GNU bug report logs - #27429
Stack clash (CVE-2017-1000366 etc)

Previous Next

Full log

View this message in rfc822 format

From: Mark H Weaver <mhw <at> netris.org>
To: Leo Famulari <leo <at> famulari.name>
Cc: Ludovic Courtès <ludo <at> gnu.org>, 27429 <at> debbugs.gnu.org, Efraim Flashner <efraim <at> flashner.co.il>
Subject: bug#27429: Stack clash (CVE-2017-1000366 etc)
Date: Sat, 24 Jun 2017 03:11:25 -0400

Mark H Weaver <mhw <at> netris.org> writes:

> Leo Famulari <leo <at> famulari.name> writes:
>
>> On Fri, Jun 23, 2017 at 02:36:41PM -0400, Mark H Weaver wrote:
>>> Most packages are linked with 'glibc-final' in (gnu packages
>>> commencement), and we should expect them to now be linked with *its*
>>> replacement.  Try this to find the expected glibc-final replacement:
>>> 
>>>   ./pre-inst-env guix build -e '((@@ (guix packages) package-replacement) (@@ (gnu packages commencement) glibc-final))'
>>
>> Thank you for the clarification. Indeed, with Efraim's latest patch,
>> packages seem to be referring to the replacement for glibc-final.
>
> That's good news!
>
>> So, do we think this patch is ready to apply? AFAIK, nobody has yet
>> tried upgrading a GuixSD system with this patch. I won't have access to
>> my bare-metal GuixSD system for the next few days.
>
> I think someone should try reconfiguring their GuixSD system and booting
> into it before we apply it to master.  I might be able to do it tonight,
> or else I can do it tomorrow.

I made some minor cleanups to the patch, split it up into multiple
patches, and upgraded my GuixSD system to use it.  My system seems to
work fine.  I don't have time right now to verify that the grafting is
being done correctly, but I went ahead and pushed the commits to
'master' anyway, based on Leo's preliminary observations.

I'm dubious about the changes made to glibc-2.21, but that can be fixed
up later.

I tried to copy the .drv files for the grafted 'glibc-final' and
'glibc-final-with-bootstrap-bash' from my machine to Hydra, in order to
ask Hydra to build it, but both "guix copy" and "guix archive --export"
failed:

--8<---------------cut here---------------start------------->8---
mhw <at> jojen ~$ guix copy --to=hydra <at> hydra /gnu/store/17gcwll4a2y3cjk8jf3fg2gr105m9f4i-glibc-2.25.drv /gnu/store/78j5arbcgjfbj0m91fn6p5s71kz7w2yw-glibc-2.25.drv
sending 11 store items to 'localhost'...
guix copy: error: corrupt input while restoring archive from #<closed: file 231bbd0>
mhw <at> jojen ~$ guix archive --export /gnu/store/17gcwll4a2y3cjk8jf3fg2gr105m9f4i-glibc-2.25.drv /gnu/store/78j5arbcgjfbj0m91fn6p5s71kz7w2yw-glibc-2.25.drv > GRAFTED-GLIBC-DRVS.nar
guix archive: error: corrupt input while restoring archive from #<closed: file 17e9d20>
--8<---------------cut here---------------end--------------->8---

I'm concerned that i686 and armhf users are going to have a rude
awakening when they not only have to build two variants of glibc, but
also a bunch of the early bootstrap because the NARs are not available
on Hydra.  It would be good if someone could take care of that.

I'm sorry, but I need to sleep now.  Hopefully someone else can take it
from here.

      Mark

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.