[Bug libc/15754] New: PTR_MANGLE does not initialize to a random value for the pointer guard when compiling static executables

["sidhpurwala.huzaifa at gmail dot com" <sourceware-bugzilla at sourceware dot org>]

http://sourceware.org/bugzilla/show_bug.cgi?id=15754

            Bug ID: 15754
           Summary: PTR_MANGLE does not initialize to a random value for
                    the pointer guard when compiling static executables
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: sidhpurwala.huzaifa at gmail dot com
                CC: drepper.fsp at gmail dot com

The vulnerability is caused due to the non initialization to a random value (it
is always zero) of the "pointer guard" by the glibc only when generating static
compiled executables. Dynamic executables are not affected. Pointer guard is
used to mangle the content of sensible pointers (longjmp, signal handlers,
etc.), if the pointer guard value is zero (non-initialized) then it is not
effective. 

References:

[1] http://hmarco.org/bugs/CVE-2013-4788.html
[2] http://www.openwall.com/lists/oss-security/2013/07/15/5
[3] http://hmarco.org/bugs/patches/ptr_mangle-eglibc-2.17.patch

This issue has been assigned CVE-2013-4788

-- 
You are receiving this mail because:
You are on the CC list for the bug.