Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

BUG: 64-bit argument comparisons do not work correctly (CVE-2019-9893) #139

Closed
pcmoore opened this issue Feb 18, 2019 · 3 comments
Closed

BUG: 64-bit argument comparisons do not work correctly (CVE-2019-9893) #139

pcmoore opened this issue Feb 18, 2019 · 3 comments
Assignees
@pcmoore
Labels
bug priority/high
Milestone
v2.4

Comments

@pcmoore
Copy link
Member

pcmoore commented Feb 18, 2019 •
edited
Loading

Jann Horn reported a problem with libseccomp where our approach to doing 64-bit comparisons using 32-bit operators was just plain wrong, leading to a number of potential problems with filters that used the LT, GT, LE, or GE operators.
@pcmoore pcmoore added this to the v2.4 milestone Feb 18, 2019
@pcmoore pcmoore self-assigned this Feb 18, 2019
@pcmoore pcmoore changed the title BUG: <placeholder> BUG: 64-bit argument comparisons do not work correctly Mar 14, 2019
@pcmoore
Copy link
Member Author

pcmoore commented Mar 14, 2019

Jann has done some searching/investigation using https://codesearch.debian.net and it would appear that only systemd and Tor appear to be using libseccomp in such a way as to trigger the bad code. In the case of systemd this appears to affect the socket address family and scheduling class filters. In the case of Tor it appears that the bad filters could impact the memory addresses passed to mprotect(2).

While I have verified the bug exists in libseccomp, I have not verified the implications to systemd, Tor, or any other applications/libraries.

@pcmoore
Copy link
Member Author

pcmoore commented Mar 14, 2019

This problem is fixed with commit c5bf78d, although commit cf5d153 is strongly recommended as it fixes some filter performance degradation in the fix.

From a testing perspective, commits 2878b8b, 3da42d7, b29eda9 both take the fix into account and help ensure we test for this bug in future releases.

@pcmoore pcmoore closed this as completed Mar 14, 2019
@ja-pa ja-pa mentioned this issue Mar 15, 2019
Merged
@stefano-m stefano-m mentioned this issue Mar 15, 2019
Closed
@Ikke Ikke mentioned this issue Mar 20, 2019
Closed
@pcmoore pcmoore changed the title BUG: 64-bit argument comparisons do not work correctly BUG: 64-bit argument comparisons do not work correctly (CVE-2019-9893) Mar 22, 2019
@pcmoore
Copy link
Member Author

pcmoore commented Mar 22, 2019

Adjusting the subject line to reference CVE-2019-9893

jpuhlman pushed a commit to MontaVista-OpenSourceTechnology/meta-security that referenced this issue Mar 29, 2019
@akuster @jpuhlman
libseccomp: update to 2.4.0
71d0b90 
Source: meta-security
MR: 00000
Type: Integration
Disposition: Merged from meta-security
ChangeID: eae5224
Description:

Update the syscall table for Linux v5.0-rc5.
also a security releated issue;
seccomp/libseccomp#139

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com>
@pcmoore pcmoore mentioned this issue Apr 24, 2019
Closed
@wglambert wglambert mentioned this issue Aug 23, 2019
Closed
@pcmoore pcmoore mentioned this issue Aug 26, 2019
Closed
This was referenced Jul 25, 2021
Closed
Open
daregit pushed a commit to daregit/yocto-combined that referenced this issue May 22, 2024
@akuster
src/meta-security:libseccomp: update to 2.4.0
ee75b44 
Update the syscall table for Linux v5.0-rc5.
also a security releated issue;
seccomp/libseccomp#139

Signed-off-by: Armin Kuster <akuster808@gmail.com>
daregit pushed a commit to daregit/yocto-combined that referenced this issue May 22, 2024
@akuster
src/meta-security:libseccomp: update to 2.4.0
61df52a 
Update the syscall table for Linux v5.0-rc5.
also a security releated issue;
seccomp/libseccomp#139

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@pcmoore pcmoore

Labels
bug priority/high
Projects
None yet
Milestone
v2.4
Development

No branches or pull requests
1 participant
@pcmoore