Descripción
In the Linux kernel, following vulnerability has been resolved:
rseq: Fix segfault on registration when rseq_cs is non-zero
The field documented as being set to 0 by user-space prior to
registration, however this not currently enforced kernel. This
can result in a return if value stored in
the doesn't point valid struct rseq_cs.
The correct solution would be fail rseq when
the non-zero. However, some older versions of glibc
will reuse area previous threads without clearing the
rseq_cs and will also terminate process rseq
registration fails secondary thread. This wasn't caught testing
because case leftover does struct
rseq_cs.
What we can do clear it's
non-zero which prevent segfaults won't break
the glibc that areas thread creation.
https://git.kernel.org/stable/c/2df285dab00fa03a3ef939b6cb0d0d0aeb0791db
https://git.kernel.org/stable/c/3e4028ef31b69286c9d4878cee0330235f53f218
https://git.kernel.org/stable/c/48900d839a3454050fd5822e34be8d54c4ec9b86
https://git.kernel.org/stable/c/b2b05d0dc2f4f0646922068af435aed5763d16ba
https://git.kernel.org/stable/c/eaf112069a904b6207b4106ff083e0208232a2eb
https://git.kernel.org/stable/c/f004f58d18a2d3dc761cf973ad27b4a5997bd876
https://git.kernel.org/stable/c/fd881d0a085fc54354414aed990ccf05f282ba53