From f6110a8fee2ca36f8e2d2abecf3cba9fa7b8ea7d Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Mon, 19 Jun 2017 17:09:55 +0200
Subject: [PATCH] CVE-2017-1000366: Ignore LD_LIBRARY_PATH for AT_SECURE=1
 programs [BZ #21624]

LD_LIBRARY_PATH can only be used to reorder system search paths, which
is not useful functionality.

This makes an exploitable unbounded alloca in _dl_init_paths unreachable
for AT_SECURE=1 programs.

patch from:
https://sourceware.org/git/?p=glibc.git;a=commit;h=f6110a8fee2ca36f8e2d2abecf3cba9fa7b8ea7d
---
 ChangeLog  | 7 +++++++
 elf/rtld.c | 3 ++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/elf/rtld.c b/elf/rtld.c
index 2446a87..2269dbe 100644
--- a/elf/rtld.c
+++ b/elf/rtld.c
@@ -2422,7 +2422,8 @@ process_envvars (enum mode *modep)
 
 	case 12:
 	  /* The library search path.  */
-	  if (memcmp (envline, "LIBRARY_PATH", 12) == 0)
+	  if (!__libc_enable_secure
+	      && memcmp (envline, "LIBRARY_PATH", 12) == 0)
 	    {
 	      library_path = &envline[13];
 	      break;
-- 
2.9.3

'>summary</a><a href='/guix/refs/?id=54bee9ea2eee1bd93657f6817bf7cc7aed3b18a6'>refs</a><a class='active' href='/guix/log/gnu/packages/cmake.scm'>log</a><a href='/guix/tree/gnu/packages/cmake.scm?id=54bee9ea2eee1bd93657f6817bf7cc7aed3b18a6'>tree</a><a href='/guix/commit/gnu/packages/cmake.scm?id=54bee9ea2eee1bd93657f6817bf7cc7aed3b18a6'>commit</a><a href='/guix/diff/gnu/packages/cmake.scm?id=54bee9ea2eee1bd93657f6817bf7cc7aed3b18a6'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/gnu/packages/cmake.scm'>
<input type='hidden' name='id' value='54bee9ea2eee1bd93657f6817bf7cc7aed3b18a6'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=54bee9ea2eee1bd93657f6817bf7cc7aed3b18a6'>root</a>/<a href='/guix/log/gnu?id=54bee9ea2eee1bd93657f6817bf7cc7aed3b18a6'>gnu</a>/<a href='/guix/log/gnu/packages?id=54bee9ea2eee1bd93657f6817bf7cc7aed3b18a6'>packages</a>/<a href='/guix/log/gnu/packages/cmake.scm?id=54bee9ea2eee1bd93657f6817bf7cc7aed3b18a6'>cmake.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/packages/cmake.scm?id=54bee9ea2eee1bd93657f6817bf7cc7aed3b18a6&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2018-12-12 20:49:14 +0100'>2018-12-12</span></td><td><a href='/guix/commit/gnu/packages/cmake.scm?id=036653918e9daa371cf174712a4895b55565a8b4'>gnu: CMake: Update to 3.13.1.</a><span class='msg-avail'>...</span></td><td>Marius Bakke</td></tr>
<tr><td><span title='2018-09-09 17:59:36 +0200'>2018-09-09</span></td><td><a href='/guix/commit/gnu/packages/cmake.scm?id=334bd08c425efe9827d6baed415e7651a957e497'>gnu: cmake: Update to 3.12.2.</a><span class='msg-avail'>...</span></td><td>Marius Bakke</td></tr>
<tr><td><span title='2018-08-21 17:24:27 +0200'>2018-08-21</span></td><td><a href='/guix/commit/gnu/packages/cmake.scm?id=f203e533861005431e26adbbd1bb053c22dbf0de'>gnu: cmake: Update to 3.12.1.</a><span class='msg-avail'>...</span></td><td>Marius Bakke</td></tr>
<tr><td><span title='2018-07-21 02:45:55 +0200'>2018-07-21</span></td><td><a href='/guix/commit/gnu/packages/cmake.scm?id=f2ca4fa5c34ba719fae8a2fd86cacc10c6096481'>gnu: cmake: Update to 3.12.0.</a><span class='msg-avail'>...</span></td><td>Marius Bakke</td></tr>
<tr><td><span title='2018-07-08 20:14:40 +0200'>2018-07-08</span></td><td><a href='/guix/commit/gnu/packages/cmake.scm?id=38a978154effb371c2e845e4e16cc59f32cc7176'>gnu: cmake: Update to 3.11.4.</a><span class='msg-avail'>...</span></td><td>Tobias Geerinckx-Rice</td></tr>
<tr><td><span title='2018-06-12 15:06:23 +0200'>2018-06-12</span></td><td><a href='/guix/commit/gnu/packages/cmake.scm?id=4f3958dacb13713842ec5d1aaf7150d5b3716ef8'>gnu: cmake: Update to 3.11.3.</a><span class='msg-avail'>...</span></td><td>Tobias Geerinckx-Rice</td></tr>
<tr><td><span title='2018-06-06 23:01:48 +0200'>2018-06-06</span></td><td><a href='/guix/commit/gnu/packages/cmake.scm?id=87096247567ac0d4aac3fc5a7a1e150d307c5b80'>Merge branch 'origin/core-updates-next' into core-updates</a></td><td>Ricardo Wurmus</td></tr>
<tr><td><span title='2018-05-25 12:18:55 +0300'>2018-05-25</span></td><td><a href='/guix/commit/gnu/packages/cmake.scm?id=ffd526e61ab1b45c6c913ab4e139193e4d5bee9b'>gnu: cmake: Delete Emacs library.</a><span class='msg-avail'>...</span></td><td>Oleg Pykhalov</td></tr>
<tr><td><span title='2018-05-24 02:34:08 -0400'>2018-05-24</span></td><td><a href='/guix/commit/gnu/packages/cmake.scm?id=9d10a63402e3c3dcda288b9370d04568dfa20ea6'>Merge branch 'master' into core-updates</a></td><td>Mark H Weaver</td></tr>
<tr><td><span title='2018-05-22 14:39:53 -0400'>2018-05-22</span></td><td><a href='/guix/commit/gnu/packages/cmake.scm?id=4935701a4a31212e0cf1b2375832fb7ecd3d8809'>Revert "gnu: cmake: Delete Emacs library."</a><span class='msg-avail'>...</span></td><td>Mark H Weaver</td></tr>
<tr><td><span title='2018-05-22 17:37:14 +0300'>2018-05-22</span></td><td><a href='/guix/commit/gnu/packages/cmake.scm?id=aa4818c33b6b2fd8d602ee93a2f53005d9472f41'>gnu: cmake.scm: Add missing module.</a><span class='msg-avail'>...</span></td><td>Oleg Pykhalov</td></tr>
<tr><td><span title='2018-05-22 17:20:46 +0300'>2018-05-22</span></td><td><a href='/guix/commit/gnu/packages/cmake.scm?id=bbdf36666b82eae0a583d7124d8117801969570c'>gnu: Add emacs-cmake-mode.</a><span class='msg-avail'>...</span></td><td>Oleg Pykhalov</td></tr>
<tr><td><span title='2018-05-22 17:16:40 +0300'>2018-05-22</span></td><td><a href='/guix/commit/gnu/packages/cmake.scm?id=f037673c3133ae7453794f1f62eecebf9d06b092'>gnu: cmake: Delete Emacs library.</a><span class='msg-avail'>...</span></td><td>Oleg Pykhalov</td></tr>
<tr><td><span title='2018-04-30 20:48:55 +0200'>2018-04-30</span></td><td><a href='/guix/commit/gnu/packages/cmake.scm?id=c98fe1d0648ba5d94f2954e9e5c3b2a22ef18fb6'>gnu: cmake: Update to 3.11.1.</a><span class='msg-avail'>...</span></td><td>Marius Bakke</td></tr>
<tr><td><span title='2018-03-29 16:54:52 +0200'>2018-03-29</span></td><td><a href='/guix/commit/gnu/packages/cmake.scm?id=12cb6c31df4b90d58658e88a256e36b6808e1064'>gnu: cmake: Update to 3.11.0.</a><span class='msg-avail'>...</span></td><td>Marius Bakke</td></tr>
<tr><td><span title='2018-03-23 11:32:33 +0530'>2018-03-23</span></td><td><a href='/guix/commit/gnu/packages/cmake.scm?id=12420c800e91026ea884c9643ff0df2d2e59d7f9'>gnu: cmake: Re-indent.</a><span class='msg-avail'>...</span></td><td>Arun Isaac</td></tr>
<tr><td><span title='2018-03-23 11:32:24 +0530'>2018-03-23</span></td><td><a href='/guix/commit/gnu/packages/cmake.scm?id=89db6c6de97d717c9c2b49d94305381f998b0ca2'>gnu: cmake: Update to 3.10.2.</a><span class='msg-avail'>...</span></td><td>Arun Isaac</td></tr>
<tr><td><span title='2018-03-04 17:54:40 +0100'>2018-03-04</span></td><td><a href='/guix/commit/gnu/packages/cmake.scm?id=1568cc14fa7b8f93eb73d21be109b0e5e00cb718'>gnu: Add cmake@3.11.</a><span class='msg-avail'>...</span></td><td>Marius Bakke</td></tr>