{"id":113322,"date":"2024-02-01T13:41:10","date_gmt":"2024-02-01T11:41:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-sistemnoj-biblioteki-glibc-2-39-i-nabora-utilit-gnu-binutils-2-42"},"modified":"2024-02-01T13:41:10","modified_gmt":"2024-02-01T11:41:10","slug":"vypusk-sistemnoj-biblioteki-glibc-2-39-i-nabora-utilit-gnu-binutils-2-42","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-sistemnoj-biblioteki-glibc-2-39-i-nabora-utilit-gnu-binutils-2-42","title":{"rendered":"Release of the Glibc 2.39 system library and the GNU Binutils 2.42 utilities","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
After six months of development, the release of the GNU C Library (glibc) 2.39 has been published, fully adhering to the ISO C11 and POSIX.1-2017 standards. This new release includes fixes from 67 developers. <\/p>\n
Improvements implemented in Glibc 2.39 include: <\/p>\n
\n
Support for shadow stack has been implemented, which appeared in Linux kernel 6.6 and allows blocking the execution of many exploits by utilizing hardware capabilities of Intel processors to protect against overwriting the return address from a function in case of stack buffer overflow. The essence of the protection is that after control is transferred to a function, return addresses are saved by the processor not only in the regular stack but also in a separate 'shadow' stack that cannot be directly modified. Before exiting the function, the return address is extracted from the shadow stack and compared to the return address from the main stack. Mismatched addresses lead to an exception being raised, blocking situations where an exploit managed to overwrite the address in the main stack. An assembly option '--enable-cet' has been added to enable this feature.\n
A new header file has been added, defined in the draft ISO C2X standard and including functions stdc_leading_zeros, stdc_leading_ones, stdc_trailing_zeros, stdc_trailing_ones, stdc_first_leading_zero, stdc_first_leading_one, stdc_first_trailing_zero, stdc_first_trailing_one, stdc_count_zeros, stdc_count_ones, stdc_has_single_bit, stdc_bit_width, stdc_bit_floor, and stdc_bit_ceil for types 'unsigned char', 'unsigned short', 'unsigned int', 'unsigned long int', and 'unsigned long long int'.\n
For the Linux platform, the functions posix_spawnattr_getcgroup_np and posix_spawnattr_setcgroup_np have been implemented, as well as the flag POSIX_SPAWN_SETCGROUP, which allow configuring cgroupv2 in a new process using the posix_spawn and posix_spawnp functions, thereby avoiding race condition issues. These functions are GNU extensions and require a Linux kernel with support for the clone3 system call.\n
For the Linux platform, the functions pidfd_spawn and pidfd_spawn have been implemented, which are semantically similar to the posix_spawn function, but return a file descriptor instead of a process identifier (PID) for use in functions that support the PIDFD mechanism, such as pidfd_send_signal, poll, and waitid (PIDFD is tied to a specific process and does not change, whereas a PID may be reassigned to another process after the current process associated with that PID terminates).\n
For the Linux platform, the function pidfd_getpid has been added to determine the process identifier (PID) based on the process file descriptor (PIDFD) returned by the functions pid_spawn, fork_np, and pidfd_open.\n
In the scanf family of functions, a size modifier 'wN' has been added, applicable for arguments with types intN_t, int_leastN_t, uintN_t, and uint_leastN_t. For example, to read decimal values with types int32_t and int_least32_t, one can specify '%w32d', and for hexadecimal values \u2014 '%w32x'. A similar 'wfN' modifier has been added for types int_fastN_t and uint_fastN_t, as presented in the draft ISO C2X standard.\n
A setting 'glibc.cpu.plt_rewrite' has been added, which enables the rewriting of the PLT (Procedure Linkage Table) on x86-64 systems, where the linker will replace indirect branches in the PLT with direct ones.\n
A setting 'glibc.mem.decorate_maps' has been added to include additional information about memory allocation (for example, about the thread stack created by the pthread_create function or memory allocated via malloc).\n
In the 'statvfs' structure, the 'f_type' field is now filled with information about the filesystem type, equivalent to the content of the field in the 'statfs' structure. Previously, in Linux, the 'f_type' field was always set to 0.\n
For the AArch64 platform, libmvec and math.h have been enhanced with annotations that allow vectorization of calls during compilation when using the option '-ffast-math' in GCC 9 and newer compiler versions. Vectorization is enabled for mathematical functions acos, acosf, asin, asinf, atan, atanf, atan2, atan2f, cos, cosf, exp, expf, exp10, exp10f, exp2, exp2f, expm1, expm1f, log, logf, log10, log10f, log1p, log1pf, log2, log2f, sin, sinf, tan, and tanf.\n
The libcrypt library and its associated header file '' have been removed. Application developers are advised to switch to alternative libraries such as libxcrypt.\n
In the ldconfig utility, files containing the character \u2018;\u2019 in the filename or ending with '.dpkg.tmp' and '.dpkg.new' are now skipped, preventing the processing of temporary files by the rpm and dpkg package managers.\n
Support for the ia64 architecture (ia64*-*-linux-gnu), used in Intel Itanium processors, has been discontinued.\n
Fixed vulnerabilities:\n
\n
CVE-2023-6246, CVE-2023-6779, CVE-2023-6780 \u2014 critical vulnerabilities in the __vsyslog_internal() function that allow for privilege escalation through manipulation of SUID applications.\n
CVE-2023-4911 \u2014 vulnerability in Glibc ld.so that allows root access to the system. This vulnerability is caused by a parsing error in the string specified in the GLIBC_TUNABLES environment variable, which can lead to writing the parsed value outside the allocated buffer. Working exploits are available.\n
CVE-2023-4806 \u2014 vulnerability in the getaddrinfo function caused by dereferencing free memory (use-after-free). This issue occurs when the NSS plugin only implements the callback calls '_gethostbyname2_r' and '_getcanonname_r', but does not support the call '_gethostbyname3_r'. To exploit this vulnerability, the DNS server must return a large number of IPv6 and IPv4 addresses for the requested host, leading to a crash of the process invoking the getaddrinfo function for the AF_INET6 family with the AI_CANONNAME, AI_ALL, and AI_V4MAPPED flags set.\n
CVE-2023-4527 \u2014 vulnerability in the getaddrinfo function that allows reading data from outside the buffer bounds while processing a DNS response received over TCP, sized over 2048 bytes. The vulnerability manifests when using the 'no-aaaa' option in \/etc\/resolv.conf. <\/ul>\n
Additionally, the release of the GNU Binutils 2.42 system utility set is noteworthy, which includes programs such as the GNU linker, GNU assembler, nm, objdump, strings, and strip. <\/p>\n
In the new version of Binutils: <\/p>\n
\n
An experimental option \u2018--scfi=experimental\u2019 has been added to the assembler (gas) for x86-64 systems to synthesize CFI (Control Flow Integrity) constructs for manually written assembly code compliant with the System V AMD64 ABI.\n
The readelf program has been enhanced with the option «—extra-sym-info» to display extended symbol information («—symbols»), such as the section name referenced by the st_shndx index.\n
The objcopy utility now allows the use of the «—set-section-flags» option with the value «large» to set the SHF_X86_64_LARGE flag for ELF objects on x86-64 systems. The «—visualize-jumps» option now supports the s390 architecture.\n
When disassembling s390 instructions, it is now possible to display comments with instruction descriptions. To include descriptions in objdump, the «-M insndesc» parameter can be specified, and in gdb \u2014 the setting «set disassembler-options insndesc».\n
The linker has added the «-z mark-plt» and «-z nomark-plt» options to mark entries in the PLT table using the DT_X86_64_PLT, DT_X86_64_PLTSZ, and DT_X86_64_PLTENT tags.\n
The linker now supports reverse order sorting.\n
Options «—warn-execstack-objects», «—error-execstack», and «—error-rxw-segments» have been added to provide warnings or errors when using executable stack objects.\n
Support for ABI 2.30 of the LoongArch architecture has been implemented, along with support for new instructions defined in the LoongArch 1.10 specification.\n
Support for the KVX instruction set used in Kalray processors (for example, utilized in the Coolidge SoC) has been added.\n
For Intel architecture-based systems, support for the following extensions has been added:\n
Support for the following extensions has been added to the RISC-V port:\n
\n
T-Head (XTheadVector, XTheadZvlsseg and XTheadZvamo).\n
CORE-V (XCVmac, XCValu).\n
SiFive VCIX (XSfVcp). <\/ul>\n
Support for the following extensions has been added to the AArch64 port:\n
\n
SVE2.1 (Scalable Vector Extension 2.1).\n
SME2.1 (Scalable Matrix Extension 2.1).\n
B16B16 (BFloat16 and BFloat16 for SVE2 and SME2).\n
RASv2 (Reliability, Availability and Serviceability v2).\n
LSE128 (128-bit Atomic).\n
GCS (Guarded Control Stack).\n
CHK (Check Feature Status).\n
SPECRES2 (Enhanced Speculation Restriction).\n
LRCPC3 (Load-Acquire RCpc).\n
THE (Translation Hardening).\n
ITE (Instruction Trace).\n
D128 (128-bit page table memory descriptors).\n
XS (memory attribute XS). <\/ul>\n
Support for AArch64 Cortex-A520, Cortex-A720, Cortex-X3, and Cortex-X4 processors has been added.\n
In the BPF assembler, support for separating comments with the symbols «#» and «\\\/\\\/» has been added for compatibility with the clang\/LLVM assembler, as well as the use of the symbol «;» for separating expressions in a line («;» can no longer be used for comments). <\/ul>\n