| Message ID | 20261112115818.76259-1-UpStream_IP-SP@bmwtechworks.in |
|---|---|
| State | Not Applicable, archived |
| Delegated to: | Yoann Congal |
| Headers | show |
| Series | [scarthgap,v3,1/2] glibc: Fix CVE-2026-5450 | expand |
This is already patched, see https://git.openembedded.org/openembedded-core/commit/?h=scarthgap&id=3eb9b43fb0bcfc2c49aa884f1e7cde8a1f032dd8 Peter > -----Original Message----- > From: Sourav Kumar Pramanik via openembedded-core <UpStream_IP- > SP=bmwtechworks.in@lists.openembedded.org> > Sent: Thursday, November 12, 2026 12:58 PM > To: openembedded-core@lists.openembedded.org > Cc: Sourav Kumar Pramanik <souravkumar.pramanik@bmwtechworks.in> > Subject: [OE-core] [scarthgap][PATCH v3 1/2] glibc: Fix CVE-2026-5450 > > From: Sourav Kumar Pramanik <souravkumar.pramanik@bmwtechworks.in> > > NVD describes CVE-2026-5450 as a one-byte heap buffer overflow in the > scanf family when using %mc with an explicit field width greater than > 1024. The affected versions are glibc 2.7 through 2.43, including the > 2.39 version used by this recipe. > > Backport upstream commit 839898 fixes the buffer-growth calculation > in vfscanf-internal.c, which can allocate one element too few, > and adds a regression test using %1040mc with malloc > checking enabled. > > Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-5450 > > Comment: Refreshed for glibc 2.39[adjusted source hunk locations and > Makefile contexts] > > Signed-off-by: Sourav Kumar Pramanik > <souravkumar.pramanik@bmwtechworks.in> > --- > .../glibc/glibc/CVE-2026-5450.patch | 132 ++++++++++++++++++ > meta/recipes-core/glibc/glibc_2.39.bb | 1 + > 2 files changed, 133 insertions(+) > create mode 100644 meta/recipes-core/glibc/glibc/CVE-2026-5450.patch > > diff --git a/meta/recipes-core/glibc/glibc/CVE-2026-5450.patch b/meta/recipes- > core/glibc/glibc/CVE-2026-5450.patch > new file mode 100644 > --- /dev/null > +++ b/meta/recipes-core/glibc/glibc/CVE-2026-5450.patch > @@ -0,0 +1,132 @@ > +From 839898777226a3ed88c0859f25ffe712519b4ead Mon Sep 17 00:00:00 > 2001 > +From: Rocket Ma <marocketbd@gmail.com> > +Date: Fri, 17 Apr 2026 23:48:41 -0700 > +Subject: [PATCH] stdio-common: Fix buffer overflow in scanf %mc [BZ #34008] > + > +* stdio-common/vfscanf-internal.c: When enlarging allocated buffer with > +format %mc or %mC, glibc allocates one byte less, leading to > +user-controlled one byte overflow. This commit fixes BZ #34008, or > +CVE-2026-5450. > + > +CVE: CVE-2026-5450 > +Upstream-Status: Backport > [https://sourceware.org/cgit/glibc/commit/?id=839898777226a3ed88c0859f25ffe7 > 12519b4ead] > +Comment: Refreshed for glibc 2.39[adjusted source hunk locations and > +Makefile contexts] > + > +Reviewed-by: Carlos O'Donell <carlos@redhat.com> > +Signed-off-by: Rocket Ma <marocketbd@gmail.com> > +Reviewed-by: H.J. Lu <hjl.tools@gmail.com> > +Signed-off-by: Sourav Kumar Pramanik > <souravkumar.pramanik@bmwtechworks.in> > +--- > + stdio-common/Makefile | 4 ++++ > + stdio-common/tst-vfscanf-bz34008.c | 48 > ++++++++++++++++++++++++++++++++++++++++ > + stdio-common/vfscanf-internal.c | 6 ++--- > + 3 files changed, 55 insertions(+), 3 deletions(-) > + create mode 100644 stdio-common/tst-vfscanf-bz34008.c > + > +diff --git a/stdio-common/Makefile b/stdio-common/Makefile > +--- a/stdio-common/Makefile > ++++ b/stdio-common/Makefile > +@@ -266,6 +266,7 @@ tests := \ > + tst-vfprintf-width-i18n \ > + tst-vfprintf-width-prec \ > + tst-vfprintf-width-prec-alloc \ > ++ tst-vfscanf-bz34008 \ > + tst-wc-printf \ > + tstdiomisc \ > + tstgetln \ > +@@ -401,6 +402,9 @@ tst-printf-bz18872-ENV = > MALLOC_TRACE=$(objpfx)tst-printf-bz18872.mtrace \ > + tst-vfprintf-width-prec-ENV = \ > + MALLOC_TRACE=$(objpfx)tst-vfprintf-width-prec.mtrace \ > + LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so > ++tst-vfscanf-bz34008-ENV = \ > ++ MALLOC_CHECK_=3 \ > ++ LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so > + tst-printf-bz25691-ENV = \ > + MALLOC_TRACE=$(objpfx)tst-printf-bz25691.mtrace \ > + LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so > +diff --git a/stdio-common/tst-vfscanf-bz34008.c b/stdio-common/tst-vfscanf- > bz34008.c > +new file mode 100644 > +--- /dev/null > ++++ b/stdio-common/tst-vfscanf-bz34008.c > +@@ -0,0 +1,48 @@ > ++/* Regression test for vfscanf %Nmc out-of-bound write (BZ #34008) > ++ Copyright (C) 2026 The GNU Toolchain Authors. > ++ This file is part of the GNU C Library. > ++ > ++ The GNU C Library is free software; you can redistribute it and/or > ++ modify it under the terms of the GNU Lesser General Public > ++ License as published by the Free Software Foundation; either > ++ version 2.1 of the License, or (at your option) any later version. > ++ > ++ The GNU C Library is distributed in the hope that it will be useful, > ++ but WITHOUT ANY WARRANTY; without even the implied warranty of > ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the > GNU > ++ Lesser General Public License for more details. > ++ > ++ You should have received a copy of the GNU Lesser General Public > ++ License along with the GNU C Library; if not, see > ++ <https://www.gnu.org/licenses/>. */ > ++ > ++#include "malloc/mcheck.h" > ++#include <stddef.h> > ++#include <stdio.h> > ++#include <string.h> > ++#include <wchar.h> > ++#include <stdlib.h> > ++#include <malloc.h> > ++#include <support/check.h> > ++ > ++#define WIDTH 0x410 > ++#define SCANFSTR "%1040mc" > ++static int > ++do_test (void) > ++{ > ++ mcheck_pedantic (NULL); > ++ char *input = malloc (WIDTH + 1); > ++ TEST_VERIFY (input != NULL); > ++ memset (input, 'A', WIDTH); > ++ input[WIDTH] = '\0'; > ++ > ++ char *buf = NULL; > ++ TEST_VERIFY (sscanf (input, SCANFSTR, &buf) != -1); > ++ TEST_VERIFY (buf != NULL); > ++ > ++ free (buf); > ++ free (input); > ++ return 0; > ++} > ++ > ++#include <support/test-driver.c> > +diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c > +--- a/stdio-common/vfscanf-internal.c > ++++ b/stdio-common/vfscanf-internal.c > +@@ -854,7 +854,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list > argptr, > + /* Enlarge the buffer. */ > + size_t newsize > + = strsize > +- + (strsize >= width ? width - 1 : strsize); > ++ + (strsize >= width ? width : strsize); > + > + str = (char *) realloc (*strptr, newsize); > + if (str == NULL) > +@@ -925,7 +925,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list > argptr, > + && wstr == (wchar_t *) *strptr + strsize) > + { > + size_t newsize > +- = strsize + (strsize > width ? width - 1 : strsize); > ++ = strsize + (strsize >= width ? width : strsize); > + /* Enlarge the buffer. */ > + wstr = (wchar_t *) realloc (*strptr, > + newsize * sizeof (wchar_t)); > +@@ -980,7 +980,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list > argptr, > + && wstr == (wchar_t *) *strptr + strsize) > + { > + size_t newsize > +- = strsize + (strsize > width ? width - 1 : strsize); > ++ = strsize + (strsize >= width ? width : strsize); > + /* Enlarge the buffer. */ > + wstr = (wchar_t *) realloc (*strptr, > + newsize * sizeof (wchar_t)); > +-- > +2.43.0 > diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes- > core/glibc/glibc_2.39.bb > --- a/meta/recipes-core/glibc/glibc_2.39.bb > +++ b/meta/recipes-core/glibc/glibc_2.39.bb > @@ -63,6 +63,7 @@ SRC_URI = > "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ > file://0028-CVE-2026-6238-0004.patch \ > file://0029-CVE-2026-6238-0005.patch \ > file://0030-CVE-2026-6238-0006.patch \ > + file://CVE-2026-5450.patch \ > " > S = "${WORKDIR}/git" > B = "${WORKDIR}/build-${TARGET_SYS}" > -- > 2.43.0
diff --git a/meta/recipes-core/glibc/glibc/CVE-2026-5450.patch b/meta/recipes-core/glibc/glibc/CVE-2026-5450.patch new file mode 100644 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/CVE-2026-5450.patch @@ -0,0 +1,132 @@ +From 839898777226a3ed88c0859f25ffe712519b4ead Mon Sep 17 00:00:00 2001 +From: Rocket Ma <marocketbd@gmail.com> +Date: Fri, 17 Apr 2026 23:48:41 -0700 +Subject: [PATCH] stdio-common: Fix buffer overflow in scanf %mc [BZ #34008] + +* stdio-common/vfscanf-internal.c: When enlarging allocated buffer with +format %mc or %mC, glibc allocates one byte less, leading to +user-controlled one byte overflow. This commit fixes BZ #34008, or +CVE-2026-5450. + +CVE: CVE-2026-5450 +Upstream-Status: Backport [https://sourceware.org/cgit/glibc/commit/?id=839898777226a3ed88c0859f25ffe712519b4ead] +Comment: Refreshed for glibc 2.39[adjusted source hunk locations and +Makefile contexts] + +Reviewed-by: Carlos O'Donell <carlos@redhat.com> +Signed-off-by: Rocket Ma <marocketbd@gmail.com> +Reviewed-by: H.J. Lu <hjl.tools@gmail.com> +Signed-off-by: Sourav Kumar Pramanik <souravkumar.pramanik@bmwtechworks.in> +--- + stdio-common/Makefile | 4 ++++ + stdio-common/tst-vfscanf-bz34008.c | 48 ++++++++++++++++++++++++++++++++++++++++ + stdio-common/vfscanf-internal.c | 6 ++--- + 3 files changed, 55 insertions(+), 3 deletions(-) + create mode 100644 stdio-common/tst-vfscanf-bz34008.c + +diff --git a/stdio-common/Makefile b/stdio-common/Makefile +--- a/stdio-common/Makefile ++++ b/stdio-common/Makefile +@@ -266,6 +266,7 @@ tests := \ + tst-vfprintf-width-i18n \ + tst-vfprintf-width-prec \ + tst-vfprintf-width-prec-alloc \ ++ tst-vfscanf-bz34008 \ + tst-wc-printf \ + tstdiomisc \ + tstgetln \ +@@ -401,6 +402,9 @@ tst-printf-bz18872-ENV = MALLOC_TRACE=$(objpfx)tst-printf-bz18872.mtrace \ + tst-vfprintf-width-prec-ENV = \ + MALLOC_TRACE=$(objpfx)tst-vfprintf-width-prec.mtrace \ + LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so ++tst-vfscanf-bz34008-ENV = \ ++ MALLOC_CHECK_=3 \ ++ LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so + tst-printf-bz25691-ENV = \ + MALLOC_TRACE=$(objpfx)tst-printf-bz25691.mtrace \ + LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so +diff --git a/stdio-common/tst-vfscanf-bz34008.c b/stdio-common/tst-vfscanf-bz34008.c +new file mode 100644 +--- /dev/null ++++ b/stdio-common/tst-vfscanf-bz34008.c +@@ -0,0 +1,48 @@ ++/* Regression test for vfscanf %Nmc out-of-bound write (BZ #34008) ++ Copyright (C) 2026 The GNU Toolchain Authors. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ <https://www.gnu.org/licenses/>. */ ++ ++#include "malloc/mcheck.h" ++#include <stddef.h> ++#include <stdio.h> ++#include <string.h> ++#include <wchar.h> ++#include <stdlib.h> ++#include <malloc.h> ++#include <support/check.h> ++ ++#define WIDTH 0x410 ++#define SCANFSTR "%1040mc" ++static int ++do_test (void) ++{ ++ mcheck_pedantic (NULL); ++ char *input = malloc (WIDTH + 1); ++ TEST_VERIFY (input != NULL); ++ memset (input, 'A', WIDTH); ++ input[WIDTH] = '\0'; ++ ++ char *buf = NULL; ++ TEST_VERIFY (sscanf (input, SCANFSTR, &buf) != -1); ++ TEST_VERIFY (buf != NULL); ++ ++ free (buf); ++ free (input); ++ return 0; ++} ++ ++#include <support/test-driver.c> +diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c +--- a/stdio-common/vfscanf-internal.c ++++ b/stdio-common/vfscanf-internal.c +@@ -854,7 +854,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr, + /* Enlarge the buffer. */ + size_t newsize + = strsize +- + (strsize >= width ? width - 1 : strsize); ++ + (strsize >= width ? width : strsize); + + str = (char *) realloc (*strptr, newsize); + if (str == NULL) +@@ -925,7 +925,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr, + && wstr == (wchar_t *) *strptr + strsize) + { + size_t newsize +- = strsize + (strsize > width ? width - 1 : strsize); ++ = strsize + (strsize >= width ? width : strsize); + /* Enlarge the buffer. */ + wstr = (wchar_t *) realloc (*strptr, + newsize * sizeof (wchar_t)); +@@ -980,7 +980,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr, + && wstr == (wchar_t *) *strptr + strsize) + { + size_t newsize +- = strsize + (strsize > width ? width - 1 : strsize); ++ = strsize + (strsize >= width ? width : strsize); + /* Enlarge the buffer. */ + wstr = (wchar_t *) realloc (*strptr, + newsize * sizeof (wchar_t)); +-- +2.43.0 diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb --- a/meta/recipes-core/glibc/glibc_2.39.bb +++ b/meta/recipes-core/glibc/glibc_2.39.bb @@ -63,6 +63,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0028-CVE-2026-6238-0004.patch \ file://0029-CVE-2026-6238-0005.patch \ file://0030-CVE-2026-6238-0006.patch \ + file://CVE-2026-5450.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}"