Wind River Support Network

HomeDefectsLIN7-3304

Fixed

LIN7-3304 : Security Advisory - glibc - CVE-2014-8121

Created: Mar 30, 2015 Updated: Sep 8, 2018

Resolved Date: May 5, 2015

Found In Version: 7.0.0.0.LB03

Fix Version: 7.0.0.6

Severity: Standard

Applicable for: Wind River Linux 7

Component/s: Toolchain

Description

DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up while the database is iterated over the database, which triggers the file pointer to be reset.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8121

Workaround

Configure a project to build glibc from source
  wrlinux/configure --with-template=feature/build_libc

Apply the attached patch to layers/oe-core by 
  git am /path/to/attached-patch

Other Downloads

CVEs

CVE-2014-8121