Medium: glibc

Issue Overview:

A vulnerability was discovered in glibc where the LD_PREFER_MAP_32BIT_EXEC environment variable is not ignored when running binaries with the setuid flag on x86_64 architectures. This allows an attacker to force system to utilize only half of the memory (making the system think the software is 32-bit only), thus lowering the amount of memory being used with address space layout randomization (ASLR). The highest threat is confidentiality although the complexity of attack is high. The affected application must already have other vulnerabilities for this flaw to be usable. (CVE-2019-19126)

A flaw was found in glibc. When processing input in the EUC-KR encoding, an invalid input sequence could cause glibc to read beyond the end of a buffer, resulting in a segmentation fault. The highest threat from this vulnerability is to system availability. (CVE-2019-25013)

A flaw was found in glibc in versions prior to 2.32. Pseudo-zero values are not validated causing a stack corruption due to a stack-based overflow. The highest threat from this vulnerability is to system availability. (CVE-2020-10029)

A stack buffer overflow flaw was found in glibc in the way the printf family of functions processed an 80-bit long double with a non-canonical bit pattern. This flaw allows an attacker who can control the arguments of these functions with the non-standard long double pattern to trigger an overflow and cause an application crash. The highest threat from this vulnerability is to system availability. (CVE-2020-29573)

Affected Packages:

glibc

Issue Correction:
Run yum update glibc to update your system.

New Packages:

i686:  
    glibc-static-2.17-322.181.amzn1.i686  
    glibc-utils-2.17-322.181.amzn1.i686  
    glibc-headers-2.17-322.181.amzn1.i686  
    glibc-2.17-322.181.amzn1.i686  
    glibc-devel-2.17-322.181.amzn1.i686  
    glibc-common-2.17-322.181.amzn1.i686  
    glibc-debuginfo-2.17-322.181.amzn1.i686  
    glibc-debuginfo-common-2.17-322.181.amzn1.i686  
    nscd-2.17-322.181.amzn1.i686  
  
src:  
    glibc-2.17-322.181.amzn1.src  
  
x86_64:  
    nscd-2.17-322.181.amzn1.x86_64  
    glibc-debuginfo-common-2.17-322.181.amzn1.x86_64  
    glibc-headers-2.17-322.181.amzn1.x86_64  
    glibc-2.17-322.181.amzn1.x86_64  
    glibc-static-2.17-322.181.amzn1.x86_64  
    glibc-debuginfo-2.17-322.181.amzn1.x86_64  
    glibc-common-2.17-322.181.amzn1.x86_64  
    glibc-devel-2.17-322.181.amzn1.x86_64  
    glibc-utils-2.17-322.181.amzn1.x86_64  

Additional References

Red Hat: CVE-2019-19126, CVE-2019-25013, CVE-2020-10029, CVE-2020-29573

Mitre: CVE-2019-19126, CVE-2019-25013, CVE-2020-10029, CVE-2020-29573