After six months of development, the release of the GNU C Library (glibc) 2.39 has been published, fully adhering to the ISO C11 and POSIX.1-2017 standards. This new release includes fixes from 67 developers.
Improvements implemented in Glibc 2.39 include:
- Support for shadow stack introduced in Linux kernel 6.6 has been provided, allowing many exploits to be blocked by using Intel processor hardware features to safeguard against overwriting the return address from a function in the case of stack buffer overflow. The protection works by ensuring that after control is passed to a function, the return addresses are saved by the processor not only in the ordinary stack but also in a separate 'shadow' stack that cannot be modified directly. Before exiting the function, the return address is retrieved from the shadow stack and compared with the return address from the main stack. A mismatch in addresses triggers an exception, preventing situations where an exploit has succeeded in overwriting the address in the main stack. An assembly option â--enable-cetâ has been added to enable it.
- A new header file has been added, defined in the draft standard ISO C2X and includes the functions stdc_leading_zeros, stdc_leading_ones, stdc_trailing_zeros, stdc_trailing_ones, stdc_first_leading_zero, stdc_first_leading_one, stdc_first_trailing_zero, stdc_first_trailing_one, stdc_count_zeros, stdc_count_ones, stdc_has_single_bit, stdc_bit_width, stdc_bit_floor, and stdc_bit_ceil in the variants with the types 'unsigned char', 'unsigned short', 'unsigned int', 'unsigned long int', and 'unsigned long long int'.
- For the Linux platform, the functions posix_spawnattr_getcgroup_np and posix_spawnattr_setcgroup_np have been implemented, as well as the flag POSIX_SPAWN_SETCGROUP, which allow configuring cgroupv2 in a new process using the posix_spawn and posix_spawnp functions, thereby avoiding race condition issues. These functions are GNU extensions and require a Linux kernel with support for the clone3 system call.
- For the Linux platform, the functions pidfd_spawn and pidfd_spawn have been implemented, which are semantically similar to the posix_spawn function, but return a file descriptor instead of a process identifier (PID) for use in functions that support the PIDFD mechanism, such as pidfd_send_signal, poll, and waitid (PIDFD is tied to a specific process and does not change, whereas a PID may be reassigned to another process after the current process associated with that PID terminates).
- For the Linux platform, the function pidfd_getpid has been added to determine the process identifier (PID) based on the process file descriptor (PIDFD) returned by the functions pid_spawn, fork_np, and pidfd_open.
- A size modifier "wN" has been added to the family of scanf functions, applied to arguments of types intN_t, int_leastN_t, uintN_t, and uint_leastN_t. For example, to read decimal values with types int32_t and int_least32_t, one can specify "%w32d", and for hexadecimal values â "%w32x". Similarly, a modifier "wfN" has been added for the types int_fastN_t and uint_fastN_t, as presented in the draft ISO C2X standard.
- The setting "glibc.cpu.plt_rewrite" has been added, enabling the rewrite of the PLT (Procedure Linkage Table) on x86-64 systems, where the linker will replace indirect branches in the PLT with direct ones.
- The setting "glibc.mem.decorate_maps" has been added to include additional information about memory allocation (for example, about the thread stack created by the pthread_create function or memory allocated via malloc).
- In the "statvfs" structure, the "f_type" field is now populated with information about the file system type, equivalent to the content of the field in the "statfs" structure. Previously in Linux, the "f_type" field was always set to 0.
- For the AArch64 platform, annotations have been added in libmvec and math.h, allowing for vectorization of calls when compiling with the option "-ffast-math" using GCC 9 and newer versions of the compiler. Vectorization is enabled for the mathematical functions acos, acosf, asin, asinf, atan, atanf, atan2, atan2f, cos, cosf, exp, expf, exp10, exp10f, exp2, exp2f, expm1, expm1f, log, logf, log10, log10f, log1p, log1pf, log2, log2f, sin, sinf, tan, and tanf.
- The library libcrypt and its associated header file "" have been removed from the composition. Application developers are advised to transition to alternative libraries such as libxcrypt.
- In the ldconfig utility, files with the symbol â;â in the filename or ending with «.dpkg.tmp» and «.dpkg.new» are now skipped, which prevents the processing of temporary files from the rpm and dpkg package managers.
- Support for the ia64 architecture (ia64*-*-linux-gnu), used in Intel Itanium processors, has been discontinued.
- Fixed vulnerabilities:
- CVE-2023-6246, CVE-2023-6779, CVE-2023-6780 â critical vulnerabilities in the __vsyslog_internal() function allow exploitation through manipulations with SUID applications to achieve elevated privilege code execution.
- CVE-2023-4911 â a vulnerability in Glibc ld.so that enables root access on the system. The vulnerability arises from an error in parsing the string specified in the GLIBC_TUNABLES environment variable and can lead to writing the parsed value outside the allocated buffer. Exploitable exploits exist.
- CVE-2023-4806 â a vulnerability in the getaddrinfo function caused by accessing memory after it has been freed (use-after-free). This issue occurs when the NSS plugin implements only the callback calls «_gethostbyname2_r» and «_getcanonname_r», but does not support the call «_gethostbyname3_r». To exploit this vulnerability, the DNS server must return a large number of IPv6 and IPv4 addresses for the requested host, leading to a crash of the process that called getaddrinfo for the AF_INET6 family with the flags AI_CANONNAME, AI_ALL, and AI_V4MAPPED.
- CVE-2023-4527 â a vulnerability in the getaddrinfo function that allows reading data from outside the buffer boundaries when processing a DNS response obtained via TCP, with a size greater than 2048 bytes. This vulnerability occurs when using the «no-aaaa» option in /etc/resolv.conf.
Additionally, the release of the GNU Binutils 2.42 system utility set is noteworthy, which includes programs such as the GNU linker, GNU assembler, nm, objdump, strings, and strip.
In the new version of Binutils:
- In the assembler (gas) for x86-64 systems, an experimental option «âscfi=experimental» has been added for synthesizing CFI (Control Flow Integrity) constructs for manually written assembly code that conforms to the System V AMD64 ABI.
- The readelf program has been updated with the option «âextra-sym-info» to output extended information about symbols («âsymbols»), such as the name of the section referenced by the st_shndx index.
- In the objcopy utility, the option «âset-section-flags» now allows the use of the value «large» to set the flag SHF_X86_64_LARGE for ELF objects on x86-64 systems. The option «âvisualize-jumps» now supports the s390 architecture.
- When disassembling s390 instructions, the ability to display comments in the instruction descriptions has been implemented. To include descriptions in objdump, you can specify the parameter "-M insndesc", and in gdb â the setting "set disassembler-options insndesc".
- The linker has added options "-z mark-plt" and "-z nomark-plt" for marking entries in the PLT table using the tags DT_X86_64_PLT, DT_X86_64_PLTSZ, and DT_X86_64_PLTENT.
- The linker now supports reverse order sorting.
- Options "âwarn-execstack-objects", "âerror-execstack", and "âerror-rxw-segments" have been added to output warnings or errors when using executable stack objects.
- Support for ABI 2.30 of the LoongArch architecture has been implemented, along with support for new instructions defined in the LoongArch 1.10 specification.
- Support for the KVX instruction set used in Kalray processors (for example, utilized in the Coolidge SoC) has been added.
- For Intel architecture-based systems, support for the following extensions has been added:
- Intel APX: 32 GPRs, NDD, PUSH2/POP2, PUSHP/POPP.
- USER_MSR.
- AVX10.1.
- PBNDKB.
- SM4.
- SM3.
- SHA512.
- AVX-VNNI-INT16.
- Support for the following extensions has been added to the RISC-V port:
- T-Head (XTheadVector, XTheadZvlsseg and XTheadZvamo).
- CORE-V (XCVmac, XCValu).
- SiFive VCIX (XSfVcp).
- Support for the following extensions has been added to the AArch64 port:
- SVE2.1 (Scalable Vector Extension 2.1).
- SME2.1 (Scalable Matrix Extension 2.1).
- B16B16 (BFloat16 and BFloat16 for SVE2 and SME2).
- RASv2 (Reliability, Availability and Serviceability v2).
- LSE128 (128-bit Atomic).
- GCS (Guarded Control Stack).
- CHK (Check Feature Status).
- SPECRES2 (Enhanced Speculation Restriction).
- LRCPC3 (Load-Acquire RCpc).
- THE (Translation Hardening).
- ITE (Instruction Trace).
- D128 (128-bit page table memory descriptors).
- XS (memory attribute XS).
- Support for AArch64 Cortex-A520, Cortex-A720, Cortex-X3, and Cortex-X4 processors has been added.
- In the BPF assembler, for compatibility with the clang/LLVM assembler, support has been added for separating comments with the symbols "#" and "//", as well as using the symbol ";" to separate expressions in a line (";" can no longer be used for comments).
Source: opennet.ru
