CVE-2018-1000001

In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.

• CVE-2018-6485: fix integer overflows in memalign and malloc
• CVE-2018-1000001: fix realpath buffer underflow via getcwd
• CVE-2018-19591: fix if_nametoindex descriptor leak

• CVE-2018-6485: fix integer overflows in memalign and malloc
• CVE-2018-1000001: fix realpath buffer underflow via getcwd
• CVE-2018-19591: fix if_nametoindex descriptor leak

Updated glibc packages fix security vulnerabilities:

An issue in the code handling RPATHs was fixed that could have been exploited by an attacker to execute code loaded from arbitrary libraries (CVE-2017-16997).

A privilege escalation bug in the realpath() function when the getcwd() system call doesn't return a valid absolute pathname (CVE-2018-1000001).

Also, support for the C.UTF-8 locale has been added in the locales package.

An issue in the code handling RPATHs was fixed that could have been exploited by an attacker to execute code loaded from arbitrary libraries (CVE-2017-16997).

A privilege escalation bug in the realpath() function when the getcwd() system call doesn't return a valid absolute pathname (CVE-2018-1000001).

These are all security issues fixed in the glibc-2.34-1.2 package on the GA media of openSUSE Tumbleweed.

This update for glibc fixes the following issues:

• A privilege escalation bug in the realpath() function has been fixed. [CVE-2018-1000001, bsc#1074293]

This update for glibc fixes the following issues:

• A privilege escalation bug in the realpath() function has been fixed. [CVE-2018-1000001, bsc#1074293]

• A memory leak and a buffer overflow in the dynamic ELF loader has been fixed. [CVE-2017-1000408, CVE-2017-1000409, bsc#1071319]

• An issue in the code handling RPATHs was fixed that could have been exploited by an attacker to execute code loaded from arbitrary libraries. [CVE-2017-16997, bsc#1073231]

• A potential crash caused by a use-after-free bug in pthread_create() has been fixed. [bsc#1053188]

• A bug that prevented users to build shared objects which use the optimized libmvec.so API has been fixed. [bsc#1070905]

• A memory leak in the glob() function has been fixed. [CVE-2017-15670, CVE-2017-15671, CVE-2017-15804, bsc#1064569, bsc#1064580, bsc#1064583]

• A bug that would lose the syscall error code value in case of crashes has been fixed. [bsc#1063675]

This update for glibc fixes the following issues:

• A privilege escalation bug in the realpath() function has been fixed. [CVE-2018-1000001, bsc#1074293]

This update for glibc fixes the following issues:

• A privilege escalation bug in the realpath() function has been fixed. [CVE-2018-1000001, bsc#1074293]

• A buffer manipulation vulnerability in nscd has been fixed that could possibly have lead to an nscd daemon crash or code execution as the user running nscd. [CVE-2014-9984, bsc#1043984]

This update for glibc fixes the following issues:

Security issues fixed:

• CVE-2017-8804: Fix memory leak after deserialization failure in xdr_bytes, xdr_string (bsc#1037930)
• CVE-2017-12132: Reduce EDNS payload size to 1200 bytes (bsc#1051791)
• CVE-2018-6485,CVE-2018-6551: Fix integer overflows in internal memalign and malloc functions (bsc#1079036)
• CVE-2018-1000001: Avoid underflow of malloced area (bsc#1074293)

Non security bugs fixed:

• Release read lock after resetting timeout (bsc#1073990)

This update for glibc fixes the following issues:

Security issues:

• CVE-2017-8804: Fix memory leak after deserialization failure in xdr_bytes, xdr_string (bsc#1037930)
• CVE-2017-12132: Reduce EDNS payload size to 1200 bytes (bsc#1051791)
• CVE-2018-6485,CVE-2018-6551: Fix integer overflows in internal memalign and malloc functions (bsc#1079036)
• CVE-2018-1000001: Avoid underflow of malloced area in realpath (bsc#1074293)

Also a non security issue was fixed:

• Do not fail if one of the two responses to AF_UNSPEC fails (bsc#978209)

This update for glibc fixes the following issues:

Security issues fixed:

• CVE-2017-15804: Fix buffer overflow during unescaping of user names in the glob function in glob.c (bsc#1064580).
• CVE-2017-15670: Fix buffer overflow in glob with GLOB_TILDE (bsc#1064583).
• CVE-2017-15671: Fix memory leak in glob with GLOB_TILDE (bsc#1064569).
• CVE-2018-11236: Fix 32bit arch integer overflow in stdlib/canonicalize.c when processing very long pathname arguments (bsc#1094161).
• CVE-2017-12132: Reduce advertised EDNS0 buffer size to guard against fragmentation attacks (bsc#1051791).
• CVE-2018-1000001: Avoid underflow of malloced area (bsc#1074293).

It was discovered that the GNU C library did not properly handle all of the possible return values from the kernel getcwd(2) syscall. A local attacker could potentially exploit this to execute arbitrary code in setuid programs and gain administrative privileges. (CVE-2018-1000001)

A memory leak was discovered in the _dl_init_paths() function in the GNU C library dynamic loader. A local attacker could potentially exploit this with a specially crafted value in the LD_HWCAP_MASK environment variable, in combination with CVE-2017-1000409 and another vulnerability on a system with hardlink protections disabled, in order to gain administrative privileges. (CVE-2017-1000408)

A heap-based buffer overflow was discovered in the _dl_init_paths() function in the GNU C library dynamic loader. A local attacker could potentially exploit this with a specially crafted value in the LD_LIBRARY_PATH environment variable, in combination with CVE-2017-1000408 and another vulnerability on a system with hardlink protections disabled, in order to gain administrative privileges. (CVE-2017-1000409)

An off-by-one error leading to a heap-based buffer overflow was discovered in the GNU C library glob() implementation. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code via a maliciously crafted pattern. (CVE-2017-15670)

A heap-based buffer overflow was discovered during unescaping of user names with the ~ operator in the GNU C library glob() implementation. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code via a maliciously crafted pattern. (CVE-2017-15804)

It was discovered that the GNU C library dynamic loader mishandles RPATH and RUNPATH containing $ORIGIN for privileged (setuid or AT_SECURE) programs. A local attacker could potentially exploit this by providing a specially crafted library in the current working directory in order to gain administrative privileges. (CVE-2017-16997)

It was discovered that the GNU C library malloc() implementation could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, resulting in a heap-based overflow. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 17.10. (CVE-2017-17426)

It was discovered that musl did not properly handle kernel syscalls. An attacker could use this vulnerability to cause a denial of service (crash) or possibly execute arbitrary code. (CVE-2018-1000001)

It was discovered that musl did not properly handle the parsing of DNS response codes. A remote attacker could use this vulnerability to cause resource consumption (infinite loop), denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 ESM. (CVE-2014-3484)

It was discovered that musl did not properly handle the parsing of DNS response codes. A remote attacker could use this vulnerability to cause resource consumption (infinite loop), denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 ESM. (CVE-2017-15650)

It was discovered that musl did not properly handle the parsing of ipv6 addresses. An attacker could use this vulnerability to cause a denial of service (crash) or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 ESM. (CVE-2015-1817)

It was discovered that TRE library, used by musl, did not properly handle certain inputs. An attacker could use this vulnerability to cause a denial of service (crash). (CVE-2016-8859)