local-CVE-2021-33574-mq_notify-use-after-free

local-CVE-2021-33574-mq_notify-use-after-free

This is basically a backport of the following upstream commits below with
__pthread_attr_copy implemented as a static function in mq_notify.c Indeed it
has been added upstream in glibc 2.32 and is exported as a GLIBC_PRIVATE symbol
from libpthread.so while __mq_notify is exported by librt.so. As Debian
supports online upgrades, We need to support the case where 1) a process is
started loading libpthread.so, 2) the glibc libraries are upgraded 3) librt.so
is dlopened.  This scenario might happens for instance with OpenJDK.

commit 331c6e8a184167dd21a9f0b3fc165aeefea6eeca
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue May 19 12:32:39 2020 +0200

    nptl: Add __pthread_attr_copy for copying pthread_attr_t objects

commit 79474303223c5665bec75ffbdb2a86ee04a2514b
Author: Nikita Popov <npv1310@gmail.com>
Date:   Mon Aug 9 20:17:34 2021 +0530

    librt: fix NULL pointer dereference (bug 28213)

    Helper thread frees copied attribute on NOTIFY_REMOVED message
    received from the OS kernel.  Unfortunately, it fails to check whether
    copied attribute actually exists (data.attr != NULL).  This worked
    earlier because free() checks passed pointer before actually
    attempting to release corresponding memory.  But
    __pthread_attr_destroy assumes pointer is not NULL.

    So passing NULL pointer to __pthread_attr_destroy will result in
    segmentation fault.  This scenario is possible if
    notification->sigev_notify_attributes == NULL (which means default
    thread attributes should be used).

    Signed-off-by: Nikita Popov <npv1310@gmail.com>
    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit b805aebd42364fe696e417808a700fdb9800c9e8)

commit 42d359350510506b87101cf77202fefcbfc790cb
Author: Andreas Schwab <schwab@linux-m68k.org>
Date:   Thu May 27 12:49:47 2021 +0200

    Use __pthread_attr_copy in mq_notify (bug 27896)

    Make a deep copy of the pthread attribute object to remove a potential
    use-after-free issue.

commit 217b6dc298156bdb0d6aea9ea93e7e394a5ff091
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue Jun 1 17:51:41 2021 +0200

    Fix use of __pthread_attr_copy in mq_notify (bug 27896)

    __pthread_attr_copy can fail and does not initialize the attribute
    structure in that case.

    If __pthread_attr_copy is never called and there is no allocated
    attribute, pthread_attr_destroy should not be called, otherwise
    there is a null pointer dereference in rt/tst-mqueue6.

    Fixes commit 42d359350510506b87101cf77202fefcbfc790cb
    ("Use __pthread_attr_copy in mq_notify (bug 27896)").

    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Gbp-Pq: Topic any
Gbp-Pq: Name local-CVE-2021-33574-mq_notify-use-after-free.diff