-component = "logo" >
< img src = "../../assets/icon-white.svg" alt = "logo" >
< / a >
< label class = "md-header__button md-icon" for = "__drawer" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M3 6h18v2H3V6m0 5h18v2H3v-2m0 5h18v2H3v-2Z" / > < / svg >
< / label >
< div class = "md-header__title" data-md-component = "header-title" >
< div class = "md-header__ellipsis" >
< div class = "md-header__topic" >
< span class = "md-ellipsis" >
SIG/Security Wiki
< / span >
< / div >
< div class = "md-header__topic" data-md-component = "header-topic" >
< span class = "md-ellipsis" >
Override package: glibc
< / span >
< / div >
< / div >
< / div >
< form class = "md-header__option" data-md-component = "palette" >
2023-12-14 22:29:36 +00:00
< input class = "md-option" data-md-color-media = "(prefers-color-scheme: light)" data-md-color-scheme = "default" data-md-color-primary = "teal" data-md-color-accent = "teal" aria-label = "Switch to dark mode" type = "radio" name = "__palette" id = "__palette_0" >
2023-10-13 20:03:09 +00:00
2023-12-14 22:29:36 +00:00
< label class = "md-header__button md-icon" title = "Switch to dark mode" for = "__palette_1" hidden >
2023-10-13 20:03:09 +00:00
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "m17.75 4.09-2.53 1.94.91 3.06-2.63-1.81-2.63 1.81.91-3.06-2.53-1.94L12.44 4l1.06-3 1.06 3 3.19.09m3.5 6.91-1.64 1.25.59 1.98-1.7-1.17-1.7 1.17.59-1.98L15.75 11l2.06-.05L18.5 9l.69 1.95 2.06.05m-2.28 4.95c.83-.08 1.72 1.1 1.19 1.85-.32.45-.66.87-1.08 1.27C15.17 23 8.84 23 4.94 19.07c-3.91-3.9-3.91-10.24 0-14.14.4-.4.82-.76 1.27-1.08.75-.53 1.93.36 1.85 1.19-.27 2.86.69 5.83 2.89 8.02a9.96 9.96 0 0 0 8.02 2.89m-1.64 2.02a12.08 12.08 0 0 1-7.8-3.47c-2.17-2.19-3.33-5-3.49-7.82-2.81 3.14-2.7 7.96.31 10.98 3.02 3.01 7.84 3.12 10.98.31Z" / > < / svg >
< / label >
2023-12-14 22:29:36 +00:00
< input class = "md-option" data-md-color-media = "(prefers-color-scheme: dark)" data-md-color-scheme = "slate" data-md-color-primary = "teal" data-md-color-accent = "teal" aria-label = "Switch to light mode" type = "radio" name = "__palette" id = "__palette_1" >
2023-10-13 20:03:09 +00:00
2023-12-14 22:29:36 +00:00
< label class = "md-header__button md-icon" title = "Switch to light mode" for = "__palette_0" hidden >
2023-10-13 20:03:09 +00:00
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M12 7a5 5 0 0 1 5 5 5 5 0 0 1-5 5 5 5 0 0 1-5-5 5 5 0 0 1 5-5m0 2a3 3 0 0 0-3 3 3 3 0 0 0 3 3 3 3 0 0 0 3-3 3 3 0 0 0-3-3m0-7 2.39 3.42C13.65 5.15 12.84 5 12 5c-.84 0-1.65.15-2.39.42L12 2M3.34 7l4.16-.35A7.2 7.2 0 0 0 5.94 8.5c-.44.74-.69 1.5-.83 2.29L3.34 7m.02 10 1.76-3.77a7.131 7.131 0 0 0 2.38 4.14L3.36 17M20.65 7l-1.77 3.79a7.023 7.023 0 0 0-2.38-4.15l4.15.36m-.01 10-4.14.36c.59-.51 1.12-1.14 1.54-1.86.42-.73.69-1.5.83-2.29L20.64 17M12 22l-2.41-3.44c.74.27 1.55.44 2.41.44.82 0 1.63-.17 2.37-.44L12 22Z" / > < / svg >
< / label >
< / form >
2023-12-14 22:29:36 +00:00
< script > var media , input , key , value , palette = _ _md _get ( "__palette" ) ; if ( palette && palette . color ) { "(prefers-color-scheme)" === palette . color . media && ( media = matchMedia ( "(prefers-color-scheme: light)" ) , input = document . querySelector ( media . matches ? "[data-md-color-media='(prefers-color-scheme: light)']" : "[data-md-color-media='(prefers-color-scheme: dark)']" ) , palette . color . media = input . getAttribute ( "data-md-color-media" ) , palette . color . scheme = input . getAttribute ( "data-md-color-scheme" ) , palette . color . primary = input . getAttribute ( "data-md-color-primary" ) , palette . color . accent = input . getAttribute ( "data-md-color-accent" ) ) ; for ( [ key , value ] of Object . entries ( palette . color ) ) document . body . setAttribute ( "data-md-color-" + key , value ) } < / script >
2023-10-13 20:03:09 +00:00
< label class = "md-header__button md-icon" for = "__search" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5Z" / > < / svg >
< / label >
< div class = "md-search" data-md-component = "search" role = "dialog" >
< label class = "md-search__overlay" for = "__search" > < / label >
< div class = "md-search__inner" role = "search" >
< form class = "md-search__form" name = "search" >
< input type = "text" class = "md-search__input" name = "query" aria-label = "Search" placeholder = "Search" autocapitalize = "off" autocorrect = "off" autocomplete = "off" spellcheck = "false" data-md-component = "search-query" required >
< label class = "md-search__icon md-icon" for = "__search" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5Z" / > < / svg >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11h12Z" / > < / svg >
< / label >
< nav class = "md-search__options" aria-label = "Search" >
< button type = "reset" class = "md-search__icon md-icon" title = "Clear" aria-label = "Clear" tabindex = "-1" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12 19 6.41Z" / > < / svg >
< / button >
< / nav >
< div class = "md-search__suggest" data-md-component = "search-suggest" > < / div >
< / form >
< div class = "md-search__output" >
< div class = "md-search__scrollwrap" data-md-scrollfix >
< div class = "md-search-result" data-md-component = "search-result" >
< div class = "md-search-result__meta" >
Initializing search
< / div >
< ol class = "md-search-result__list" role = "presentation" > < / ol >
< / div >
< / div >
< / div >
< / div >
< / div >
< div class = "md-header__source" >
< a href = "https://git.resf.org/security/wiki" title = "Go to repository" class = "md-source" data-md-component = "source" >
< div class = "md-source__icon md-icon" >
2023-12-14 22:29:36 +00:00
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 448 512" > <!-- ! Font Awesome Free 6.5.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2023 Fonticons, Inc. --> < path d = "M439.55 236.05 244 40.45a28.87 28.87 0 0 0-40.81 0l-40.66 40.63 51.52 51.52c27.06-9.14 52.68 16.77 43.39 43.68l49.66 49.66c34.23-11.8 61.18 31 35.47 56.69-26.49 26.49-70.21-2.87-56-37.34L240.22 199v121.85c25.3 12.54 22.26 41.85 9.08 55a34.34 34.34 0 0 1-48.55 0c-17.57-17.6-11.07-46.91 11.25-56v-123c-20.8-8.51-24.6-30.74-18.64-45L142.57 101 8.45 235.14a28.86 28.86 0 0 0 0 40.81l195.61 195.6a28.86 28.86 0 0 0 40.8 0l194.69-194.69a28.86 28.86 0 0 0 0-40.81z" / > < / svg >
2023-10-13 20:03:09 +00:00
< / div >
< div class = "md-source__repository" >
security/wiki
< / div >
< / a >
< / div >
< / nav >
< / header >
< div class = "md-container" data-md-component = "container" >
< main class = "md-main" data-md-component = "main" >
< div class = "md-main__inner md-grid" >
< div class = "md-sidebar md-sidebar--primary" data-md-component = "sidebar" data-md-type = "navigation" >
< div class = "md-sidebar__scrollwrap" >
< div class = "md-sidebar__inner" >
< nav class = "md-nav md-nav--primary md-nav--integrated" aria-label = "Navigation" data-md-level = "0" >
< label class = "md-nav__title" for = "__drawer" >
< a href = "../.." title = "SIG/Security Wiki" class = "md-nav__button md-logo" aria-label = "SIG/Security Wiki" data-md-component = "logo" >
< img src = "../../assets/icon-white.svg" alt = "logo" >
< / a >
SIG/Security Wiki
< / label >
< div class = "md-nav__source" >
< a href = "https://git.resf.org/security/wiki" title = "Go to repository" class = "md-source" data-md-component = "source" >
< div class = "md-source__icon md-icon" >
2023-12-14 22:29:36 +00:00
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 448 512" > <!-- ! Font Awesome Free 6.5.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2023 Fonticons, Inc. --> < path d = "M439.55 236.05 244 40.45a28.87 28.87 0 0 0-40.81 0l-40.66 40.63 51.52 51.52c27.06-9.14 52.68 16.77 43.39 43.68l49.66 49.66c34.23-11.8 61.18 31 35.47 56.69-26.49 26.49-70.21-2.87-56-37.34L240.22 199v121.85c25.3 12.54 22.26 41.85 9.08 55a34.34 34.34 0 0 1-48.55 0c-17.57-17.6-11.07-46.91 11.25-56v-123c-20.8-8.51-24.6-30.74-18.64-45L142.57 101 8.45 235.14a28.86 28.86 0 0 0 0 40.81l195.61 195.6a28.86 28.86 0 0 0 40.8 0l194.69-194.69a28.86 28.86 0 0 0 0-40.81z" / > < / svg >
2023-10-13 20:03:09 +00:00
< / div >
< div class = "md-source__repository" >
security/wiki
< / div >
< / a >
< / div >
< ul class = "md-nav__list" data-md-scrollfix >
2023-11-27 13:49:44 +00:00
2023-10-13 20:03:09 +00:00
< li class = "md-nav__item" >
< a href = "../.." class = "md-nav__link" >
< span class = "md-ellipsis" >
SIG/Security Wiki
< / span >
< / a >
< / li >
2023-11-15 21:59:06 +00:00
2023-11-27 13:49:44 +00:00
2023-12-18 22:34:23 +00:00
< li class = "md-nav__item" >
2023-12-18 23:05:26 +00:00
< a href = "../../news/" class = "md-nav__link" >
2023-12-18 22:34:23 +00:00
< span class = "md-ellipsis" >
2023-12-18 23:05:26 +00:00
News
2023-12-18 22:34:23 +00:00
< / span >
< / a >
< / li >
2023-11-15 21:59:06 +00:00
< li class = "md-nav__item md-nav__item--section md-nav__item--nested" >
2023-12-18 22:34:23 +00:00
< input class = "md-nav__toggle md-toggle md-toggle--indeterminate" type = "checkbox" id = "__nav_3" >
2023-11-15 21:59:06 +00:00
2023-12-18 22:34:23 +00:00
< label class = "md-nav__link" for = "__nav_3" id = "__nav_3_label" tabindex = "" >
2023-11-15 21:59:06 +00:00
< span class = "md-ellipsis" >
Issues
< / span >
< span class = "md-nav__icon md-icon" > < / span >
< / label >
2023-12-18 22:34:23 +00:00
< nav class = "md-nav" data-md-level = "1" aria-labelledby = "__nav_3_label" aria-expanded = "false" >
< label class = "md-nav__title" for = "__nav_3" >
2023-11-15 21:59:06 +00:00
< span class = "md-nav__icon md-icon" > < / span >
Issues
< / label >
< ul class = "md-nav__list" data-md-scrollfix >
2023-11-27 13:49:44 +00:00
2023-11-15 21:59:06 +00:00
< li class = "md-nav__item" >
< a href = "../../issues/CVE-2023-23583/" class = "md-nav__link" >
< span class = "md-ellipsis" >
2023-11-15 23:24:03 +00:00
CVE-2023-23583: microcode_ctl
2023-11-15 21:59:06 +00:00
< / span >
< / a >
< / li >
2023-11-27 13:49:44 +00:00
2023-11-15 21:59:06 +00:00
< li class = "md-nav__item" >
< a href = "../../issues/CVE-2023-4911/" class = "md-nav__link" >
< span class = "md-ellipsis" >
2023-11-15 23:24:03 +00:00
CVE-2023-4911: glibc
2023-11-15 21:59:06 +00:00
< / span >
< / a >
< / li >
< / ul >
< / nav >
< / li >
2023-10-13 20:03:09 +00:00
2023-11-27 13:49:44 +00:00
2023-10-13 20:03:09 +00:00
2023-11-16 19:31:38 +00:00
2023-10-13 20:03:09 +00:00
2023-11-14 20:43:12 +00:00
2023-12-14 22:29:36 +00:00
2023-11-15 21:59:06 +00:00
2023-11-14 20:43:12 +00:00
2023-10-13 20:03:09 +00:00
< li class = "md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested" >
2023-12-18 22:34:23 +00:00
< input class = "md-nav__toggle md-toggle " type = "checkbox" id = "__nav_4" checked >
2023-10-13 20:03:09 +00:00
2023-12-18 22:34:23 +00:00
< label class = "md-nav__link" for = "__nav_4" id = "__nav_4_label" tabindex = "" >
2023-10-13 20:03:09 +00:00
< span class = "md-ellipsis" >
Packages
< / span >
< span class = "md-nav__icon md-icon" > < / span >
< / label >
2023-12-18 22:34:23 +00:00
< nav class = "md-nav" data-md-level = "1" aria-labelledby = "__nav_4_label" aria-expanded = "true" >
< label class = "md-nav__title" for = "__nav_4" >
2023-10-13 20:03:09 +00:00
< span class = "md-nav__icon md-icon" > < / span >
Packages
< / label >
< ul class = "md-nav__list" data-md-scrollfix >
2023-12-14 22:29:36 +00:00
< li class = "md-nav__item" >
< a href = "../control/" class = "md-nav__link" >
< span class = "md-ellipsis" >
Extra package: control
< / span >
< / a >
< / li >
2023-10-13 20:03:09 +00:00
2023-11-27 13:49:44 +00:00
2023-10-13 20:03:09 +00:00
< li class = "md-nav__item md-nav__item--active" >
< input class = "md-nav__toggle md-toggle" type = "checkbox" id = "__toc" >
< label class = "md-nav__link md-nav__link--active" for = "__toc" >
< span class = "md-ellipsis" >
Override package: glibc
< / span >
< span class = "md-nav__icon md-icon" > < / span >
< / label >
< a href = "./" class = "md-nav__link md-nav__link--active" >
< span class = "md-ellipsis" >
Override package: glibc
< / span >
< / a >
< nav class = "md-nav md-nav--secondary" aria-label = "Table of contents" >
< label class = "md-nav__title" for = "__toc" >
< span class = "md-nav__icon md-icon" > < / span >
Table of contents
< / label >
< ul class = "md-nav__list" data-md-component = "toc" data-md-scrollfix >
< li class = "md-nav__item" >
< a href = "#el9" class = "md-nav__link" >
2023-11-19 20:04:35 +00:00
< span class = "md-ellipsis" >
EL9
< / span >
2023-10-13 20:03:09 +00:00
< / a >
< nav class = "md-nav" aria-label = "EL9" >
< ul class = "md-nav__list" >
< li class = "md-nav__item" >
< a href = "#changes-summary" class = "md-nav__link" >
2023-11-19 20:04:35 +00:00
< span class = "md-ellipsis" >
Changes summary
< / span >
2023-10-13 20:03:09 +00:00
< / a >
< nav class = "md-nav" aria-label = "Changes summary" >
< ul class = "md-nav__list" >
< li class = "md-nav__item" >
< a href = "#known-effective-vulnerability-mitigations-and-fixes" class = "md-nav__link" >
2023-11-19 20:04:35 +00:00
< span class = "md-ellipsis" >
Known-effective vulnerability mitigations and fixes
< / span >
2023-10-13 20:03:09 +00:00
< / a >
< / li >
< / ul >
< / nav >
< / li >
< li class = "md-nav__item" >
< a href = "#change-log" class = "md-nav__link" >
2023-11-19 20:04:35 +00:00
< span class = "md-ellipsis" >
Change log
< / span >
2023-10-13 20:03:09 +00:00
< / a >
< / li >
< / ul >
< / nav >
< / li >
< / ul >
< / nav >
< / li >
2023-11-27 13:49:44 +00:00
2023-11-14 20:43:12 +00:00
< li class = "md-nav__item" >
< a href = "../hardened_malloc/" class = "md-nav__link" >
< span class = "md-ellipsis" >
Extra package: hardened_malloc
< / span >
< / a >
< / li >
2023-11-27 13:49:44 +00:00
2023-11-16 19:31:38 +00:00
< li class = "md-nav__item" >
< a href = "../lkrg/" class = "md-nav__link" >
< span class = "md-ellipsis" >
Extra package: lkrg
< / span >
< / a >
< / li >
2023-11-27 13:49:44 +00:00
2023-11-15 21:59:06 +00:00
< li class = "md-nav__item" >
< a href = "../microcode_ctl/" class = "md-nav__link" >
< span class = "md-ellipsis" >
Override package: microcode_ctl
< / span >
< / a >
< / li >
2023-11-27 13:49:44 +00:00
2023-10-13 20:03:09 +00:00
< li class = "md-nav__item" >
< a href = "../openssh/" class = "md-nav__link" >
< span class = "md-ellipsis" >
Override package: openssh
< / span >
2023-11-16 19:31:38 +00:00
< / a >
< / li >
2023-11-27 13:49:44 +00:00
2023-11-16 19:31:38 +00:00
< li class = "md-nav__item" >
< a href = "../passwdqc/" class = "md-nav__link" >
< span class = "md-ellipsis" >
Extra package: passwdqc
< / span >
2023-10-13 20:03:09 +00:00
< / a >
< / li >
< / ul >
< / nav >
< / li >
< / ul >
< / nav >
< / div >
< / div >
< / div >
< div class = "md-content" data-md-component = "content" >
< article class = "md-content__inner md-typeset" >
< a href = "https://git.resf.org/security/wiki/_edit/main/docs/packages/glibc.md" title = "Edit this page" class = "md-content__button md-icon" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4v-2m10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1 2.1 2.1Z" / > < / svg >
< / a >
< h1 id = "override-package-glibc" > Override package: glibc< a class = "headerlink" href = "#override-package-glibc" title = "Permanent link" > ¶ < / a > < / h1 >
< h2 id = "el9" > EL9< a class = "headerlink" href = "#el9" title = "Permanent link" > ¶ < / a > < / h2 >
< ul >
2024-02-01 22:04:43 +00:00
< li > Version < code > 2.34-83.7.el9_3.security.0.4< / code > < / li >
2023-11-27 13:49:44 +00:00
< li > Based on < code > 2.34-83.el9.7< / code > < / li >
2023-10-13 20:03:09 +00:00
< / ul >
< h3 id = "changes-summary" > Changes summary< a class = "headerlink" href = "#changes-summary" title = "Permanent link" > ¶ < / a > < / h3 >
< ul >
< li > Distrust and/or unset many more environment variables used by current and previous glibc versions when running SUID/SGID/setcap (Owl via ALT Linux)< / li >
2024-02-01 22:04:43 +00:00
< li > When < code > syslog(3)< / code > /< code > vsyslog(3)< / code > is called by a SUID/SGID/setcap program without a preceding call to < code > openlog(3)< / code > , don't blindly trust < code > __progname< / code > for the syslog ident (Owl via ALT Linux, further revised for Rocky Linux)< / li >
2023-10-13 20:03:09 +00:00
< li > In < code > syslog(3)/vsyslog(3)< / code > use < code > asctime_r(3)+localtime_r(3)< / code > instead of < code > strftime_r()< / code > so that month names don't depend on current locale settings (Owl via ALT Linux)< / li >
< li > In < code > asprintf(3)/vasprintf(3)< / code > reset the pointer to NULL on error, like BSDs do, so that the caller wouldn't access memory over an uninitialized or stale pointer (ALT Linux)< / li >
< li > In < code > fread(3)/fwrite(3)< / code > check for potential integer overflow (ALT Linux)< / li >
< li > In < code > tmpfile(3)< / code > use the < code > TMPDIR< / code > environment variable (when not running SUID/SGID/setcap) (ALT Linux)< / li >
2024-02-01 22:04:43 +00:00
< li > When < code > qsort(3)< / code > is wrongly used with a nontransitive comparison function, nevertheless be robust and avoid < a href = "https://www.openwall.com/lists/oss-security/2024/01/30/7" > memory corruption< / a > (Qualys, Rocky Linux)< / li >
2023-10-13 20:03:09 +00:00
< / ul >
< h4 id = "known-effective-vulnerability-mitigations-and-fixes" > Known-effective vulnerability mitigations and fixes< a class = "headerlink" href = "#known-effective-vulnerability-mitigations-and-fixes" title = "Permanent link" > ¶ < / a > < / h4 >
2023-11-27 13:49:44 +00:00
< p > < code > 2.34-60.el9_2.security.0.2< / code > included mitigations sufficient to avoid security exposure of < a href = "../../issues/CVE-2023-4911/" > CVE-2023-4911< / a > and a backport of upstream glibc fix of < a href = "https://www.openwall.com/lists/oss-security/2023/09/25/1" > CVE-2023-4527< / a > that was not yet in upstream EL. In the update to < code > 2.34-60.7.el9_2.security.0.3< / code > and beyond, we retained the mitigations while rebasing on upstream EL's package with upstream fixes for these vulnerabilities (and more).< / p >
2023-10-13 20:03:09 +00:00
< p > In general, inclusion of additional security fixes will be "reverted" if and when those get included in upstream EL packages that we rebase our changes on.< / p >
< h3 id = "change-log" > Change log< a class = "headerlink" href = "#change-log" title = "Permanent link" > ¶ < / a > < / h3 >
2024-02-01 22:04:43 +00:00
< div class = "highlight" > < pre > < span > < / span > < code > * Wed Jan 31 2024 Solar Designer < solar@openwall.com> - 2.34-83.7.el9.security.0.4
- Harden syslog ident fallback initialization to use at most 64 characters of
__progname when __libc_enable_secure, as inspired by Qualys' discovery of
related vulnerabilities in newer glibc (not yet present in this version):
https://www.openwall.com/lists/oss-security/2024/01/30/6
- Harden qsort against nontransitive comparison functions as suggested by
Qualys: https://www.openwall.com/lists/oss-security/2024/01/30/7
* Wed Nov 22 2023 Solar Designer < solar@openwall.com> - 2.34-83.7.el9.security.0.3
2023-11-27 13:49:44 +00:00
- Rebase on 2.34-83.7, drop " our" CVE-2023-4527 patch in favor of RH' s
(a similar rebase was made on Oct 6 in 2.34-60.7.el9.security.0.3 for 9.2)
2023-10-13 20:03:09 +00:00
2023-11-27 13:49:44 +00:00
[... upstream changes ...]
2023-10-13 20:03:09 +00:00
2023-11-27 13:49:44 +00:00
* Fri Oct 6 2023 Solar Designer < solar@openwall.com> - 2.34-60.7.el9.security.0.3
- Rebase on 2.34-60.7, drop " our" CVE-2023-4527 patch in favor of RH' s
2023-10-13 20:03:09 +00:00
2023-11-27 13:49:44 +00:00
[... upstream changes ...]
2023-10-13 20:03:09 +00:00
* Mon Oct 2 2023 Solar Designer < solar@openwall.com> - 2.34-60.el9.security.0.2
- Add glibc-owl-alt-sanitize-env.patch stitched from several ALT Linux commits
as none of their revisions matched this package' s set of backports as-is
- Add glibc-upstream-no-aaaa-CVE-2023-4527.patch based on upstream commit
bd77dd7e73e3530203be1c52c8a29d08270cb25d fixing
CVE-2023-4527: Stack read overflow with large TCP responses in no-aaaa mode
* Tue Sep 26 2023 Solar Designer < solar@openwall.com> - 2.34-60.el9.security.0.1
- Revise the texinfo documentation edit of glibc-2.34-alt-asprintf.patch via
glibc-2.34-rocky-asprintf.patch
* Sat Sep 23 2023 Solar Designer < solar@openwall.com> - 2.34-60.el9.security.0.0
- Add some of the patches from ALT Linux as of when they were at 2.34:
https://git.altlinux.org/gears/g/glibc.git
git show 5fa32fb0f8509f4b2b1105d71b45966dfbadc099 > glibc-2.34-alt-tmpfile.patch
git show f97e5d60a6a4c9cb64e3b9ee6f5113969cf07d87 > glibc-2.34-alt-asprintf.patch
git show cd45d0f74560325cc48aedb9f56881270ab3dfab > glibc-2.34-alt-libio-bound.patch
git show 436eb1017c04aee3a553c2868d00a4b046e5e394 > glibc-2.34-owl-alt-syslog-ident.patch
git show 03a86c234873723c26b7e387c498c1332c223968 > glibc-2.34-mjt-owl-alt-syslog-timestamp.patch
< / code > < / pre > < / div >
2023-12-14 22:29:36 +00:00
< aside class = "md-source-file" >
2023-10-13 20:03:09 +00:00
2023-12-14 22:29:36 +00:00
< span class = "md-source-file__fact" >
< span class = "md-icon" title = "Last update" >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1-2.1-2M12.5 7v5.2l4 2.4-1 1L11 13V7h1.5M11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2v1.8Z" / > < / svg >
< / span >
2024-02-01 22:04:43 +00:00
< span class = "git-revision-date-localized-plugin git-revision-date-localized-plugin-date" > January 31, 2024< / span >
2023-12-14 22:29:36 +00:00
< / span >
2023-10-13 20:03:09 +00:00
2023-12-14 22:29:36 +00:00
< / aside >
2023-10-13 20:03:09 +00:00
< / article >
< / div >
2023-12-14 22:29:36 +00:00
< script > var target = document . getElementById ( location . hash . slice ( 1 ) ) ; target && target . name && ( target . checked = target . name . startsWith ( "__tabbed_" ) ) < / script >
2023-10-13 20:03:09 +00:00
< / div >
< button type = "button" class = "md-top md-icon" data-md-component = "top" hidden >
< svg xmlns = "http://www.w3.org/2000/svg" viewBox = "0 0 24 24" > < path d = "M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8v12Z" / > < / svg >
Back to top
< / button >
< / main >
< footer class = "md-footer" >
< div class = "md-footer-meta md-typeset" >
< div class = "md-footer-meta__inner md-grid" >
< div class = "md-copyright" >
< div class = "md-copyright__highlight" >
Copyright © 2023 Rocky Enterprise Software Foundation
< / div >
Made with
< a href = "https://squidfunk.github.io/mkdocs-material/" target = "_blank" rel = "noopener" >
Material for MkDocs
< / a >
< / div >
< / div >
< / div >
< / footer >
< / div >
< div class = "md-dialog" data-md-component = "dialog" >
< div class = "md-dialog__inner md-typeset" > < / div >
< / div >
2024-02-01 22:04:43 +00:00
< script id = "__config" type = "application/json" > { "base" : "../.." , "features" : [ "navigation.expand" , "navigation.indexes" , "navigation.instant" , "navigation.sections" , "navigation.top" , "navigation.tracking" , "navigation.path" , "search.highlight" , "search.suggest" , "toc.integrate" , "content.action.edit" ] , "search" : "../../assets/javascripts/workers/search.b8dbb3d2.min.js" , "translations" : { "clipboard.copied" : "Copied to clipboard" , "clipboard.copy" : "Copy to clipboard" , "search.result.more.one" : "1 more on this page" , "search.result.more.other" : "# more on this page" , "search.result.none" : "No matching documents" , "search.result.one" : "1 matching document" , "search.result.other" : "# matching documents" , "search.result.placeholder" : "Type to start searching" , "search.result.term.missing" : "Missing" , "select.version" : "Select version" } } < / script >
2023-10-13 20:03:09 +00:00
2024-02-01 22:04:43 +00:00
< script src = "../../assets/javascripts/bundle.e1c3ead8.min.js" > < / script >
2023-10-13 20:03:09 +00:00
< / body >
< / html >
