After six months of development, the release of the GNU C Library (glibc) 2.40 has been published, fully adhering to the ISO C11 and POSIX.1-2017 standards. The new release includes patches from 68 developers.
Notable improvements implemented in Glibc 2.40 include:
- New exponential and logarithmic functions defined in the C23 standard have been added to the header file math.h: exp2m1, exp10m1, log2p1, log10p1, and logp1. These functions are available in variants for float, double, long double, _FloatN, and _FloatNx types.
- The _ISOC23_SOURCE macro has been added to define the use of features proposed in the C23 standard (currently, only some features of C23 are implemented in Glibc). The use of C23 can also be enabled at compilation through GCC options -std=c23, -std=gnu23, -std=c2x, or -std=gnu2x.
- A new option, ‘glibc.rtld.enable_secure’, has been added, allowing programs to be tested as if they had the setuid flag.
- On the Linux platform, the epoll.h header has been updated to support new ioctl commands and epoll structures introduced in the Linux 6.9 kernel.
- Functionality for detecting potential buffer overflows and related security errors during string and memory management functions (‘_FORTIFY_SOURCE’) has been adapted for building Glibc using the Clang compiler.
- In the mathematical vector functions library (libmvec), implementations of the functions acosh, asinh, atanh, cbrt, cosh, erf, erfc, hypot, pow, sinh, and tanh for the Aarch64 architecture have been proposed.
- On x86 systems, to speed up writing large data sets in the memset function, the option to disable the use of temporary buffers has been provided. This optimization is activated using the setting ‘x86_memset_non_temporal_threshold’.
- Macros in the stdbit.h header that work with various types (type-generic) have been changed to use the built-in functions __builtin_stdc_bit_ceil for supporting operands with types __int128 and _BitInt(N) when using GCC 14.
- Fields with epoch timestamp counters in the lastlog, utmp, and utmpx structures have been switched from using a 32-bit signed type to an unsigned type, extending the maximum addressable time by the counter from the year 2038 to 2106.
- Fixed vulnerabilities:
- CVE-2024-2961 — buffer overflow when converting specially formatted strings in the ISO-2022-CN-EXT encoding using the iconv() function. In practice, this vulnerability can be exploited for a remote attack on PHP applications, leading to code execution.
- CVE-2024-33599 — buffer overflow in the code for handling netgroup caching in the nscd (Name Service Cache Daemon) process. The vulnerability can be exploited by sending a specially crafted request from the client.
- CVE-2024-33600 — null pointer dereference in the nscd process that can lead to a crash when handling certain requests.
- CVE-2024-33601 — an error in netgroup cache handling can cause the nscd process to crash due to a memory allocation failure.
- CVE-2024-33602 — memory corruption when dealing with netgroup cache in the nscd process.
Source: opennet.ru
