⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.184
Server IP:
65.21.180.239
Server:
Linux gowhm.eplangoweb.com 5.4.0-216-generic #236-Ubuntu SMP Fri Apr 11 19:53:21 UTC 2025 x86_64
Server Software:
Apache
PHP Version:
8.0.30
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
proc
/
self
/
root
/
usr
/
src
/
glibc
/
debian
/
patches
/
any
/
View File Name :
CVE-2025-0395.patch
From 68ee0f704cb81e9ad0a78c644a83e1e9cd2ee578 Mon Sep 17 00:00:00 2001 From: Siddhesh Poyarekar <siddhesh@sourceware.org> Date: Tue, 21 Jan 2025 16:11:06 -0500 Subject: [PATCH 1/1] Fix underallocation of abort_msg_s struct (CVE-2025-0395) Include the space needed to store the length of the message itself, in addition to the message string. This resolves BZ #32582. Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> Reviewed: Adhemerval Zanella <adhemerval.zanella@linaro.org> --- assert/assert.c | 4 +++- sysdeps/posix/libc_fatal.c | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) Index: glibc-2.31/assert/assert.c =================================================================== --- glibc-2.31.orig/assert/assert.c +++ glibc-2.31/assert/assert.c @@ -18,6 +18,7 @@ #include <assert.h> #include <atomic.h> #include <ldsodefs.h> +#include <libc-pointer-arith.h> #include <libintl.h> #include <stdio.h> #include <stdlib.h> @@ -64,7 +65,8 @@ __assert_fail_base (const char *fmt, con (void) __fxprintf (NULL, "%s", str); (void) fflush (stderr); - total = (total + 1 + GLRO(dl_pagesize) - 1) & ~(GLRO(dl_pagesize) - 1); + total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1, + GLRO(dl_pagesize)); struct abort_msg_s *buf = __mmap (NULL, total, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0); if (__glibc_likely (buf != MAP_FAILED)) Index: glibc-2.31/sysdeps/posix/libc_fatal.c =================================================================== --- glibc-2.31.orig/sysdeps/posix/libc_fatal.c +++ glibc-2.31/sysdeps/posix/libc_fatal.c @@ -20,6 +20,7 @@ #include <errno.h> #include <fcntl.h> #include <ldsodefs.h> +#include <libc-pointer-arith.h> #include <paths.h> #include <stdarg.h> #include <stdbool.h> @@ -125,8 +126,8 @@ __libc_message (enum __libc_message_acti if ((action & do_abort)) { - total = ((total + 1 + GLRO(dl_pagesize) - 1) - & ~(GLRO(dl_pagesize) - 1)); + total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1, + GLRO(dl_pagesize)); struct abort_msg_s *buf = __mmap (NULL, total, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0);