Bug 10870

Summary:	CVE-2016-6323 for glibc
Product:	[Build System, Metadata & Runtime] Security - Recipe Upgrade	Reporter:	Ismo Puustinen <ismo.puustinen>
Component:	security	Assignee:	Saul Wold <sgw>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	Undecided	CC:	bluelightning, stephano
Version:	unspecified
Target Milestone:	---
Hardware:	x86
OS:	arm
Whiteboard:
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	Don't know

Description Ismo Puustinen 2017-01-02 07:42:31 UTC

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6323 :

The makecontext function in the GNU C Library (aka glibc or libc6) before 2.25 creates execution contexts incompatible with the unwinder on ARM EABI (32-bit) platforms, which might allow context-dependent attackers to cause a denial of service (hang), as demonstrated by applications compiled using gccgo, related to backtrace generation.

Comment 1 Paul Eggleton 2017-09-27 22:53:20 UTC

The patch for this is in master, pyro and morty - can we mark this resolved?

Comment 2 Stephano Cetola 2018-02-02 20:41:35 UTC

pyro:
a3c2acee40c8875e311e03bff6906e7c93c491fc

morty:
e80d454711f67a9a3a2a43bb7d9ff911c4664a84