Bug 10870 - CVE-2016-6323 for glibc
Summary: CVE-2016-6323 for glibc
Status: RESOLVED FIXED
Alias: None
Product: Security - Recipe Upgrade
Classification: Build System, Metadata & Runtime
Component: security (show other bugs)
Version: unspecified
Hardware: x86 arm
: Undecided normal
Target Milestone: ---
Assignee: Saul Wold
QA Contact:
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2017-01-02 07:42 UTC by Ismo Puustinen
Modified: 2018-02-02 20:41 UTC (History)
2 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: Don't know

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ismo Puustinen 2017-01-02 07:42:31 UTC 
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6323 :

The makecontext function in the GNU C Library (aka glibc or libc6) before 2.25 creates execution contexts incompatible with the unwinder on ARM EABI (32-bit) platforms, which might allow context-dependent attackers to cause a denial of service (hang), as demonstrated by applications compiled using gccgo, related to backtrace generation.
Comment 1 Paul Eggleton 2017-09-27 22:53:20 UTC 
The patch for this is in master, pyro and morty - can we mark this resolved?
Comment 2 Stephano Cetola 2018-02-02 20:41:35 UTC 
pyro:
a3c2acee40c8875e311e03bff6906e7c93c491fc

morty:
e80d454711f67a9a3a2a43bb7d9ff911c4664a84