[Bug libc/34541] New: Stack buffer overflow in _dl_reloc_overflow on POWER

https://sourceware.org/bugzilla/show_bug.cgi?id=34541

            Bug ID: 34541
           Summary: Stack buffer overflow in _dl_reloc_overflow on POWER
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P3
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---
            Target: powerpc*-linux-gnu
             Flags: security-

Created attachment 16953
  --> https://sourceware.org/bugzilla/attachment.cgi?id=16953&action=edit
RHEL-218069.html

Red Hat Product Security has asked me to forward the attached report.

When reporting an out-of-reach relocation target, ld.so copies the unbounded
symbol name into a fixed-size on-stack buffer.

The issue applies to both PowerPC 32-bit and POWER 64-bit. It only affects text
relocations because that's where these overflows happen in practice. This
explains why this hasn't been seen before. Long C++ symbol names easily exceed
both buffer sizes.

This is not a vulnerability because ELF binaries are necessarily trusted (we
want to run the code that they contain, after all).

The _dl_reloc_overflow function should use _dl_exception_create_format. The
recommendation in the report is wrong.

-- 
You are receiving this mail because:
You are on the CC list for the bug.