Vulmon
Amazon Linux AMI Security Advisory: ALAS-2021-1511
Advisory Release Date: 2021-07-08 18:38 Pacific
Advisory Updated Date: 2021-07-12 21:49 Pacific
A vulnerability was discovered in glibc where the LD_PREFER_MAP_32BIT_EXEC environment variable is not ignored when running binaries with the setuid flag on x86_64 architectures. This allows an attacker to force system to utilize only half of the memory (making the system think the software is 32-bit only), thus lowering the amount of memory being used with address space layout randomization (ASLR). The highest threat is confidentiality although the complexity of attack is high. The affected application must already have other vulnerabilities for this flaw to be usable. (CVE-2019-19126)
A flaw was found in glibc. When processing input in the EUC-KR encoding, an invalid input sequence could cause glibc to read beyond the end of a buffer, resulting in a segmentation fault. The highest threat from this vulnerability is to system availability. (CVE-2019-25013)
A flaw was found in glibc in versions prior to 2.32. Pseudo-zero values are not validated causing a stack corruption due to a stack-based overflow. The highest threat from this vulnerability is to system availability. (CVE-2020-10029)
A stack buffer overflow flaw was found in glibc in the way the printf family of functions processed an 80-bit long double with a non-canonical bit pattern. This flaw allows an attacker who can control the arguments of these functions with the non-standard long double pattern to trigger an overflow and cause an application crash. The highest threat from this vulnerability is to system availability. (CVE-2020-29573)
Affected Packages:
glibc
Issue Correction:
Run yum update glibc to update your system.
i686:
glibc-static-2.17-322.181.amzn1.i686
glibc-utils-2.17-322.181.amzn1.i686
glibc-headers-2.17-322.181.amzn1.i686
glibc-2.17-322.181.amzn1.i686
glibc-devel-2.17-322.181.amzn1.i686
glibc-common-2.17-322.181.amzn1.i686
glibc-debuginfo-2.17-322.181.amzn1.i686
glibc-debuginfo-common-2.17-322.181.amzn1.i686
nscd-2.17-322.181.amzn1.i686
src:
glibc-2.17-322.181.amzn1.src
x86_64:
nscd-2.17-322.181.amzn1.x86_64
glibc-debuginfo-common-2.17-322.181.amzn1.x86_64
glibc-headers-2.17-322.181.amzn1.x86_64
glibc-2.17-322.181.amzn1.x86_64
glibc-static-2.17-322.181.amzn1.x86_64
glibc-debuginfo-2.17-322.181.amzn1.x86_64
glibc-common-2.17-322.181.amzn1.x86_64
glibc-devel-2.17-322.181.amzn1.x86_64
glibc-utils-2.17-322.181.amzn1.x86_64