From patchwork Thu Oct 22 22:47:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 101711 Received: from mta-64-228.siemens.flowmailer.net (mta-64-228.siemens.flowmailer.net [185.136.64.228]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.2246.1792709321364008109 for ; Thu, 22 Oct 2026 15:48:41 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=NpyQY9w5; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.228, mailfrom: fm-256628-20261022224839e68114feb80002078d-wrodky@rts-flowmailer.siemens.com) Received: by mta-64-228.siemens.flowmailer.net with ESMTPSA id 20261022224839e68114feb80002078d for ; Fri, 23 Oct 2026 00:48:39 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=Zj94oDb/Xbp77YFOSyH1Mg27M8Qp6BCFSDLzqJonbKA=; b=NpyQY9w5e59C07w66a0cFfk30nROACtbGnt68uJoK2cYynCTu9rzuBTuGmXCivMnh717Go xywB7b2cjDORLKrzP06pglzGoBkWGgpLhojTzMfaQtQKouvGl777wNpOlgGbjOWJqmtbaCiw Y7CZGOT2x1SQ8sdCxIxrCf8jl4488TWfCdNy/J6+SCXtaBnz12RJravbz9AhD1ECN251+/Kz X+scnXGFWkB65dkjd/4M3Pzq/0IzDNE2hqAF+fOiFtJEmu+naABLbm2OGC8P6/9L0VWJM99j mb3FtsoiILR3iCzolmOcCnJrCiGrC2DxbiLPoxOw/DqLcu1mTRhF0WQg==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [scarthgap][PATCH 11/15] glibc: patch CVE-2026-8674 Date: Fri, 23 Oct 2026 00:47:04 +0200 Message-ID: <20261022224711.3783258-11-peter.marko@siemens.com> In-Reply-To: <20261022224711.3783258-1-peter.marko@siemens.com> References: <20261022224711.3783258-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 22 Oct 2026 22:48:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248466 From: Peter Marko Pick patch referencing this CVE from 3.41 branch (oldest release still receiving security updates). Signed-off-by: Peter Marko --- .../glibc/glibc/0042-CVE-2026-8674.patch | 118 ++++++++++++++++++ meta/recipes-core/glibc/glibc_2.39.bb | 1 + 2 files changed, 119 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/0042-CVE-2026-8674.patch diff --git a/meta/recipes-core/glibc/glibc/0042-CVE-2026-8674.patch b/meta/recipes-core/glibc/glibc/0042-CVE-2026-8674.patch new file mode 100644 index 00000000000..bbdeafd5f38 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0042-CVE-2026-8674.patch @@ -0,0 +1,118 @@ +From c97fdd483232a831829aaff458a212307f1bf4bc Mon Sep 17 00:00:00 2001 +From: Adhemerval Zanella +Date: Mon, 14 Sep 2026 17:08:03 -0300 +Subject: [PATCH] resolv: Fix assertion failure on search list truncation [BZ + 31026, CVE-2026-8674] + +update_from_conf copies the search list into the 256-byte +resp->defdname and truncates it when an entry does not fit, then +asserts that resolv_conf_matches accepts the result. + +The truncation check there compared the accumulated size against +sizeof (resp->dnsrch) (the pointer array) instead of resp->defdname, +and the empty-list case did not account for a first entry that does +not fit at all. A long search domain in resolv.conf or LOCALDOMAIN +thus aborts any process using the resolver. + +Check whether the entry fits in the remaining defdname space, matching +alloc_buffer_copy_string, and also accept an empty resp->dnsrch when +the first entry is too long. Add tests covering both cases through +the search and domain directives. + +Checked on x86_64-linux-gnu and i686-linux-gnu. +Reviewed-by: Florian Weimer + +(cherry picked from commit 506ea57086bfb9ce3daff1c14246a1cb532aba0a) +(cherry picked from commit c0c8a45dee30c8089822d859575a3ad4324b15ff) + +CVE: CVE-2026-8674 +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=c97fdd483232a831829aaff458a212307f1bf4bc] +Signed-off-by: Peter Marko +--- + resolv/resolv_conf.c | 19 +++++++++------ + resolv/tst-resolv-res_init-skeleton.c | 35 +++++++++++++++++++++++++++ + 2 files changed, 47 insertions(+), 7 deletions(-) + +diff --git a/resolv/resolv_conf.c b/resolv/resolv_conf.c +index dcf92ee90e..0418267044 100644 +--- a/resolv/resolv_conf.c ++++ b/resolv/resolv_conf.c +@@ -281,8 +281,12 @@ resolv_conf_matches (const struct __res_state *resp, + { + if (resp->dnsrch[0] == NULL) + { +- /* Empty search list. No default domain name. */ +- return conf->search_list_size == 0 && resp->defdname[0] == '\0'; ++ /* Empty search list, or the first entry does not fit in ++ resp->defdname. No default domain name. */ ++ return resp->defdname[0] == '\0' ++ && (conf->search_list_size == 0 ++ || (strlen (conf->search_list[0]) + 1 ++ > sizeof (resp->defdname))); + } + + if (resp->dnsrch[0] != resp->defdname) +@@ -309,11 +313,12 @@ resolv_conf_matches (const struct __res_state *resp, + } + else + { +- /* resp->dnsrch is truncated if the number of elements +- exceeds MAXDNSRCH, or if the combined storage space for +- the search list exceeds what can be stored in +- resp->defdname. */ +- if (i == MAXDNSRCH || search_list_size > sizeof (resp->dnsrch)) ++ /* resp->dnsrch is truncated if the number of elements exceeds ++ MAXDNSRCH, or if conf->search_list[i] does not fit in the ++ remaining space of resp->defdname. */ ++ if (i == MAXDNSRCH ++ || (search_list_size + strlen (conf->search_list[i]) + 1 ++ > sizeof (resp->defdname))) + break; + /* Otherwise, a mismatch indicates a match failure. */ + return false; +diff --git a/resolv/tst-resolv-res_init-skeleton.c b/resolv/tst-resolv-res_init-skeleton.c +index 3ccbe71db9..4e9c57f3cb 100644 +--- a/resolv/tst-resolv-res_init-skeleton.c ++++ b/resolv/tst-resolv-res_init-skeleton.c +@@ -713,6 +713,41 @@ struct test_case test_cases[] = + "nameserver 192.0.2.1\n" + "; nameserver[0]: [192.0.2.1]:53\n" + }, ++/* Search list entries which do not fit in the legacy 256-byte ++ resp->defdname buffer (bug 31026). LONG244 is 244 characters long, ++ so it does not fit after "example.com\0" (12 bytes). LONG256 is 256 ++ characters long, so it does not fit even as the first entry. */ ++#define LBL63 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" ++#define LONG244 LBL63 "." LBL63 "." LBL63 "." \ ++ "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" ++#define LONG256 LBL63 "." LBL63 "." LBL63 "." LBL63 "a" ++ {.name = "search list truncated at long entry after short entry", ++ .conf = "nameserver 192.0.2.1\n" ++ "search example.com " LONG244 "\n", ++ .expected = "search example.com\n" ++ "; search[0]: example.com\n" ++ "; search[1]: " LONG244 "\n" ++ "nameserver 192.0.2.1\n" ++ "; nameserver[0]: [192.0.2.1]:53\n" ++ }, ++ {.name = "search list truncated at long first entry", ++ .conf = "nameserver 192.0.2.1\n" ++ "search " LONG256 " example.com\n", ++ .expected = "; search[0]: " LONG256 "\n" ++ "; search[1]: example.com\n" ++ "nameserver 192.0.2.1\n" ++ "; nameserver[0]: [192.0.2.1]:53\n" ++ }, ++ {.name = "long first entry from the domain directive", ++ .conf = "nameserver 192.0.2.1\n" ++ "domain " LONG256 "\n", ++ .expected = "; search[0]: " LONG256 "\n" ++ "nameserver 192.0.2.1\n" ++ "; nameserver[0]: [192.0.2.1]:53\n" ++ }, ++#undef LONG256 ++#undef LONG244 ++#undef LBL63 + {.name = "trust-ad flag", + .conf = "options trust-ad\n" + "nameserver 192.0.2.1\n", diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb index 3e95792b359..3b27328c21a 100644 --- a/meta/recipes-core/glibc/glibc_2.39.bb +++ b/meta/recipes-core/glibc/glibc_2.39.bb @@ -74,6 +74,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0039-CVE-2026-77117-CVE-2026-80489.patch \ file://0040-CVE-2026-18374-01.patch \ file://0041-CVE-2026-18374-02.patch \ + file://0042-CVE-2026-8674.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}"