Bug 29259 - glibc new security issue CVE-2021-35942
Summary: glibc new security issue CVE-2021-35942
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK MGA8-32-OK
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2021-07-14 16:43 CEST by David Walser
Modified: 2021-07-20 12:48 CEST (History)
5 users (show)

See Also:
Source RPM: glibc-2.32-16.mga8.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2021-07-14 16:43:16 CEST 
Fedora has issued an advisory today (July 14):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZT2QUZQYD5FTXCEAQNWHUQN72QRNZNYI/

The issue is fixed upstream in 2.34.

Thomas has actually already patched this in SVN and pushed an updated build to updates_testing, it just hasn't been assigned to QA yet:
r1735142 | tmb | 2021-07-07 18:08:16 -0400 (Wed, 07 Jul 2021) | 1 line
wordexp: handle overflow in positional parameter number [BZ #28011]

It's already been running fine on one of my systems (x86_64) since the 8th, and I imagine other QA members have installed it too.

glibc-2.32-17.mga8
glibc-devel-2.32-17.mga8
glibc-doc-2.32-17.mga8
glibc-i18ndata-2.32-17.mga8
glibc-profile-2.32-17.mga8
glibc-static-devel-2.32-17.mga8
glibc-utils-2.32-17.mga8
nscd-2.32-17.mga8

from glibc-2.32-17.mga8.src.rpm
David Walser 2021-07-14 16:43:25 CEST

CC: (none) => tmb

Comment 1 Aurelien Oudelet 2021-07-14 17:15:05 CEST 
I agree with David.
glibc-2.32-17.mga8 runs fine here since day 1.

mga8 x64, kernel-5.10.48-desktop-1.mga8

CC: (none) => ouaurelien

Comment 2 Thomas Backlund 2021-07-14 18:53:39 CEST 
Yeah, I planned to add another fix before assigning to QA but I haven't had time for that yet as it needs more work, so ok on testing / validating this one as-is
Comment 3 Dave Hodgins 2021-07-14 21:39:58 CEST 
No regressions noticed on my three m8 x86_64 installs and one m8 aarch64 (rpi4)
install.

CC: (none) => davidwhodgins

Comment 4 Thomas Andrews 2021-07-17 00:40:59 CEST 
I didn't run it for an extended time, but I didn't notice any regressions in an m8 i586 Xfce install on my HP Probook 6550b.

CC: (none) => andrewsfarm

Comment 5 Aurelien Oudelet 2021-07-19 22:28:27 CEST 
Advisory:
========================

Updated glibc packages fix a security vulnerability:

An integer overflow flaw was found in glibc that may result in reading of arbitrary memory when wordexp is used with a specially crafted untrusted regular expression input (CVE-2021-35942).

References:
 - https://bugs.mageia.org/show_bug.cgi?id=29259
 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942
 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZT2QUZQYD5FTXCEAQNWHUQN72QRNZNYI/
========================

Updated packages in core/updates_testing:
========================
glibc-2.32-17.mga8
glibc-devel-2.32-17.mga8
glibc-doc-2.32-17.mga8
glibc-i18ndata-2.32-17.mga8
glibc-profile-2.32-17.mga8
glibc-static-devel-2.32-17.mga8
glibc-utils-2.32-17.mga8
nscd-2.32-17.mga8

From SRPM:
glibc-2.32-17.mga8.src.rpm
Comment 6 Thomas Andrews 2021-07-20 01:51:25 CEST 
No installation issues on real 32-bit hardware, Dell Inspiron 5100, Xfce system.

After the reboot, no regressions noted.

I see no reason to not let this go. OKing on both arches, and validating. Advisory in Comment 5.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs
Whiteboard: (none) => MGA8-64-OK MGA8-32-OK

Comment 7 Mageia Robot 2021-07-20 12:48:20 CEST 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0362.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED
Note You need to log in before you can comment on or make changes to this bug.