[Bug string/22644] memmove-sse2-unaligned on 32bit x86 produces garbage when crossing 2GB threshold (CVE-2017-18269)

["mwelinder at gmail dot com" <sourceware-bugzilla at sourceware dot org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=22644

--- Comment #13 from M Welinder <mwelinder at gmail dot com> ---
Happy to see this fixed, less happy to see it not being deployed by
distributors.

In the meantime, an application-level workaround is something like this,
to be executed as early as possible:

#ifdef __linux__
  // Block the memory just before the 2GB boundary to evade memmove bug
  if (sizeof (void *) == sizeof (int))
    (void)mmap ((void *)(0x80000000 - 0x2000), 0x2000, PROT_WRITE,
                MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
#endif

This prevents malloc from allocating across the 2G boundary by allocating
a block just before the boundary.  It might benefit from an error check.

-- 
You are receiving this mail because:
You are on the CC list for the bug.