[Bug string/33060] New: Power 10 strncmp clobbers nonvolatile vector registers (CVE-2025-5745)

[siddhesh at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=33060

            Bug ID: 33060
           Summary: Power 10 strncmp clobbers nonvolatile vector registers
                    (CVE-2025-5745)
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: string
          Assignee: unassigned at sourceware dot org
          Reporter: siddhesh at sourceware dot org
                CC: carlos at redhat dot com, fweimer at redhat dot com,
                    Sachin.Monga at ibm dot com, unassigned at sourceware dot org
  Target Milestone: ---
            Target: powerpc

+++ This bug was initially created as a clone of Bug #33056 +++

The Power 10 implementation of strncmp in
sysdeps/powerpc/powerpc64/le/power10/strncmp.S failed to save/restore
nonvolatile vector registers in the 32-byte aligned loop path.

This results in callers reading content from those registers in a different
context, potentially altering program logic.  This has a security impact: there
could be a scenario where a user controlled string could leak through strcmp
into program code, thus altering its logic.  There is also a potential for
sensitive strings passed into strcmp leaking through the clobbered registers
into parts of the calling program that should otherwise not have had access to
those strings.

The impact of this flaw is limited to applications running on Power 10 systems,
using glibc 2.39 or later and using the nonvolatile vector registers, i.e. v20
to v31.  It is possible to trivially work around the issue for those specific
applications by setting the glibc.cpu.hwcaps tunable to "-arch_3_1" like so:

export GLIBC_TUNABLES=glibc.cpu.hwcaps=-arch_3_1

-- 
You are receiving this mail because:
You are on the CC list for the bug.