After six months of development, the release of the GNU C Library 2.42 (glibc) has been published, which fully adheres to the standards of ISO C23 and POSIX.1-2024. Seventy developers participated in the creation of this new release.
Notable improvements in Glibc 2.42 include:
- The pthread_create function has been enhanced with support for lightweight guard pages to protect the stack (stack guard page), access to which triggers an exception and causes the process to terminate (SIGSEGV). The implementation relies on the new MADV_GUARD_INSTALL flag in the madvise system call, supported starting from Linux kernel 6.13. Compared to the mapping in PROT_NONE mode, guard pages effectively block code execution outside the allocated memory region, as their creation does not require allocating a new area of virtual memory.
- New functions for exponentiation and root calculations have been added and reflected in the math.h header file: compoundn, pown, and powr for exponentiation, and rootn and rsqrt for root calculations, defined in the ISO C23 standard. Function variants are implemented for float, double, long double, _FloatN, and _FloatNx types, as well as for the generic type from tgmath.h.
- On the Linux platform, the pthread_gettid_np function has been implemented, which, like the gettid() function, returns a unique thread identifier but features enhanced error checking (if undefined behavior occurs, the process terminates).
- Functions for computing absolute values working with unsigned types have been added: uabs, ulabs, ullabs, and uimaxabs. These functions will be part of the upcoming C standard.
- On the Linux platform, the termios.h interface has been enhanced with support for arbitrary baud rate values. The speed_t type has been redefined and now corresponds to the 'unsigned int' type, as in the Linux kernel.
- Support for caching large memory blocks has been added to the local thread cache (tcache) used in the malloc function. The maximum block size can be redefined through the glibc.malloc.tcache_max setting, which can accept values up to 4194304. The performance of the cache has been accelerated for small-sized blocks.
- The configure build script has been updated with the "--enable-sframe" option, which enables support for the SFrame format used for representing stack trace information and supported by the backtrace function. SFrame requires at least binutils version 2.45 to function.
- Optimized versions of mathematical functions acospif, asinpif, atanpif, atan2pif, cospif, sinpif, and tanpif have been transferred from the CORE-MATH project.
- The test suite has been significantly expanded to now cover the functionality of various versions of the printf and scanf families of functions.
- Code has been added to identify Intel processors based on the Arrow Lake, Panther Lake, Clearwater Forest, and Diamond Rapids microarchitectures.
- Support for the z17 platform (the new generation of IBM Z/S390 mainframes) has been added.
- Support for compatibility mode has been added to the glibc.rtld.execstack setting to support programs that require an executable stack through dynamically loaded libraries.
- The header file termio.h and the termio structure definition have been removed from sys/ioctl.h. The termio.h interface has been deprecated since POSIX.1 (1988) and replaced with termios.h.
- Building Glibc now requires at least GCC 12.1 and GNU Binutils 2.39 releases.
- Fixed vulnerabilities:
- CVE-2025-0395 - buffer overflow in the assert() function. The overflow occurs when specifying a program name that is too large (argv[0]). The issue is considered non-hazardous since 4 bytes are written beyond the buffer, the contents of which cannot be controlled by an attacker. However, the emergence of a vulnerability in debug functions due to an error when outputting the current application's name is notable.
- CVE-2025-5702, CVE-2025-5745 - vulnerabilities in the implementation of strcmp and strncmp functions for Power10 processors that lead to failures when saving and restoring vector registers v20-v31, which should be preserved across function calls. This vulnerability may be exploited to overwrite or determine the contents of the data in the registers used by the function.
- CVE-2025-8058 - vulnerability in the regcomp function leading to double free memory.
Additionally, it is worth noting the release of the GNU Binutils 2.45 system utility suite, which includes programs such as the GNU linker, GNU assembler, nm, objdump, strings, and strip.
In the new version of Binutils:
- In the GNU assembler:
- Support for the latest extensions for RISC-V, LoongArch, and AArch64 architectures has been added. For x86, support for XMODX instructions implemented in Zhaoxin PadLock processors has been introduced. For RISC-V, support for instructions ssqosid v1.0, ssnpm v1.0, smnpm v1.0, smmpm v1.0, sspm v1.0, supm v1.0, sha v1.0, zce v1.0, smcdeleg v1.0, ssccfg v1.0, svvptc v1.0, zilsd v1.0, zclsd v1.0, smrnmi v1.0, xtheadvdot v1.0, xmipscbop v1.0, xmipscmov v1.0, xmipsexectl v1.0, and xmipslsp v1.0 have been added.
- Compatibility for generating data in SFrame format with the SFrame V2 specification has been ensured. Support for generating stack trace information (.sframe) from CFI directives on 64-bit s390 systems (s390x) has been added.
- Support for the .errif and .warnif directives for outputting diagnostic messages when certain conditions are met has been added.
- In the linker, support for an optional argument in the "—stats" option has been implemented to specify the file name for saving resource consumption information at different stages of linking. The file name can also be set via the LD_STATS environment variable. Support for new PLT (Procedure Linkage Table) formats has been added to the linker for RISC-V systems.
- Various improvements related to SFrame format support have been made. Functions for working with SFrame have been moved to the versioned library libsframe.so.2.
- Support for the RISC-V architecture has been expanded in the disassembler and the readelf utility.
Source: opennet.ru
