CVE-2019-14871: 
NixOS vulnerability analysis and mitigation

The REENT_CHECK macro in newlib versions prior to 3.3.0, as used by REENT_CHECK_TM, REENT_CHECK_MISC, REENT_CHECK_MP, and other newlib macros, contains a critical vulnerability. The issue exists in the macro implementation found in newlib/libc/include/sys/reent.h, where it fails to verify memory allocation problems when the DEBUG flag is unset, which is typically the case in production firmware builds (Census Labs).

The vulnerability stems from the REENT_CHECK macro's implementation where it performs memory allocations without proper validation when DEBUG is disabled. This affects various newlib functions including gmtime, localtime, and strtok, which rely on REENT_CHECK to ensure proper object allocation. When memory allocation fails, the code proceeds with unsafe access patterns, leading to NULL pointer dereference bugs. For example, in the gmtime() implementation, if allocation fails, _localtime_buf becomes NULL and is passed to gmtime_r, resulting in a NULL pointer dereference during operations (Census Labs).

The vulnerability can lead to NULL pointer dereference bugs that force the processor to read or write bytes at an offset from the 0x0 memory address. On embedded processors where the Device Vector Table is commonly mapped at address 0x0, this could result in leaking interrupt handler addresses, overwriting interrupt handlers, or diverting program execution to installed interrupt handlers. The widespread use of newlib in 'bare metal' devices means many systems may remain vulnerable indefinitely, as they may never receive security updates (Census Labs).

Users are strongly advised to update to newlib version 3.3.0 or later, which includes patches addressing this vulnerability. When building the library, it's crucial to enable the newlib-reent-check-verify 'configure' option, as building without this option provides no protection against CVE-2019-14871. For systems that cannot be updated, implementing memory protection mechanisms for pages near address 0x0 can help mitigate the vulnerability's impact (Census Labs).