After six months of development, the release of the GNU C Library (glibc) 2.34 has been published, which fully complies with the requirements of the ISO C11 and POSIX.1-2017 standards. The new release includes fixes from 66 developers.
Notable improvements implemented in Glibc 2.34 include:
- The main libc now integrates the libraries libpthread, libdl, libutil, and libanl, allowing their functionality in applications without the need to link using the flags -lpthread, -ldl, -lutil, and -lanl. Preparations have been made for integrating libresolv into libc. This integration will enable a more cohesive update process for glibc and simplify runtime implementation. To ensure backward compatibility with applications built with older versions of glibc, stub libraries have been provided. Due to the expansion of structures and functions offered in glibc, there might be issues in applications where there are name collisions with previously unused libraries libpthread, libdl, libutil, libresolv, and libanl.
- The ability to use a 64-bit time_t type has been provided in configurations that traditionally used a 32-bit time_t type. In such configurations, for example, on x86 systems, the default remains a 32-bit time_t for now, but this behavior can now be changed using the macro "_TIME_BITS". This feature is only available on systems with a Linux kernel of at least version 5.1.
- The _Fork function has been added, replacing the fork function with a version that meets the "async-signal-safe" requirements, allowing for safe calls from signal handlers. During the execution of _Fork, a minimal environment is created, sufficient for calling functions in signal handlers, such as raise and execve, without engaging capabilities that might lead to changes in locks or internal states. The call to _Fork will be defined in a future version of the POSIX standard but is currently included among GNU extensions.
- The execveat function has been implemented for the Linux platform, which allows executing a file from an open file descriptor. This new function is also used in the implementation of the fexecve call, which does not require a mounted pseudo-filesystem /proc during execution.
- The timespec_getres function has been added, as defined in the draft ISO C2X standard, complementing the timespec_get function with capabilities similar to the POSIX clock_getres function.
- The close_range() function has been added, allowing a process to close a whole range of open file descriptors at once. This function is available on systems with Linux kernel version 5.9 or higher.
- The closefrom and posix_spawn_file_actions_addclosefrom_np functions have been added, allowing for the closure of all file descriptors whose numbers are greater than or equal to a specified value.
- In the modes "_DYNAMIC_STACK_SIZE_SOURCE" and "_GNU_SOURCE", the values of PTHREAD_STACK_MIN, MINSIGSTKSZ, and SIGSTKSZ are no longer constants, enabling support for dynamically sized register sets, such as those provided in the ARM SVE extension.
- The linker has implemented the "--list-diagnostics" option to output information related to IFUNC (indirect function) resolution operations and the selection of the glibc-hwcaps subdirectory.
- The macro __STDC_WANT_IEC_60559_EXT__ has been implemented, intended for checking the presence of functions defined in the ISO C2X specification Annex 'F'.
- For powerpc64* systems, the "--disable-scv" option has been implemented, allowing glibc to be built without support for the scv instruction.
- Only the minimum set of core gconv modules has been retained in the gconv-modules file, with others moved to an additional file gconv-modules-extra.conf located in the gconv-modules.d directory.
- For the Linux platform, the glibc.pthread.stack_cache_size parameter has been implemented, which can be used to configure the size of the pthread stack cache.
- The inet_neta function from the header file has been marked as deprecated, along with various rarely used functions from (dn_count_labels, fp_nquery, fp_query, fp_resstat, hostalias, loc_aton, loc_ntoa, p_cdname, p_cdnname, p_class, p_fqname, p_fqnname, p_option, p_query, p_rcode, p_time, p_type, putlong, putshort, res_hostalias, res_isourserver, res_nameinquery, res_queriesmatch, res_randomid, sym_ntop, sym_ntos, sym_ston) and (ns_datetosecs, ns_format_ttl, ns_makecanon, ns_parse_ttl, ns_samedomain, ns_samename, ns_sprintrr, ns_sprintrrf, ns_subdomain). It is recommended to use separate libraries for DNS operations instead of these functions.
- The pthread_mutex_consistent_np, thread_mutexattr_getrobust_np, pthread_mutexattr_setrobust_np, and pthread_yield functions have been deprecated, to be replaced with pthread_mutex_consistent, thread_mutexattr_getrobust, thread_mutexattr_setrobust, and sched_yield.
- The use of symbolic links to bind installed shared objects to the Glibc version has been discontinued. Such objects are now installed as-is (for example, libc.so.6 is now a file, not a link to libc-2.34.so).
- Debugging features in malloc such as MALLOC_CHECK_ (glibc.malloc.check), mtrace(), and mcheck() are disabled by default, having been moved to a separate library libc_malloc_debug.so, which also contains the deprecated functions malloc_get_state and malloc_set_state.
- In Linux, functions like shm_open and sem_open now require the presence of the device /dev/shm.
- Fixed vulnerabilities:
- CVE-2021-27645: The nscd (nameserver caching daemon) crashes due to a double call to the free function when handling specially crafted netgroup requests.
- CVE-2021-33574: Access to already freed memory (use-after-free) in the mq_notify function when using the SIGEV_THREAD notification type with a thread attribute that has an alternate CPU binding mask set. This issue can lead to crashes, but other attack vectors are also possible.
- CVE-2021-35942: A parameter size overflow in the wordexp function may cause the application to crash.
Source: opennet.ru
