Skip to content

Override package: glibc

EL9

  • Version 2.34-125.1.el9_5.security.0.10
  • Based on 2.34-125.el9_5.1

Changes summary

  • Distrust and/or unset many more environment variables used by current and previous glibc versions when running SUID/SGID/setcap (Owl via ALT Linux)
  • When syslog(3)/vsyslog(3) is called by a SUID/SGID/setcap program without a preceding call to openlog(3), don't blindly trust __progname for the syslog ident (Owl via ALT Linux, further revised for Rocky Linux)
  • In syslog(3)/vsyslog(3) use asctime_r(3)+localtime_r(3) instead of strftime_r() so that month names don't depend on current locale settings (Owl via ALT Linux)
  • In asprintf(3)/vasprintf(3) reset the pointer to NULL on error, like BSDs do, so that the caller wouldn't access memory over an uninitialized or stale pointer (ALT Linux)
  • In fread(3)/fwrite(3) check for potential integer overflow (ALT Linux)
  • In tmpfile(3) use the TMPDIR environment variable (when not running SUID/SGID/setcap) (ALT Linux)
  • When qsort(3) is wrongly used with a nontransitive comparison function, nevertheless be robust and avoid memory corruption (Qualys, Rocky Linux)

Known-effective vulnerability mitigations and fixes

2.34-83.12.el9_3.security.0.6 and above includes nscd CVE-2024-33599, CVE-2024-33600, CVE-2024-33601, CVE-2024-33602 fixes from upstream glibc 2.34 branch, which upstream EL also included starting with 2.34-100.el9_4.2.

2.34-83.12.el9_3.security.0.5 and above includes iconv(3) ISO-2022-CN-EXT CVE-2024-2961 fix from upstream glibc 2.34 branch, which upstream EL also included starting with 2.34-100.el9_4.2.

2.34-60.el9_2.security.0.2 included mitigations sufficient to avoid security exposure of CVE-2023-4911 and a backport of upstream glibc fix of CVE-2023-4527 that was not yet in upstream EL. In the update to 2.34-60.7.el9_2.security.0.3 and beyond, we retained the mitigations while rebasing on upstream EL's package with upstream fixes for these vulnerabilities (and more).

In general, inclusion of additional security fixes will be "reverted" if and when those get included in upstream EL packages that we rebase our changes on.

Change log

* Thu Nov 21 2024 Solar Designer <solar@openwall.com> - 2.34-125.1.el9.security.0.10
- Rebase on 2.34-125.1

* Thu Jun 13 2024 Solar Designer <solar@openwall.com> - 2.34-100.2.el9.security.0.9
- Rebase on 2.34-100.2

* Mon May 20 2024 Solar Designer <solar@openwall.com> - 2.34-100.el9.security.0.8
- Rebase on 2.34-100

* Tue May 07 2024 Solar Designer <solar@openwall.com> - 2.34-83.12.el9.security.0.7
- Upstream glibc 2.34 fix "nscd: Use time_t for return type of addgetnetgrentX"

* Tue Apr 30 2024 Solar Designer <solar@openwall.com> - 2.34-83.12.el9.security.0.6
- Add nscd CVE-2024-33599, CVE-2024-33600, CVE-2024-33601, CVE-2024-33602 fixes
  from upstream glibc 2.34 branch

* Thu Apr 18 2024 Solar Designer <solar@openwall.com> - 2.34-83.12.el9.security.0.5
- Rebase on 2.34-83.12
- Add iconv() ISO-2022-CN-EXT CVE-2024-2961 fix from upstream glibc 2.34 branch

* Wed Jan 31 2024 Solar Designer <solar@openwall.com> - 2.34-83.7.el9.security.0.4
- Harden syslog ident fallback initialization to use at most 64 characters of
  __progname when __libc_enable_secure, as inspired by Qualys' discovery of
  related vulnerabilities in newer glibc (not yet present in this version):
  https://www.openwall.com/lists/oss-security/2024/01/30/6
- Harden qsort against nontransitive comparison functions as suggested by
  Qualys: https://www.openwall.com/lists/oss-security/2024/01/30/7

* Wed Nov 22 2023 Solar Designer <solar@openwall.com> - 2.34-83.7.el9.security.0.3
- Rebase on 2.34-83.7, drop "our" CVE-2023-4527 patch in favor of RH's
  (a similar rebase was made on Oct 6 in 2.34-60.7.el9.security.0.3 for 9.2)

* Mon Oct  2 2023 Solar Designer <solar@openwall.com> - 2.34-60.el9.security.0.2
- Add glibc-owl-alt-sanitize-env.patch stitched from several ALT Linux commits
  as none of their revisions matched this package's set of backports as-is
- Add glibc-upstream-no-aaaa-CVE-2023-4527.patch based on upstream commit
  bd77dd7e73e3530203be1c52c8a29d08270cb25d fixing
  CVE-2023-4527: Stack read overflow with large TCP responses in no-aaaa mode

* Tue Sep 26 2023 Solar Designer <solar@openwall.com> - 2.34-60.el9.security.0.1
- Revise the texinfo documentation edit of glibc-2.34-alt-asprintf.patch via
  glibc-2.34-rocky-asprintf.patch

* Sat Sep 23 2023 Solar Designer <solar@openwall.com> - 2.34-60.el9.security.0.0
- Add some of the patches from ALT Linux as of when they were at 2.34:
  https://git.altlinux.org/gears/g/glibc.git
  git show 5fa32fb0f8509f4b2b1105d71b45966dfbadc099 > glibc-2.34-alt-tmpfile.patch
  git show f97e5d60a6a4c9cb64e3b9ee6f5113969cf07d87 > glibc-2.34-alt-asprintf.patch
  git show cd45d0f74560325cc48aedb9f56881270ab3dfab > glibc-2.34-alt-libio-bound.patch
  git show 436eb1017c04aee3a553c2868d00a4b046e5e394 > glibc-2.34-owl-alt-syslog-ident.patch
  git show 03a86c234873723c26b7e387c498c1332c223968 > glibc-2.34-mjt-owl-alt-syslog-timestamp.patch