After six months of development, the release of the GNU C Library (glibc) 2.41 has been published, which fully complies with the requirements of the ISO C11 and POSIX.1-2017 standards. A total of 79 developers participated in creating this new release.
Highlights of the improvements in Glibc 2.41 include:
- New functions sched_setattr and sched_getattr have been added for the Linux platform, allowing you to set/read scheduler parameters. Practically, these functions enable configuration of scheduling policies like SCHED_DEADLINE, which utilize additional parameters beyond priority.
- The iconv utility has added support for in-place encoding conversion (if the input and output file names are the same, iconv now automatically creates a temporary file and replaces the original file with it after the conversion is complete).
- Trigonometric functions introduced in the C23 standard (TS 18661-4:2015) have been added to the math.h header file: acospi, asinpi, atan2pi, atanpi, cospi, sinpi, and tanpi.
- Optimized functions with correct rounding from the CORE-MATH project have been migrated: exp10m1f, exp2m1f, expm1f, log10f, log2p1f, log1pf, log10p1f, cbrtf, erff, erfcf, lgammaf, tgammaf, tanf, acosf, acoshf, asinf, asinhf, atanf, atan2f, atanhf, coshf, sinhf, and tanhf.
- Support for the ARM64 GCS (Guarded Control Stack) extension has been added for hardware protection of return addresses from functions and prevention of exploits using return-oriented programming (ROP) techniques. ARM64 GCS enables the use of shadow stack technology to protect processes in user space—after control is passed to a function, return addresses are saved by the processor not only in the regular stack but also in a separate shadow stack that cannot be modified directly. Before exiting the function, the return address is retrieved from the shadow stack and compared with the return address in the main stack. To build Glibc with GCS support, at least binutils version 2.44 and GCC version 15 are required.
- Significant work has been done to improve code generation and enhance the performance of mathematical functions for ARM64/AArch64 architecture. Optimizations have been implemented using vector instructions (SVE, Scalable Vector Extension) and SIMD extensions (Neon).
- For systems with ARM64/AArch64 processors, support for the Memory Protection Keys mechanism has been added, which limits access to memory pages without altering the memory page table.
- Support for extended instructions to protect against return-oriented programming in exploits has been added for PowerPC64 processor systems.
- A new architecture type arch_kind_hygon has been added for Chinese x86-64 processors Hygon, based on AMD technologies.
- The testing suite for glibc has been significantly expanded, with the number of tests increasing from 5408 to 6232 compared to the previous release.
- The ability to test glibc builds using C and C++ compilers different from those used for the actual build has been added. For example, 'configure TEST_CC="gcc-6.4.1" TEST_CXX="g++-6.4.1"' and 'configure TEST_CC="clang" TEST_CXX="clang++"'.
- Options specified in the /etc/resolv.conf file and the RES_OPTIONS environment variable now support the use of the '-' prefix to clear a previously set option with that name. For example, if 'options no-aaaa' is specified in /etc/resolv.conf, launching a process with the environment variable 'RES_OPTIONS=-no-aaaa' will cancel the restriction on sending DNS queries for AAAA records.
- Support for the 'strict-error' option has been added to the DNS resolver, where the getaddrinfo() function, if the address type (AF_UNSPEC) is not explicitly specified, will try to obtain A (IPv4) and AAAA (IPv6) record values from another DNS server if the request for the A or AAAA record to the primary DNS server failed. Without specifying 'strict-error', in such a case, the address returned will be the result of the successfully processed request, and the value of the unsuccessful request will be ignored. For example, if server returns an 'A' record but fails when querying 'AAAA', getaddrinfo without the 'strict-error' option will immediately return only the IPv4 address, while with the 'strict-error' option, it will attempt to repeat requests to another DNS server.
- Encoding data, character type information, and transliteration tables have been updated to support the Unicode 16.0.0 specification.
- The macro "_ISOC2Y_SOURCE" has been added, allowing the activation of features defined in the draft standard C2Y. Similar features can also be activated using the macro _GNU_SOURCE and through compiler flags ("gcc -std=gnu2y").
- The benchtest toolkit for tracking the performance of various functions (usually mathematical) has been implemented.
- The glibc.rtld.execstack configuration has been added, enabling explicit prohibition of the use of an executable stack.
- Support for the extendable ABI rseq (restartable sequences) has been added, providing a mechanism for rapid atomic execution of operations (in case the operation is interrupted by another thread, the state is reset and a retry is attempted). The new version introduces the use of extended features in rseq that were not present in the original ABI, such as parallel execution identifiers (mm_cid, memory-map concurrency ID) and NUMA node identifiers (node_id).
- Support for the big-endian ARC systems port (arceb-linux-gnu) has been discontinued.
- A vulnerability (CVE-2025-039) that leads to a buffer overflow when executing the assert() function has been fixed. The overflow occurs when a program name that is too large is specified (argv[0]). The issue is considered non-critical, as 4 bytes outside the buffer are written, the contents of which cannot be controlled by an attacker. The interesting aspect is the emergence of a vulnerability in debugging functions due to a bug in outputting the current application's name.
Source: opennet.ru
