uClibC and uClibC-ng libpthread linuxthreads memory corruption vulnerabilities
We discussed this vulnerability during Episode 156 on 04 October 2022
The core issue is the use of MAP_FIXED flag with mmap. Basically pthread_allocate_stack
for every thread it creates, starting its mapping a new STACK_SIZE
memory segment to a fixed address (calculated relative to THREAD_STACK_START_ADDRESS
and the number of threads already allocated). The problem is that using the MAP_FIXED
flag means that if the desired memory address overlaps a region already allocatead, the overlapped region will simply be unmapped and given over to this new call, potentially corrupting libraries with stack data.