Bug 29357

Summary: Update request: glibc-2.32-18.mga8 (fixes CVE-2021-38604)
Product: Mageia Reporter: Thomas Backlund <tmb>
Component: SecurityAssignee: QA Team <qa-bugs>
Status: RESOLVED FIXED QA Contact: Sec team <security>
Severity: normal    
Priority: Normal CC: brtians1, davidwhodgins, sysadmin-bugs, tarazed25
Version: 8Keywords: advisory, validated_update
Target Milestone: ---   
Hardware: All   
OS: Linux   
Whiteboard: MGA8-64-OK
Source RPM: glibc CVE:
Status comment:

Description Thomas Backlund 2021-08-11 13:28:43 CEST 
Advisory:
The  recent fix for CVE-2021-33574 released in MGASA-2021-0308 introduced
a NULL pointer dereference that will result in segmentation fault.
This update adds the missing NULL pointer check to resolve this issue.


SRPM:
glibc-2.32-18.mga8.src.rpm


i586:
glibc-2.32-18.mga8.i586.rpm
glibc-devel-2.32-18.mga8.i586.rpm
glibc-doc-2.32-18.mga8.noarch.rpm
glibc-i18ndata-2.32-18.mga8.i586.rpm
glibc-profile-2.32-18.mga8.i586.rpm
glibc-static-devel-2.32-18.mga8.i586.rpm
glibc-utils-2.32-18.mga8.i586.rpm
nscd-2.32-18.mga8.i586.rpm


x86_64:
glibc-2.32-18.mga8.x86_64.rpm
glibc-devel-2.32-18.mga8.x86_64.rpm
glibc-doc-2.32-18.mga8.noarch.rpm
glibc-i18ndata-2.32-18.mga8.x86_64.rpm
glibc-profile-2.32-18.mga8.x86_64.rpm
glibc-static-devel-2.32-18.mga8.x86_64.rpm
glibc-utils-2.32-18.mga8.x86_64.rpm
nscd-2.32-18.mga8.x86_64.rpm
Comment 1 Brian Rockwell 2021-08-11 20:07:44 CEST 
MGA8-Plasma, Phys Hardware

The following 8 packages are going to be installed:

- firefox-78.13.0-1.mga8.x86_64
- firefox-en_CA-78.13.0-1.mga8.noarch
- firefox-en_GB-78.13.0-1.mga8.noarch
- firefox-en_US-78.13.0-1.mga8.noarch
- glibc-2.32-18.mga8.x86_64
- glibc-devel-2.32-18.mga8.x86_64
- lib64nss3-3.69.0-1.mga8.x86_64
- nss-3.69.0-1.mga8.x86_64


-- rebooted

System is behaving normally.

CC: (none) => brtians1

Comment 2 Len Lawrence 2021-08-13 01:19:01 CEST 
mga8, x64.  Intel, nvidia.
Installed the 8 packages, ran `dracut -f` and rebooted.
No obvious problems.

Had a look at glibc-utils but could not get memusage to work.

CC: (none) => tarazed25

Comment 3 Dave Hodgins 2021-08-13 03:36:13 CEST 
"memusage -p memusage.png /usr/bin/ls" works, with the graph stored in the png
file.

CC: (none) => davidwhodgins

Comment 4 Len Lawrence 2021-08-13 08:55:43 CEST 
Ah, so its does.  I was starting a program like stellarium and running this:
$ memusage --progname=/bin/stellarium -p stellarium.png
No program name given

Thanks Dave.
Len Lawrence 2021-08-13 09:27:22 CEST

Whiteboard: (none) => MGA8-64-OK

Thomas Backlund 2021-08-14 15:09:53 CEST

Keywords: (none) => advisory, validated_update
CC: (none) => sysadmin-bugs

Comment 5 Mageia Robot 2021-08-14 16:01:54 CEST 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0404.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED

Comment 6 David Walser 2021-08-17 16:19:35 CEST 
This is CVE-2021-38604:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38604

Summary: Update request: glibc-2.32-18.mga8 => Update request: glibc-2.32-18.mga8 (fixes CVE-2021-38604)