wok-current view glibc/stuff/CVE-2025-4802.patch @ rev 25775
Patch glibc (CVE-2025-4802)
| author | Stanislas Leduc <shann@slitaz.org> |
|---|---|
| date | Thu May 22 19:19:31 2025 +0000 (5 months ago) |
| parents | |
| children | e92a5b32321f |
line source
1 From 5451fa962cd0a90a0e2ec1d8910a559ace02bba0 Mon Sep 17 00:00:00 2001
2 From: Adhemerval Zanella <adhemerval.zanella@linaro.org>
3 Date: Mon, 6 Nov 2023 17:25:49 -0300
4 Subject: elf: Ignore LD_LIBRARY_PATH and debug env var for setuid for static
6 It mimics the ld.so behavior.
8 Checked on x86_64-linux-gnu.
9 Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
10 Adjust for backport to glibc 2.28
11 ---
12 elf/dl-support.c | 32 ++++++++++++++++----------------
13 1 file changed, 16 insertions(+), 16 deletions(-)
15 diff --git a/elf/dl-support.c b/elf/dl-support.c
16 index 31a608df87..837fa1c836 100644
17 --- a/elf/dl-support.c
18 +++ b/elf/dl-support.c
19 @@ -317,12 +317,34 @@
20 if (HP_SMALL_TIMING_AVAIL)
21 HP_TIMING_NOW (_dl_cpuclock_offset);
23 - _dl_verbose = *(getenv ("LD_WARN") ?: "") == '\0' ? 0 : 1;
24 -
25 /* Set up the data structures for the system-supplied DSO early,
26 so they can influence _dl_init_paths. */
27 setup_vdso (NULL, NULL);
29 + if (__libc_enable_secure)
30 + {
31 + static const char unsecure_envvars[] =
32 + UNSECURE_ENVVARS
33 +#ifdef EXTRA_UNSECURE_ENVVARS
34 + EXTRA_UNSECURE_ENVVARS
35 +#endif
36 + ;
37 + const char *cp = unsecure_envvars;
38 +
39 + while (cp < unsecure_envvars + sizeof (unsecure_envvars))
40 + {
41 + __unsetenv (cp);
42 + cp = (const char *) __rawmemchr (cp, '\0') + 1;
43 + }
44 +
45 +#if !HAVE_TUNABLES
46 + if (__access ("/etc/suid-debug", F_OK) != 0)
47 + __unsetenv ("MALLOC_CHECK_");
48 +#endif
49 + }
50 +
51 + _dl_verbose = *(getenv ("LD_WARN") ?: "") == '\0' ? 0 : 1;
52 +
53 /* Initialize the data structures for the search paths for shared
54 objects. */
55 _dl_init_paths (getenv ("LD_LIBRARY_PATH"));
56 @@ -340,28 +362,6 @@
57 if (_dl_profile_output == NULL || _dl_profile_output[0] == '\0')
58 _dl_profile_output
59 = &"/var/tmp\0/var/profile"[__libc_enable_secure ? 9 : 0];
60 -
61 - if (__libc_enable_secure)
62 - {
63 - static const char unsecure_envvars[] =
64 - UNSECURE_ENVVARS
65 -#ifdef EXTRA_UNSECURE_ENVVARS
66 - EXTRA_UNSECURE_ENVVARS
67 -#endif
68 - ;
69 - const char *cp = unsecure_envvars;
70 -
71 - while (cp < unsecure_envvars + sizeof (unsecure_envvars))
72 - {
73 - __unsetenv (cp);
74 - cp = (const char *) __rawmemchr (cp, '\0') + 1;
75 - }
76 -
77 -#if !HAVE_TUNABLES
78 - if (__access ("/etc/suid-debug", F_OK) != 0)
79 - __unsetenv ("MALLOC_CHECK_");
80 -#endif
81 - }
83 #ifdef DL_PLATFORM_INIT
84 DL_PLATFORM_INIT;
86 --
87 cgit