diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh index b98833b3513..2419b567d57 100644 --- a/pkgs/build-support/cc-wrapper/add-hardening.sh +++ b/pkgs/build-support/cc-wrapper/add-hardening.sh @@ -1,4 +1,4 @@ -hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow) +hardeningFlags=(fortify stackprotector pic strictoverflow format relro bindnow stackcheck) hardeningFlags+=("${hardeningEnable[@]}") hardeningCFlags=() hardeningLDFlags=() @@ -50,7 +50,11 @@ if [[ ! $hardeningDisable =~ "all" ]]; then if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: enabling bindnow >&2; fi hardeningLDFlags+=('-z' 'now') ;; - *) + stackcheck) + if [[ -n "$NIX_DEBUG" ]]; then echo HARDENING: enabling stackcheck >&2; fi + hardeningCFlags+=('-fstack-check=specific') + ;; + *) echo "Hardening flag unknown: $flag" >&2 ;; esac diff --git a/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_AUDIT.patch b/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_AUDIT.patch new file mode 100644 index 00000000000..68e2798181f --- /dev/null +++ b/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_AUDIT.patch @@ -0,0 +1,209 @@ +From ba67ba3275d47e0080f0e5f09d9f5102c000c97e Mon Sep 17 00:00:00 2001 +Message-Id: +In-Reply-To: +References: +From: Florian Weimer +Date: Sun, 28 May 2017 20:44:52 +0200 +Subject: [PATCH 3/3] rtld: Reject overly long LD_AUDIT path elements +To: libc-alpha@sourceware.org + +Also only process the last LD_AUDIT entry. +--- + elf/rtld.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 95 insertions(+), 15 deletions(-) + +diff --git a/elf/rtld.c b/elf/rtld.c +index 30f0cae..89d8573 100644 +--- a/elf/rtld.c ++++ b/elf/rtld.c +@@ -116,13 +116,95 @@ dso_name_valid_for_suid (const char *p) + return *p != '\0'; + } + +-/* List of auditing DSOs. */ ++/* LD_AUDIT variable contents. Must be processed before the ++ audit_list below. */ ++const char *audit_list_string; ++ ++/* Cyclic list of auditing DSOs. audit_list->next is the first ++ element. */ + static struct audit_list + { + const char *name; + struct audit_list *next; + } *audit_list; + ++/* Iterator for audit_list_string followed by audit_list. */ ++struct audit_list_iter ++{ ++ /* Tail of audit_list_string still needing processing, or NULL. */ ++ const char *audit_list_tail; ++ ++ /* The list element returned in the previous iteration. NULL before ++ the first element. */ ++ struct audit_list *previous; ++ ++ /* Scratch buffer for returning a name which is part of ++ audit_list_string. */ ++#ifdef PATH_MAX ++ char fname[PATH_MAX]; ++#else ++ char fname[4096]; ++#endif ++}; ++ ++/* Initialize an audit list iterator. */ ++static void ++audit_list_iter_init (struct audit_list_iter *iter) ++{ ++ iter->audit_list_tail = audit_list_string; ++ iter->previous = NULL; ++} ++ ++/* Iterate through both audit_list_string and audit_list. */ ++static const char * ++audit_list_iter_next (struct audit_list_iter *iter) ++{ ++ if (iter->audit_list_tail != NULL) ++ { ++ /* First iterate over audit_list_string. */ ++ while (*iter->audit_list_tail != '\0') ++ { ++ /* Split audit list at colon. */ ++ size_t len = strcspn (iter->audit_list_tail, ":"); ++ if (len > 0 && len < sizeof(iter->fname)) ++ { ++ memcpy (iter->fname, iter->audit_list_tail, len); ++ iter->fname[len] = '\0'; ++ } ++ else ++ /* Do not return this name to the caller. */ ++ iter->fname[0] = '\0'; ++ ++ /* Skip over the substring and the following delimiter. */ ++ iter->audit_list_tail += len; ++ if (*iter->audit_list_tail == ':') ++ ++iter->audit_list_tail; ++ ++ /* If the name is valid, return it. */ ++ if (dso_name_valid_for_suid (iter->fname)) ++ return iter->fname; ++ /* Otherwise, wrap around and try the next name. */ ++ } ++ /* Fall through to the procesing of audit_list. */ ++ } ++ ++ if (iter->previous == NULL) ++ { ++ if (audit_list == NULL) ++ /* No pre-parsed audit list. */ ++ return NULL; ++ /* Start of audit list. The first list element is at ++ audit_list->next (cyclic list). */ ++ iter->previous = audit_list->next; ++ return iter->previous->name; ++ } ++ if (iter->previous == audit_list) ++ /* Cyclic list wrap-around. */ ++ return NULL; ++ iter->previous = iter->previous->next; ++ return iter->previous->name; ++} ++ + #ifndef HAVE_INLINED_SYSCALLS + /* Set nonzero during loading and initialization of executable and + libraries, cleared before the executable's entry point runs. This +@@ -1290,11 +1368,13 @@ of this helper program; chances are you did not intend to run this program.\n\ + GL(dl_rtld_map).l_tls_modid = _dl_next_tls_modid (); + + /* If we have auditing DSOs to load, do it now. */ +- if (__glibc_unlikely (audit_list != NULL)) ++ bool need_security_init = true; ++ if (__glibc_unlikely (audit_list != NULL) ++ || __glibc_unlikely (audit_list_string != NULL)) + { +- /* Iterate over all entries in the list. The order is important. */ + struct audit_ifaces *last_audit = NULL; +- struct audit_list *al = audit_list->next; ++ struct audit_list_iter al_iter; ++ audit_list_iter_init (&al_iter); + + /* Since we start using the auditing DSOs right away we need to + initialize the data structures now. */ +@@ -1305,9 +1385,14 @@ of this helper program; chances are you did not intend to run this program.\n\ + use different values (especially the pointer guard) and will + fail later on. */ + security_init (); ++ need_security_init = false; + +- do ++ while (true) + { ++ const char *name = audit_list_iter_next (&al_iter); ++ if (name == NULL) ++ break; ++ + int tls_idx = GL(dl_tls_max_dtv_idx); + + /* Now it is time to determine the layout of the static TLS +@@ -1316,7 +1401,7 @@ of this helper program; chances are you did not intend to run this program.\n\ + no DF_STATIC_TLS bit is set. The reason is that we know + glibc will use the static model. */ + struct dlmopen_args dlmargs; +- dlmargs.fname = al->name; ++ dlmargs.fname = name; + dlmargs.map = NULL; + + const char *objname; +@@ -1329,7 +1414,7 @@ of this helper program; chances are you did not intend to run this program.\n\ + not_loaded: + _dl_error_printf ("\ + ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n", +- al->name, err_str); ++ name, err_str); + if (malloced) + free ((char *) err_str); + } +@@ -1433,10 +1518,7 @@ ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n", + goto not_loaded; + } + } +- +- al = al->next; + } +- while (al != audit_list->next); + + /* If we have any auditing modules, announce that we already + have two objects loaded. */ +@@ -1700,7 +1782,7 @@ ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n", + if (tcbp == NULL) + tcbp = init_tls (); + +- if (__glibc_likely (audit_list == NULL)) ++ if (__glibc_likely (need_security_init)) + /* Initialize security features. But only if we have not done it + earlier. */ + security_init (); +@@ -2331,9 +2413,7 @@ process_dl_audit (char *str) + char *p; + + while ((p = (strsep) (&str, ":")) != NULL) +- if (p[0] != '\0' +- && (__builtin_expect (! __libc_enable_secure, 1) +- || strchr (p, '/') == NULL)) ++ if (dso_name_valid_for_suid (p)) + { + /* This is using the local malloc, not the system malloc. The + memory can never be freed. */ +@@ -2397,7 +2477,7 @@ process_envvars (enum mode *modep) + break; + } + if (memcmp (envline, "AUDIT", 5) == 0) +- process_dl_audit (&envline[6]); ++ audit_list_string = &envline[6]; + break; + + case 7: +-- +2.9.4 + diff --git a/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_LIBRARY_PATH.patch b/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_LIBRARY_PATH.patch new file mode 100644 index 00000000000..88b1925fa12 --- /dev/null +++ b/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_LIBRARY_PATH.patch @@ -0,0 +1,33 @@ +From 4d009d39ac9ede0369e268554a181b428f177a80 Mon Sep 17 00:00:00 2001 +Message-Id: <4d009d39ac9ede0369e268554a181b428f177a80.1495998948.git.fweimer@redhat.com> +In-Reply-To: +References: +From: Florian Weimer +Date: Sun, 28 May 2017 20:37:40 +0200 +Subject: [PATCH 1/3] rtld: Completely ignore LD_LIBRARY_PATH for AT_SECURE=1 + programs +To: libc-alpha@sourceware.org + +LD_LIBRARY_PATH can only be used to reorder system search paths, which +is not useful functionality. +--- + elf/rtld.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/elf/rtld.c b/elf/rtld.c +index 319ef06..824b6cf 100644 +--- a/elf/rtld.c ++++ b/elf/rtld.c +@@ -2419,7 +2419,8 @@ process_envvars (enum mode *modep) + + case 12: + /* The library search path. */ +- if (memcmp (envline, "LIBRARY_PATH", 12) == 0) ++ if (!__libc_enable_secure ++ && memcmp (envline, "LIBRARY_PATH", 12) == 0) + { + library_path = &envline[13]; + break; +-- +2.9.4 + diff --git a/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_PRELOAD.patch b/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_PRELOAD.patch new file mode 100644 index 00000000000..76be2a3308f --- /dev/null +++ b/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_PRELOAD.patch @@ -0,0 +1,115 @@ +From 65ff0b7a085b85271ec8fde99f542281b495e3bc Mon Sep 17 00:00:00 2001 +Message-Id: <65ff0b7a085b85271ec8fde99f542281b495e3bc.1495998948.git.fweimer@redhat.com> +In-Reply-To: +References: +From: Florian Weimer +Date: Sun, 28 May 2017 20:57:40 +0200 +Subject: [PATCH 2/3] rtld: Reject overly long LD_PRELOAD path elements +To: libc-alpha@sourceware.org + +--- + elf/rtld.c | 69 +++++++++++++++++++++++++++++++++++++++++++++++--------------- + 1 file changed, 53 insertions(+), 16 deletions(-) + +diff --git a/elf/rtld.c b/elf/rtld.c +index 824b6cf..30f0cae 100644 +--- a/elf/rtld.c ++++ b/elf/rtld.c +@@ -99,6 +99,22 @@ uintptr_t __pointer_chk_guard_local + strong_alias (__pointer_chk_guard_local, __pointer_chk_guard) + #endif + ++/* Check that AT_SECURE=0, or that the passed name does not contain ++ directories and is not overly long. Reject empty names ++ unconditionally. */ ++static bool ++dso_name_valid_for_suid (const char *p) ++{ ++ if (__glibc_unlikely (__libc_enable_secure)) ++ { ++ /* Ignore pathnames with directories for AT_SECURE=1 ++ programs, and also skip overlong names. */ ++ size_t len = strlen (p); ++ if (len >= NAME_MAX || memchr (p, '/', len) != NULL) ++ return false; ++ } ++ return *p != '\0'; ++} + + /* List of auditing DSOs. */ + static struct audit_list +@@ -716,6 +732,46 @@ static const char *preloadlist attribute_relro; + /* Nonzero if information about versions has to be printed. */ + static int version_info attribute_relro; + ++/* The LD_PRELOAD environment variable gives list of libraries ++ separated by white space or colons that are loaded before the ++ executable's dependencies and prepended to the global scope list. ++ (If the binary is running setuid all elements containing a '/' are ++ ignored since it is insecure.) Return the number of preloads ++ performed. */ ++unsigned int ++handle_ld_preload (const char *preloadlist, struct link_map *main_map) ++{ ++ unsigned int npreloads = 0; ++ const char *p = preloadlist; ++#ifdef PATH_MAX ++ char fname[PATH_MAX]; ++#else ++ char fname[4096]; ++#endif ++ ++ while (*p != '\0') ++ { ++ /* Split preload list at space/colon. */ ++ size_t len = strcspn (p, " :"); ++ if (len > 0 && len < sizeof(fname)) ++ { ++ memcpy (fname, p, len); ++ fname[len] = '\0'; ++ } ++ else ++ fname[0] = '\0'; ++ ++ /* Skip over the substring and the following delimiter. */ ++ p += len; ++ if (*p == ' ' || *p == ':') ++ ++p; ++ ++ if (dso_name_valid_for_suid (fname)) ++ npreloads += do_preload (fname, main_map, "LD_PRELOAD"); ++ } ++ return npreloads; ++} ++ + static void + dl_main (const ElfW(Phdr) *phdr, + ElfW(Word) phnum, +@@ -1462,23 +1514,8 @@ ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n", + + if (__glibc_unlikely (preloadlist != NULL)) + { +- /* The LD_PRELOAD environment variable gives list of libraries +- separated by white space or colons that are loaded before the +- executable's dependencies and prepended to the global scope +- list. If the binary is running setuid all elements +- containing a '/' are ignored since it is insecure. */ +- char *list = strdupa (preloadlist); +- char *p; +- + HP_TIMING_NOW (start); +- +- /* Prevent optimizing strsep. Speed is not important here. */ +- while ((p = (strsep) (&list, " :")) != NULL) +- if (p[0] != '\0' +- && (__builtin_expect (! __libc_enable_secure, 1) +- || strchr (p, '/') == NULL)) +- npreloads += do_preload (p, main_map, "LD_PRELOAD"); +- ++ npreloads += handle_ld_preload (preloadlist, main_map); + HP_TIMING_NOW (stop); + HP_TIMING_DIFF (diff, start, stop); + HP_TIMING_ACCUM_NT (load_time, diff); +-- +2.9.4 + diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix index db80a8be299..7b777b06871 100644 --- a/pkgs/development/libraries/glibc/common.nix +++ b/pkgs/development/libraries/glibc/common.nix @@ -59,6 +59,11 @@ stdenv.mkDerivation ({ "/bin:/usr/bin", which is inappropriate on NixOS machines. This patch extends the search path by "/run/current-system/sw/bin". */ ./fix_path_attribute_in_getconf.patch + + /* Stack Clash */ + ./CVE-2017-1000366-rtld-LD_LIBRARY_PATH.patch + ./CVE-2017-1000366-rtld-LD_PRELOAD.patch + ./CVE-2017-1000366-rtld-LD_AUDIT.patch ] ++ lib.optional stdenv.isi686 ./fix-i686-memchr.patch; diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix index 1747d34fe11..3e658e55dac 100644 --- a/pkgs/os-specific/linux/kernel/patches.nix +++ b/pkgs/os-specific/linux/kernel/patches.nix @@ -156,4 +156,23 @@ rec { sha256 = "10dmv3d3gj8rvj9h40js4jh8xbr5wyaqiy0kd819mya441mj8ll2"; }; }; + + # CVE-2017-1000364 (stack clash) + mm_larger_stack_guard_gap_4_9 = rec + { name = "mm-larger-stack-guard-gap-between-vmas.patch"; + patch = fetchpatch { + inherit name; + url = "https://anonscm.debian.org/cgit/kernel/linux.git/plain/debian/patches/bugfix/all/mm-enlarge-stack-guard-gap.patch?h=debian/4.9.30-2%2bdeb9u1_bpo8%2b1"; + sha256 = "0bl7w1zgcy691avp54p6mvzdam6snrb7pz3hywsf2g2mcxjkyja5"; + }; + }; + + mm_larger_stack_guard_gap_4_11 = rec + { name = "mm-larger-stack-guard-gap-between-vmas.patch"; + patch = fetchpatch { + inherit name; + url = "https://anonscm.debian.org/cgit/kernel/linux.git/plain/debian/patches/bugfix/all/mm-larger-stack-guard-gap-between-vmas.patch?h=debian/4.11.6-1"; + sha256 = "19bakn3119v5jkhh4w7x3d50py9an1w8h7v3mmy7y2l2agj4mn3i"; + }; + }; } diff --git a/pkgs/servers/mail/exim/default.nix b/pkgs/servers/mail/exim/default.nix index bf7b5d8d6ed..d503a4d7b57 100644 --- a/pkgs/servers/mail/exim/default.nix +++ b/pkgs/servers/mail/exim/default.nix @@ -1,4 +1,4 @@ -{ coreutils, fetchurl, db, openssl, pcre, perl, pkgconfig, stdenv }: +{ coreutils, fetchurl, db, openssl, pcre, perl, pkgconfig, stdenv, fetchpatch }: stdenv.mkDerivation rec { name = "exim-4.89"; @@ -8,6 +8,14 @@ stdenv.mkDerivation rec { sha256 = "09lndv34jsxwglq5zsh9y4xaqj5g37g9ca4x0zb25fvvm4f0lj8c"; }; + patches = [ + (fetchpatch { + name = "CVE-2017-1000369.patch"; + url = "https://anonscm.debian.org/git/pkg-exim4/exim4.git/plain/debian/patches/79_CVE-2017-1000369.patch?h=4.89-2%2bdeb9u1"; + sha256 = "0v46zywgkv1rdqhybqqrd0rwkdaj6q1f4x0a3vm9p0wz8vad3023"; + }) + ]; + buildInputs = [ coreutils db openssl pcre perl pkgconfig ]; preBuild = '' diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix index d87976cbc5e..fdd18418083 100644 --- a/pkgs/tools/misc/coreutils/default.nix +++ b/pkgs/tools/misc/coreutils/default.nix @@ -31,6 +31,9 @@ stdenv.mkDerivation rec { sed '2i echo Skipping cp sparse test && exit 0' -i ./tests/cp/sparse.sh sed '2i echo Skipping rm deep-2 test && exit 0' -i ./tests/rm/deep-2.sh sed '2i echo Skipping du long-from-unreadable test && exit 0' -i ./tests/du/long-from-unreadable.sh + sed '2i echo Skipping chmod setgid test && exit 0' -i ./tests/chmod/setgid.sh + substituteInPlace ./tests/install/install-C.sh \ + --replace 'mode3=2755' 'mode3=1755' ''; outputs = [ "out" "info" ]; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 2973e2d9b0f..049e4eb1f69 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -11905,6 +11905,7 @@ with pkgs; kernelPatches.p9_fixes kernelPatches.cpu-cgroup-v2."4.9" kernelPatches.modinst_arg_list_too_long + kernelPatches.mm_larger_stack_guard_gap_4_9 ] ++ lib.optionals ((platform.kernelArch or null) == "mips") [ kernelPatches.mips_fpureg_emu @@ -11921,6 +11922,7 @@ with pkgs; # when adding a new linux version kernelPatches.cpu-cgroup-v2."4.11" kernelPatches.modinst_arg_list_too_long + kernelPatches.mm_larger_stack_guard_gap_4_11 ] ++ lib.optionals ((platform.kernelArch or null) == "mips") [ kernelPatches.mips_fpureg_emu