Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-72017

glibc: ctype.h macros segfault in multithreaded programs with multiple libc.so [rhel-9]

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • glibc-2.34-199.el9
    • No
    • Impediment
    • Low
    • ZStream
    • Hide
      10a66a8e421b09682b774c795ef1da402235dddc
      a894f04d877653bea1639fc9a4adf73bd9347bf4
      e0c0f856f58ceb68800a964c36c15c606e7a8c4c
      2745db8dd3ec31045acd761b612516490085bc20
      12956e0a330e3d90fc196f7d7a047ce613f78920
      Show
      10a66a8e421b09682b774c795ef1da402235dddc a894f04d877653bea1639fc9a4adf73bd9347bf4 e0c0f856f58ceb68800a964c36c15c606e7a8c4c 2745db8dd3ec31045acd761b612516490085bc20 12956e0a330e3d90fc196f7d7a047ce613f78920
    • 1
    • rhel-pt-c-libs
    • ssg_platform_tools
    • 1
    • True
    • False
    • Hide

      Flagged

      Show
      Flagged
    • Yes
    • PT Libraries 2025 S08
    • Bug Fix
    • Hide
      .glibc: `ctype.h` macros caused segmentation faults in multithreaded programs with multiple `libc.so`

      Previously, the internal state for ‎`<ctype.h>` in secondary C library copies created by audit or with ‎`dlmopen` failed to initialize for threads created with ‎`pthread_create`. As a consequence, using ‎`<ctype.h>` functionality, either directly or indirectly, in secondary threads and namespaces resulted in program crashes.

      With this update, the internal state for ‎`<ctype.h>` is initialized to refer to the ‎`C` locale for secondary threads and namespaces. As a result, using functionality from ‎`<ctype.h>` in these scenarios no longer causes crashes.
      Show
      .glibc: `ctype.h` macros caused segmentation faults in multithreaded programs with multiple `libc.so` Previously, the internal state for ‎`<ctype.h>` in secondary C library copies created by audit or with ‎`dlmopen` failed to initialize for threads created with ‎`pthread_create`. As a consequence, using ‎`<ctype.h>` functionality, either directly or indirectly, in secondary threads and namespaces resulted in program crashes. With this update, the internal state for ‎`<ctype.h>` is initialized to refer to the ‎`C` locale for secondary threads and namespaces. As a result, using functionality from ‎`<ctype.h>` in these scenarios no longer causes crashes.
    • Done
    • Done
    • Not Required
    • Done
    • None

      This is a clone of issue RHEL-72011 to use for version rhel-9.6

      Original description:
      The ctype.h macros (isdigit, isspace, etc.) segfault if called from a secondary thread (created in the base namespace) and dlmopen'd namespace.

      In this scenario `*_ctype_b_loc()` is a zero pointer which causes the segfault. AFAICT `_ctype_init()` is only called for the base namespace during `start_thread()`, the dlmopen'd namespace's locale TLS is left default-initialized to a zero pointer that then gets dereferenced in the `isdigit()` macro and segfaults.

       

      This has already been filed upstream https://sourceware.org/bugzilla/show_bug.cgi?id=32483 and appears to affect all versions of glibc including upstream glibc.

      A RH glibc engineer has already done an initial evaluation and posted a patch upstream https://sourceware.org/pipermail/libc-alpha/2024-December/162893.html

      The customer request is to backport this upstream patch and include it in RHEL8.10 (current production), RHEL 9.5 (currently in testing), and make sure that it is included in RHEL10.

       

      Kindly let me know if we need to raise separate Jira's for RHEL 9 and RHEL 10.

       

      Also, the customer has shared reproducer programs as attachment "reproducer.tar.gz" which I have attached to this Jira now.

              skolosov@redhat.com Sergey Kolosov
              watson-automation Watson Automation
              Michal Stubna
              Frederic Berat Frederic Berat
              Sergey Kolosov Sergey Kolosov
              Malhar Jivrajani Malhar Jivrajani
              Votes:
              1 Vote for this issue
              Watchers:
              15 Start watching this issue

                Created:
                Updated: