RHSA-2015:2199 Moderate: glibc security, bug fix, and enhancement update

Updated -

Red Hat Product Security has rated this update as having Moderate security impact. For information on the security issues included in this erratum, see RHSA-2015:2199.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

The glibc packages have been updated to ensure correct operation on Power little endian and ARM 64-bit hardware architectures. (BZ#1162895, BZ#1182355, BZ#1202952, BZ#1234622).

This update also fixes the following bugs:

  • The library header netinet/tcp.h did not contain some of the newer definitions such as TCP_USER_TIMEOUT which were required for user applications to compile correctly. The library headers have been updated and synchronized with Linux kernel definitions for TCP_* constants. Two new structures, tcp_repair_opt, and tcp_cookie_transactions have also been added to the header. (BZ#1219891)

  • A defect in the library function dlopen() could cause recursive calls to this function to terminate unexpectedly or abort with a library assertion. The implementation is now reentrant, and recursive calls no longer crash or abort with an assertion. (BZ#1165212)

  • When a system with a large .rhosts file used the rsh shell to connect to a rlogind server, the authentication could time out. This update adjusts the ruserok() function so that it first performs user matching in order to avoid demanding DNS lookups. As a result, rlogind authentication with large .rhosts files is faster and no longer times out. (BZ#1216246)

  • The gethostby() functions generated syslog messages for every unrecognized record type, even if the resolver options explicitly selected extra data. The library has been fixed to avoid generating logging messages when the user explicitly or implicitly requested the data. The number of syslog messages in DNSSEC-enabled systems related to calls to gethostby() is now reduced. (BZ#1186620)

  • Previously, when using NetApp filers as NFS servers, the rpc.statd daemon in some cases terminated unexpectedly. The glibc API segmentation violation in the server Remote Procedure Call (RPC) code that was causing this crash has been corrected, and the described problem no longer occurs. (BZ#1159169)

  • The getaddrinfo() function correctly returns the EAI_AGAIN error for AF_INET and AF_INET6 queries that have timed out. However, for AF_UNSPEC, a defect in the library caused the EAI_NONAME error to be returned. Applications could incorrectly interpret EAI_NONAME as there being no result when they should have tried the query again. The defect has been corrected such that an EAI_AGAIN is returned to the caller instead of EAI_NONAME. (BZ#1098042)

  • A defect in the reinitialization of thread local structures could result in a too-small thread local storage (TLS) structure which could lead to unexpected termination of an application. The thread library has been fixed to reinitialize the TLS structure correctly to prevent applications from crashing when they reuse thread stacks. (BZ#1189278)

  • A defect in the handling of thread local storage (TLS) could cause a thread created in the constructor of a dynamically loaded shared library to become unresponsive. The thread must access TLS for the first time in the process, triggering delayed initialization of TLS support. The defect has been fixed and threads in this condition no longer hang. (BZ#1248208)

  • Long netgroup entries larger than 1024 bytes in any NSS source could cause various API functions, like getnetgrent(), to enter into an infinite loop. Applications making use of the affected API functions could become unresponsive when calling these functions. All affected API functions have been fixed to correctly handle netgroup entries larger than 1024 bytes. (BZ#1173537)

  • Compiler options or hand written assembly can violate the expected Linux 32-bit x86 ABI by aligning the stack to a value lower than 16 bytes. Calling the strstr() library routine on hardware with SSE 4.2 support with such misaligned stacks can cause a segfault in the application. In order to help application authors migrate away from these ABI violating uses, an additional strstr() routine has been added that can tolerate unaligned stacks. The alternate strstr() is enabled by creating an empty file named 64bit_strstr_via_64bit_strstr_sse2_unaligned in the /etc/sysconfig directory. (BZ#1150282)

In addition, this update adds the following enhancement:

  • This update of Name Server Caching Daemon (nscd) adds a system of inotify-based monitoring and stat-based backup monitoring for nscd configuration files, so that nscd now correctly detects changes to its configuration and reloads the data. This prevents nscd from returning stale data. (BZ#1193797)

All Red Hat Enterprise Linux 7 users are advised to install these updated packages, which correct these issues and add these enhancements.

Comments