The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check.
La función malloc en GNU C Library (también conocida como glibc o libc6) 2.26 podría devolver un bloque de memoria demasiado pequeño si se intenta asignar un objeto cuyo tamaño se acerca a SIZE_MAX. Esto podría conducir a un desbordamiento de memoria dinámica (heap). Esto ocurre debido a que la característica de caché per-thread (también conocida como tcache) habilita una ruta de código a la que le falta una comprobación de desbordamiento de enteros.
It was discovered that the GNU C library did not properly handle all of the possible return values from the kernel getcwd syscall. A local attacker could potentially exploit this to execute arbitrary code in setuid programs and gain administrative privileges. A memory leak was discovered in the _dl_init_paths function in the GNU C library dynamic loader. A local attacker could potentially exploit this with a specially crafted value in the LD_HWCAP_MASK environment variable, in combination with CVE-2017-1000409 and another vulnerability on a system with hardlink protections disabled, in order to gain administrative privileges. Various other issues were also addressed.
