[SECURITY] Fedora 38 Update: glibc-2.37-10.fc38
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2023-2b8c11ee75
2023-10-04 15:50:14.488670
--------------------------------------------------------------------------------
Name : glibc
Product : Fedora 38
Version : 2.37
Release : 10.fc38
URL : http://www.gnu.org/software/glibc/
Summary : The GNU libc libraries
Description :
The glibc package contains standard libraries which are used by
multiple programs on the system. In order to save disk space and
memory, as well as to make upgrading easier, common system code is
kept in one place and shared between programs. This particular package
contains the most important sets of shared libraries: the standard C
library and the standard math library. Without these two libraries, a
Linux system will not function.
--------------------------------------------------------------------------------
Update Information:
Security fix for CVE-2023-4911, CVE-2023-4806, and CVE-2023-4527.
CVE-2023-4911: If a tunable of the form NAME=NAME=VAL is passed in the
environment of a setuid program and NAME is valid, it may result in a buffer
overflow, which could be exploited to achieve escalated privileges. This flaw
was introduced in glibc 2.34. CVE-2023-4806: When an NSS plugin only implements
the _gethostbyname2_r and _getcanonname_r callbacks, getaddrinfo could use
memory that was freed during buffer resizing, potentially causing a crash or
read or write to arbitrary memory. CVE-2023-4527: If the system is configured
in no-aaaa mode via /etc/resolv.conf, getaddrinfo is called for the AF_UNSPEC
address family, and a DNS response is received over TCP that is larger than 2048
bytes, getaddrinfo may potentially disclose stack contents via the returned
address data, or crash. ---- This update contains [changes to ELF destructor
ordering]( https://sourceware.org/bugzilla/show_bug.cgi?id=30869), improving
compatibility with a certain VPN software product.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Oct 3 2023 Arjun Shankar [arjun@redhat.com] - 2.37-10
- Auto-sync with upstream branch release/2.37/master,
b4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3:
- tunables: Terminate if end of input is reached (CVE-2023-4911)
* Tue Oct 3 2023 Arjun Shankar [arjun@redhat.com] - 2.37-9
- Auto-sync with upstream branch release/2.37/master,
2dfd8c77b546fbc46d93a5d71ae319d9c230746b:
- i686: Regenerate ulps
- Document CVE-2023-4806 and CVE-2023-5156 in NEWS
- Fix leak in getaddrinfo introduced by the fix for CVE-2023-4806 [BZ #30843]
- x86: Fix for cache computation on AMD legacy cpus.
- x86/dl-cacheinfo: remove unsused parameter from handle_amd
- getaddrinfo: Fix use after free in getcanonname (CVE-2023-4806)
- CVE-2023-4527: Stack read overflow with large TCP responses in no-aaaa mode
* Fri Sep 29 2023 Florian Weimer [fweimer@redhat.com] - 2.37-8
- Drop downstream-specific patches for ELF destructor ordering (#2239304)
* Tue Sep 26 2023 Florian Weimer [fweimer@redhat.com] - 2.37-7
- Further adjustments to ELF destructor order in _dl_fini (#2239304)
* Tue Sep 19 2023 Florian Weimer [fweimer@redhat.com] - 2.37-6
- ELF destructor for main program must be called first (#2239304)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2234712 - CVE-2023-4527 glibc: Stack read overflow in getaddrinfo in no-aaaa mode
https://bugzilla.redhat.com/show_bug.cgi?id=2234712
[ 2 ] Bug #2237782 - CVE-2023-4806 glibc: potential use-after-free in getaddrinfo()
https://bugzilla.redhat.com/show_bug.cgi?id=2237782
[ 3 ] Bug #2238352 - CVE-2023-4911 glibc: buffer overflow in ld.so leading to privilege escalation
https://bugzilla.redhat.com/show_bug.cgi?id=2238352
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2023-2b8c11ee75' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
A glibc security update has been released for Fedora 38.
