[staging] glibc: cherry-pick fix for CVE-2023-4911 "Looney Tunables"

[ghost]

Description of changes

• Reported by Qualys. Advisory, which notes that:

historically, the processing of environment variables such as LD_PRELOAD, LD_AUDIT, and LD_LIBRARY_PATH has been a fertile source of vulnerabilities in the dynamic loader."

• There is a working exploit.

• Upstream fix commit

Things done

• Built on platform(s)
  • x86_64-linux
  • powerpc64le-linux
  • mips64el-linux
  • aarch64-linux

See also

• glibc: cherry-pick fix for CVE-2023-4911 "Looney Tunables" #258856

[Ma27]

Please update the patch tarball. The patch is already on the 2.38 & 2.37 release branch, so we can just update the patchlevel.

Also, this has the side-effect that we'd also fix https://nvd.nist.gov/vuln/detail/CVE-2023-5156 (which I just learned about while checking the diff from 2.38 on staging and now).

[ghost]

The patch is already on the 2.38 & 2.37 release branch, so we can just update the patchlevel.

Then what gets backported to 23.05? Are we going to backport the upgrade? Seems like a pretty major change for the stable branch.

I mean sure, we should update the patch tarball, but if we do that first there is no way to reference a single commit to backport only the fix.

[ghost]

Also, this has the side-effect that we'd also fix https://nvd.nist.gov/vuln/detail/CVE-2023-5156

Our current master-branch glibc expression is not affected by CVE-2023-5156.

The bug which causes CVE-2023-5156 was introduced in an attempt to fix CVE-2023-4806. The latter CVE (CVE-2023-4806) only affects a very small class of custom NSS plugins that implement nss_gethostbyname2_r but don't implement nss_gethostbyname3_r. NixOS uses nscd, which does implement nss_gethostbyname3_r. It's also not clear that CVE-2023-4806 is exploitable.

[Ma27]

Then what gets backported to 23.05? Are we going to backport the upgrade? Seems like a pretty major change for the stable branch.

Both 2.37 (what we have on 23.05) & 2.38 (what we have on staging) have the fix in their release branches, so we can update the patchlevel again.

[flokli]

@Ma27 would you mind opening new PRs for staging unstable and staging stable?

[edef1c]

@Ma27 would you mind opening new PRs for staging unstable and staging stable?

Covered: #258972 (unstable) and #258975 (stable)

[flokli]

Closing this in favor of #258972 (backport PR #258975).

It contains a patchlevel update.