From patchwork Mon Jul 31 12:13:30 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Siddhesh Poyarekar X-Patchwork-Id: 795741 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=sourceware.org (client-ip=209.132.180.131; helo=sourceware.org; envelope-from=libc-alpha-return-82565-incoming=patchwork.ozlabs.org@sourceware.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; secure) header.d=sourceware.org header.i=@sourceware.org header.b="ZR+XVXjO"; dkim-atps=neutral Received: from sourceware.org (server1.sourceware.org [209.132.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3xLdf51Ys5z9s8J for ; Mon, 31 Jul 2017 22:13:49 +1000 (AEST) DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:subject:to:references:from:message-id:date :mime-version:in-reply-to:content-type :content-transfer-encoding; q=dns; s=default; b=nkyfohfH+iDiw4LH CvPeWhebVN9XvX4yB+emFgZ1xm79dLF0fYD1h/bXWqMaLFmRfLLUPI1bIAaDjJC8 fIIDkFPYt8/nDlmzDVP8Vm0sTeKu0Cqd4qJVEuMWiK5rlSsGJaTNmOld9hp4fHiv db1ve9NB2FD2brqj5qzc5CVXiyI= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:subject:to:references:from:message-id:date :mime-version:in-reply-to:content-type :content-transfer-encoding; s=default; bh=RpsWiHBo5Ryml/kfPgtrjY DuLQg=; b=ZR+XVXjOzLDf1y6p0LOqwq+iJ5ZNwYbN7GUqwUIGcaYCZ+yf1FBAOa vLauiCdR19RXKnVhxSHTpLDLVRh2I0S/+A1wA8f+nA21oeKfD0W2tzpPp7lTw/Ut wh7Ph1ugaIs2IwJJxNPjstG/1MWXQGtAvL97i2md0Lq+zsemMUOQM= Received: (qmail 105416 invoked by alias); 31 Jul 2017 12:13:38 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 105252 invoked by uid 89); 31 Jul 2017 12:13:36 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-26.9 required=5.0 tests=BAYES_00, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.2 spammy=advertised, H*M:c6cf, sk:fragmen, escalation X-HELO: homiemail-a69.g.dreamhost.com Subject: Re: Updating NEWS for 2.26 To: Joseph Myers , libc-alpha@sourceware.org References: From: Siddhesh Poyarekar Message-ID: Date: Mon, 31 Jul 2017 17:43:30 +0530 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 MIME-Version: 1.0 In-Reply-To: On Sunday 30 July 2017 05:46 PM, Joseph Myers wrote: > On Mon, 3 Jul 2017, Joseph Myers wrote: > >> The NEWS section for security-related changes in 2.26 seems very >> incomplete, with only a single entry. It clearly needs to be filled out. >> If people know of other significant changes missing from the main NEWS >> section for 2.26, they should add those as well. > > Reminder: the security-related section is still almost empty. This needs > to be fixed before the release. This is what I've come up with based on bugzilla. I'll commit this before release if it looks OK. Siddhesh + The following bugs are resolved with this release: [The release manager will add the list generated by diff --git a/NEWS b/NEWS index ab0fb54..e068557 100644 --- a/NEWS +++ b/NEWS @@ -196,6 +196,13 @@ Security related changes: * The DNS stub resolver limits the advertised UDP buffer size to 1200 bytes, to avoid fragmentation-based spoofing attacks. +* LD_LIBRARY_PATH is now ignored in binaries running in privileged AT_SECURE + mode to guard against local privilege escalation attacks (CVE-2017-1000366). + +* Avoid printing a backtrace from the __stack_chk_fail function since it is + called on a corrupt stack and a backtrace is unreliable on a corrupt stack + (CVE-2010-3192).