CVE-2019-7303

this is a kernel limitation that is documented in the seccomp man
page, but arguably the kernel should perform the seccomp filter check on the
value that it is ultimately going to process (which likely means an
improvement to libseccomp to generate the appropriate BPF to do this)
this was further complicated by the fact that the kernel and glibc
disagree on the function prototype of ioctl, where the glibc man page
documents it as unsigned long and the kernel treats it as int (note, the
tty_ioctl man page (which is the one that documents TIOCSTI) lists the ioctl
second argument as an int)
due to miscoordination, 2.37.4 is going to -updates first as part of
the regular SRU cycle. Once that passes, we'll rebuild and publish to the
security pocket and issue a USN.
once this issue is public, the global profile initialization code
that is used to address this issue will also be made public