libc6-i386 (2.11.1-0ubuntu7.1) provides broken implementation of memset()

[Robert Swiecki]

Binary package hint: libc6-i386

libc6-i386 2.11.1-0ubuntu7.1 (I guess also regular libc6 for amd64, and libc6 for i386 ubuntu), provides broken implementation of the memset() function.

Here is the fix: http://repo.or.cz/w/glibc.git/commitdiff/cc50f1a4b458f769ceb72d88bb78c8429361fec1

It is a little bit security issue as well, as it's might to possible to exploit it (the code jumps on the content of one of the x86 registers, which is indirectly controllable by user, but didn't investigate deeper). It can be triggered remotely. I have an adobe flash .swf file which triggers this bug.

Testcase below (please compile with -m32)

$ cat test.c
#include <sys/mman.h>
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
int main(void)
{
       void *p = 0x70000000UL;
       size_t l = 0x80001000UL;
       if (mmap(p, l, PROT_READ|PROT_WRITE, MAP_ANONYMOUS | MAP_FIXED |
MAP_PRIVATE, -1, 0) == MAP_FAILED) {
               perror("mmap");
               exit(1);
       }
       memset(p, '\0', l);
       return 0;
}
$ gcc -m32 test.c -o test
$ ./test
Segmentation fault (core dumped)

[Robert Swiecki (robert+ubuntu)]

Btw, libc6-i386_2.12~20100519-0ubuntu1_amd64.deb from maverick is free from this bug:

$ LD_PRELOAD=/tmp/libc6-i386/lib32/libc.so.6 ./test
$ echo $?
0

[Matthias Klose (doko)]

fixed in maverick

[Martin Pitt (pitti)]

Accepted eglibc into lucid-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

[Matthias Klose (doko)]

Testcase works as expected with the update, fails without it.

[Launchpad Janitor (janitor)]

This bug was fixed in the package eglibc - 2.11.1-0ubuntu7.2

---------------
eglibc (2.11.1-0ubuntu7.2) lucid-proposed; urgency=low

  * Fix issues in x86 memset-sse2.S/memset-sse2-rep.S. LP: #587055.
  * Apply from the 2.11-x86 branch: x86-64 SSE4 optimized memcmp. LP: #589136.
 -- Matthias Klose <email address hidden> Thu, 03 Jun 2010 13:38:35 +0200