MGASA-2022-0052

Updated glibc packages fix security vulnerability:

An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system (CVE-2021-3999).

Other upstream fixes in this update:

• gconv: Do not emit spurious NUL character in ISO-2022-JP-3 [BZ #28524]
• x86: Fix __wcsncmp_avx2 in strcmp-avx2.S [BZ #28755]
• x86: Set Prefer_No_VZEROUPPER and add Prefer_AVX2_STRCMP
• x86-64: Add ifunc-avx2.h functions with 256-bit EVEX
• x86-64: Add strcpy family functions with 256-bit EVEX
• x86-64: Add memmove family functions with 256-bit EVEX
• x86-64: Add memset family functions with 256-bit EVEX
• x86-64: Add memcmp family functions with 256-bit EVEX
• x86-64: Add AVX optimized string/memory functions for RTM
• x86: Add string/memory function tests in RTM region
• x86-64: Use ZMM16-ZMM31 in AVX512 memset family functions
• x86-64: Use ZMM16-ZMM31 in AVX512 memmove family functions
• test-strnlen.c: Initialize wchar_t string with wmemset [BZ #27655]
• test-strnlen.c: Check that strnlen won't go beyond the maximum length
• x86: Optimize memchr-avx2.S
• x86: Fix overflow bug with wmemchr-sse2 and wmemchr-avx2 [BZ #27974]
• x86: Optimize strlen-avx2.S
• x86: Optimize memchr-evex.S
• x86-64: Fix an unknown vector operation in memchr-evex.S
• x86-64: Move strlen.S to multiarch/strlen-vec.S
• x86-64: Add wcslen optimize for sse4.1
• x86: Fix overflow bug in wcsnlen-sse4_1 and wcsnlen-avx2 [BZ #27974]
• x86: Optimize strlen-evex.S
• String: Add overflow tests for strnlen, memchr, and strncat [BZ #27974]
• x86-64: Require BMI2 for __strlen_evex and __strnlen_evex
• x86: Check RTM_ALWAYS_ABORT for RTM [BZ #28033]
• x86: Black list more Intel CPUs for TSX [BZ #27398]
• x86: Remove wcsnlen-sse4_1 from wcslen ifunc-impl-list [BZ #28064]
• x86-64: Test strlen and wcslen with 0 in the RSI register [BZ #28064]