{"id":767,"date":"2014-06-13T11:21:08","date_gmt":"2014-06-13T19:21:08","guid":{"rendered":"http:\/\/www.outflux.net\/blog\/?p=767"},"modified":"2014-06-13T11:25:22","modified_gmt":"2014-06-13T19:25:22","slug":"5-year-old-glibc-select-weakness-fixed","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2014\/06\/13\/5-year-old-glibc-select-weakness-fixed\/","title":{"rendered":"glibc select weakness fixed"},"content":{"rendered":"<p>In 2009, I reported <a href=\"https:\/\/sourceware.org\/bugzilla\/show_bug.cgi?id=10352\">this bug<\/a> to glibc, describing the problem that exists when a program is using <code>select<\/code>, and has its open file descriptor resource limit raised above 1024 (<code>FD_SETSIZE<\/code>). If a network daemon starts using the <code>FD_SET<\/code>\/<code>FD_CLR<\/code> glibc macros on <code>fdset<\/code> variables for descriptors larger than 1024, glibc will happily write beyond the end of the <code>fdset<\/code> variable, producing a buffer overflow condition. (This problem had existed since the introduction of the macros, so, for decades? I figured it was long over-due to have a report opened about it.)<\/p>\n<p>At the time, I was told this wasn&#8217;t going to be fixed and &#8220;every program using [select] must be considered buggy.&#8221; 2 years later still more people kept asking for this feature and continued to be told &#8220;no&#8221;.<\/p>\n<p>But, as it turns out, a few months later after the most recent &#8220;no&#8221;, it got silently fixed anyway, with the bug left open as &#8220;Won&#8217;t Fix&#8221;! I&#8217;m glad Florian did some house-cleaning on the glibc bug tracker, since I&#8217;d otherwise never have noticed that this protection had been added to the ever-growing list of <code>-D_FORTIFY_SOURCE=2<\/code> protections.<\/p>\n<p>I&#8217;ll still recommend everyone use <code>poll<\/code> instead of <code>select<\/code>, but now I won&#8217;t be so worried when I see requests to raise the open descriptor limit above 1024.<\/p>\n<p style='text-align:left'>&copy; 2014, <a href=\"https:\/\/outflux.net\/blog\/\">Kees Cook<\/a>. This work is licensed under a <a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\">Creative Commons Attribution-ShareAlike 4.0 License<\/a>.<br \/><a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\"><img decoding=\"async\" alt=\"CC BY-SA 4.0\" style=\"border-width:0\" src=\"https:\/\/i.creativecommons.org\/l\/by-sa\/4.0\/88x31.png\" \/><\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"<p>In 2009, I reported this bug to glibc, describing the problem that exists when a program is using select, and has its open file descriptor resource limit raised above 1024 (FD_SETSIZE). If a network daemon starts using the FD_SET\/FD_CLR glibc macros on fdset variables for descriptors larger than 1024, glibc will happily write beyond the [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,20,18,1,6,14,19],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/767"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=767"}],"version-history":[{"count":4,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/767\/revisions"}],"predecessor-version":[{"id":771,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/767\/revisions\/771"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=767"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=767"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=767"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}