glibc: patch CVE-2017-1000366 (stack clash)

2017-06-21 21:52:59 +02:00
parent aab71b31d5
commit 2296bf394e
4 changed files with 362 additions and 0 deletions
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -59,6 +59,11 @@ stdenv.mkDerivation ({
         "/bin:/usr/bin", which is inappropriate on NixOS machines. This
         patch extends the search path by "/run/current-system/sw/bin". */
      ./fix_path_attribute_in_getconf.patch
+
+      /* Stack Clash */
+      ./CVE-2017-1000366-rtld-LD_LIBRARY_PATH.patch
+      ./CVE-2017-1000366-rtld-LD_PRELOAD.patch
+      ./CVE-2017-1000366-rtld-LD_AUDIT.patch
    ]
      ++ lib.optional stdenv.isi686 ./fix-i686-memchr.patch;