glibc: CVE-2018-1000001: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation

Debian Bug report logs - #887001
glibc: CVE-2018-1000001: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: glibc: CVE-2018-1000001: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation

Date: Fri, 12 Jan 2018 13:43:14 +0100

Source: glibc
Version: 2.19-18
Severity: grave
Tags: security upstream
Forwarded: https://sourceware.org/bugzilla/show_bug.cgi?id=18203

Hi glibc maintainers,

the following vulnerability was published for glibc, filling as grave
due to the privilege escalation potential, but by default in Debian
unprivileged userns clone is not enabled, so the attack reduced. The
issue should we think preferably be fixed in a point release.

CVE-2018-1000001[0]:
Libc Realpath Buffer Underflow

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-1000001
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000001
[1] http://www.openwall.com/lists/oss-security/2018/01/11/5
[2] https://sourceware.org/bugzilla/show_bug.cgi?id=18203
[3] https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/

Regards,
Salvatore

Message #12 received at 887001-submitter@bugs.debian.org (full text, mbox, reply):

From: Aurelien Jarno <aurelien@aurel32.net>

To: 887001-submitter@bugs.debian.org

Subject: Bug#887001 marked as pending

Date: Sat, 13 Jan 2018 15:14:18 +0000

tag 887001 pending
thanks

Hello,

Bug #887001 reported by you has been fixed in the Git repository. You can
see the changelog below, and you can check the diff of the fix at:

    https://anonscm.debian.org/cgit/pkg-glibc/glibc.git/commit/?id=82a8885

---
commit 82a888594125b1d05bed4092b23af44fc23907a2
Author: Aurelien Jarno <aurelien@aurel32.net>
Date:   Sat Jan 13 16:14:06 2018 +0100

    debian/patches/git-updates.diff: update from upstream stable branch:
    
    * debian/patches/git-updates.diff: update from upstream stable branch:
      - Fix a buffer underflow in getcwd() (CVE-2018-1000001).  Closes:
        #887001.

diff --git a/debian/changelog b/debian/changelog
index f72b868..f1cebf4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -5,6 +5,9 @@ glibc (2.26-4) UNRELEASED; urgency=medium
     the multilib flavours, simplify the mips* entries into mips*, mips be and
     mips le, instead of trying to keep all the flavours in sync. Remove
     XFAILs for tests that have been fixed.
+  * debian/patches/git-updates.diff: update from upstream stable branch:
+    - Fix a buffer underflow in getcwd() (CVE-2018-1000001).  Closes:
+      #887001.
 
  -- Aurelien Jarno <aurel32@debian.org>  Fri, 12 Jan 2018 22:26:33 +0100
 

Message #17 received at 887001-close@bugs.debian.org (full text, mbox, reply):

From: Aurelien Jarno <aurel32@debian.org>

To: 887001-close@bugs.debian.org

Subject: Bug#887001: fixed in glibc 2.26-4

Date: Sun, 14 Jan 2018 11:04:42 +0000

Source: glibc
Source-Version: 2.26-4

We believe that the bug you reported is fixed in the latest version of
glibc, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 887001@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Aurelien Jarno <aurel32@debian.org> (supplier of updated glibc package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 14 Jan 2018 11:24:48 +0100
Source: glibc
Binary: libc-bin libc-dev-bin libc-l10n glibc-doc glibc-source locales locales-all nscd multiarch-support libc6 libc6-dev libc6-dbg libc6-pic libc6-udeb libc6.1 libc6.1-dev libc6.1-dbg libc6.1-pic libc6.1-udeb libc0.3 libc0.3-dev libc0.3-dbg libc0.3-pic libc0.3-udeb libc0.1 libc0.1-dev libc0.1-dbg libc0.1-pic libc0.1-udeb libc6-i386 libc6-dev-i386 libc6-sparc libc6-dev-sparc libc6-sparc64 libc6-dev-sparc64 libc6-s390 libc6-dev-s390 libc6-amd64 libc6-dev-amd64 libc6-powerpc libc6-dev-powerpc libc6-ppc64 libc6-dev-ppc64 libc6-mips32 libc6-dev-mips32 libc6-mipsn32 libc6-dev-mipsn32 libc6-mips64 libc6-dev-mips64 libc0.1-i386 libc0.1-dev-i386 libc6-x32 libc6-dev-x32 libc6-xen libc0.3-xen libc6.1-alphaev67
Architecture: source
Version: 2.26-4
Distribution: unstable
Urgency: medium
Maintainer: GNU Libc Maintainers <debian-glibc@lists.debian.org>
Changed-By: Aurelien Jarno <aurel32@debian.org>
Description:
 glibc-doc  - GNU C Library: Documentation
 glibc-source - GNU C Library: sources
 libc-bin   - GNU C Library: Binaries
 libc-dev-bin - GNU C Library: Development binaries
 libc-l10n  - GNU C Library: localization files
 libc0.1    - GNU C Library: Shared libraries
 libc0.1-dbg - GNU C Library: detached debugging symbols
 libc0.1-dev - GNU C Library: Development Libraries and Header Files
 libc0.1-dev-i386 - GNU C Library: 32bit development libraries for AMD64
 libc0.1-i386 - GNU C Library: 32bit shared libraries for AMD64
 libc0.1-pic - GNU C Library: PIC archive library
 libc0.1-udeb - GNU C Library: Shared libraries - udeb (udeb)
 libc0.3    - GNU C Library: Shared libraries
 libc0.3-dbg - GNU C Library: detached debugging symbols
 libc0.3-dev - GNU C Library: Development Libraries and Header Files
 libc0.3-pic - GNU C Library: PIC archive library
 libc0.3-udeb - GNU C Library: Shared libraries - udeb (udeb)
 libc0.3-xen - GNU C Library: Shared libraries [Xen version]
 libc6      - GNU C Library: Shared libraries
 libc6-amd64 - GNU C Library: 64bit Shared libraries for AMD64
 libc6-dbg  - GNU C Library: detached debugging symbols
 libc6-dev  - GNU C Library: Development Libraries and Header Files
 libc6-dev-amd64 - GNU C Library: 64bit Development Libraries for AMD64
 libc6-dev-i386 - GNU C Library: 32-bit development libraries for AMD64
 libc6-dev-mips32 - GNU C Library: o32 Development Libraries for MIPS
 libc6-dev-mips64 - GNU C Library: 64bit Development Libraries for MIPS64
 libc6-dev-mipsn32 - GNU C Library: n32 Development Libraries for MIPS64
 libc6-dev-powerpc - GNU C Library: 32bit powerpc development libraries for ppc64
 libc6-dev-ppc64 - GNU C Library: 64bit Development Libraries for PowerPC64
 libc6-dev-s390 - GNU C Library: 32bit Development Libraries for IBM zSeries
 libc6-dev-sparc - GNU C Library: 32bit Development Libraries for SPARC
 libc6-dev-sparc64 - GNU C Library: 64bit Development Libraries for UltraSPARC
 libc6-dev-x32 - GNU C Library: X32 ABI Development Libraries for AMD64
 libc6-i386 - GNU C Library: 32-bit shared libraries for AMD64
 libc6-mips32 - GNU C Library: o32 Shared libraries for MIPS
 libc6-mips64 - GNU C Library: 64bit Shared libraries for MIPS64
 libc6-mipsn32 - GNU C Library: n32 Shared libraries for MIPS64
 libc6-pic  - GNU C Library: PIC archive library
 libc6-powerpc - GNU C Library: 32bit powerpc shared libraries for ppc64
 libc6-ppc64 - GNU C Library: 64bit Shared libraries for PowerPC64
 libc6-s390 - GNU C Library: 32bit Shared libraries for IBM zSeries
 libc6-sparc - GNU C Library: 32bit Shared libraries for SPARC
 libc6-sparc64 - GNU C Library: 64bit Shared libraries for UltraSPARC
 libc6-udeb - GNU C Library: Shared libraries - udeb (udeb)
 libc6-x32  - GNU C Library: X32 ABI Shared libraries for AMD64
 libc6-xen  - GNU C Library: Shared libraries [Xen version]
 libc6.1    - GNU C Library: Shared libraries
 libc6.1-alphaev67 - GNU C Library: Shared libraries (EV67 optimized)
 libc6.1-dbg - GNU C Library: detached debugging symbols
 libc6.1-dev - GNU C Library: Development Libraries and Header Files
 libc6.1-pic - GNU C Library: PIC archive library
 libc6.1-udeb - GNU C Library: Shared libraries - udeb (udeb)
 locales    - GNU C Library: National Language (locale) data [support]
 locales-all - GNU C Library: Precompiled locale data
 multiarch-support - Transitional package to ensure multiarch compatibility
 nscd       - GNU C Library: Name Service Cache Daemon
Closes: 702962 743618 784015 820826 870257 887001
Changes:
 glibc (2.26-4) unstable; urgency=medium
 .
   [ Aurelien Jarno ]
   * debian/testsuite-xfail-debian.mk: since we now also run the testsuite for
     the multilib flavours, simplify the mips* entries into mips*, mips be and
     mips le, instead of trying to keep all the flavours in sync. Remove
     XFAILs for tests that have been fixed.
   * debian/patches/git-updates.diff: update from upstream stable branch:
     - Fix a buffer underflow in getcwd() (CVE-2018-1000001).  Closes:
       #887001.
   * debian/control.in/*: add conflicts to only allow one to install one set
     of multilib packages simultaneously.  Closes: #702962, #743618, #784015,
     #820826, #870257.
Checksums-Sha1:
 7647330ca874c0a570459291369a9156634fd1fc 8799 glibc_2.26-4.dsc
 02738b4437c21ce4afbb842d34286c667896ae0c 1085352 glibc_2.26-4.debian.tar.xz
 008f686d22b687215066cbcfc837c945900e0bc8 7509 glibc_2.26-4_source.buildinfo
Checksums-Sha256:
 4b551de8b7ecc553a6464e022c63b8118d8879a16305ba562dc5153dad2f148c 8799 glibc_2.26-4.dsc
 3e3385262c977489a5bd4f141233afb5d8bd06b9efcf07bb5547b7ffb5350b2d 1085352 glibc_2.26-4.debian.tar.xz
 c186fc40813ac2bab3bcb184d2b6a5f7d82bc0a8fec62ac9393b9b2e4b0a2d07 7509 glibc_2.26-4_source.buildinfo
Files:
 ed248ea28063231f6e91d3e9c11bd8f8 8799 libs required glibc_2.26-4.dsc
 58545c1d54be18720cfce62d0a085571 1085352 libs required glibc_2.26-4.debian.tar.xz
 60cbf146b982b4dbda4a3a1a33019b83 7509 libs required glibc_2.26-4_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEd0YmQqnvlP0Pdxltupx4Bh4djJsFAlpbMlEACgkQupx4Bh4d
jJtXPRAApK6hnOpQwIKbVsACXzoEF/MAeozExhDkFJ6xVBRVY1z7ddyQq7Fw6FLq
epNRhypcIhXdenMVz356hHicy6Oao0nasFAF7eOC1zOLMK/RGbw6Bfp/welw8AeB
1gl9+s7wNiwtMi3vZj/wNrj1YrnZ6FvVQC6+eAH8bWP4QGM5g7g1tNe+jZgGx6cu
bKSe1+iI4yqJydOMLGfpKgNgONiOm422ZRd3+RdRUQLQQi982FlaroTv5TxIO+2Q
gTozjelfOulwyxVt004rkJSmtZg+5d46nVHVDLyVxvw5MMkNJUlvjjpWPCG5uneS
xRkCXsx3tNyBgLuhYQ/YAaugfjy6daKAwLCkz3pwaS58uxMGcrMOXXGw8WiCY6N4
VoMN34V6D7tFWhAATJY/YCHl/PWOOA4AX16tpSOyuvbh527SJrOPV6LMOHB3EEvX
CvpkK8w16upRmfRVK5nIcAP343mn5Od11poAqSH2KvS2DDqKxo/ZMtJa9FjOKp1L
SdeBtQEwNMfLcQWsKkS75suDr7xU8li86KD0OCSbDJdzCT2fZQ6kYDucV8uu5nAJ
4oWyPaEiDEJNkhGf18fUnK6p1Qu3EwibTn7qZaqz4Bw22cXv0cgKfZKPD4mkLx1h
Qkx1npE4hzJlQD9dJLwNQ2Ia0SnWv0L3Vgxo1suh4Jtd04ZCGEg=
=F+pz
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.