| Message ID | 20261112115818.76259-2-UpStream_IP-SP@bmwtechworks.in |
|---|---|
| State | Not Applicable, archived |
| Delegated to: | Yoann Congal |
| Headers | show |
| Series | [scarthgap,v3,1/2] glibc: Fix CVE-2026-5450 | expand |
This is already patched, see https://git.openembedded.org/openembedded-core/commit/?h=scarthgap&id=3459c342137aea6a59c43b80289d30a84d0a3148 Peter > -----Original Message----- > From: Sourav Kumar Pramanik via openembedded-core <UpStream_IP- > SP=bmwtechworks.in@lists.openembedded.org> > Sent: Thursday, November 12, 2026 12:58 PM > To: openembedded-core@lists.openembedded.org > Cc: Sourav Kumar Pramanik <souravkumar.pramanik@bmwtechworks.in> > Subject: [OE-core] [scarthgap][PATCH v3 2/2] glibc: Fix CVE-2026-5928 > > From: Sourav Kumar Pramanik <souravkumar.pramanik@bmwtechworks.in> > > NVD describes CVE-2026-5928 as a buffer under-read in ungetwc in > glibc 2.43 and earlier, including the 2.39 version used here. With > certain character encodings, this can disclose neighboring heap > data. An uninitialized byte-stream read pointer can also cause a > program crash. > > Backport upstream commit ef3bfb5f910011f3780cb06aa47e730035f53285. > It fixes _IO_wdefault_pbackfail to compare and decrement the wide > stream read pointer instead of the byte stream read pointer. The > regression test checks that ungetwc leaves the byte stream read > pointer unchanged. > > Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-5928 > > Comment: Refreshed for glibc 2.39[adjusted source hunk locations and > Makefile contexts] > > Signed-off-by: Sourav Kumar Pramanik > <souravkumar.pramanik@bmwtechworks.in> > --- > .../glibc/glibc/CVE-2026-5928.patch | 112 ++++++++++++++++++ > meta/recipes-core/glibc/glibc_2.39.bb | 1 + > 2 files changed, 113 insertions(+) > create mode 100644 meta/recipes-core/glibc/glibc/CVE-2026-5928.patch > > diff --git a/meta/recipes-core/glibc/glibc/CVE-2026-5928.patch b/meta/recipes- > core/glibc/glibc/CVE-2026-5928.patch > new file mode 100644 > --- /dev/null > +++ b/meta/recipes-core/glibc/glibc/CVE-2026-5928.patch > @@ -0,0 +1,112 @@ > +From ef3bfb5f910011f3780cb06aa47e730035f53285 Mon Sep 17 00:00:00 > 2001 > +From: Rocket Ma <marocketbd@gmail.com> > +Date: Fri, 1 May 2026 20:39:07 -0700 > +Subject: [PATCH] libio: Fix ungetwc operating on byte stream [BZ #33998] > + > +* libio/wgenops.c: When _IO_wdefault_pbackfail attempts to push back one > +character, it accidently compare the wchar to push back with the last > +char from byte stream, instead of wide stream. Under specific coding, > +attacker may exploit this to leak information. This commit fix bug > +33998, or CVE-2026-5928. > + > +CVE: CVE-2026-5928 > +Upstream-Status: Backport > [https://sourceware.org/git/?p=glibc.git;a=commit;h=ef3bfb5f910011f3780cb06aa4 > 7e730035f53285] > +Comment: Refreshed for glibc 2.39[adjusted source hunk locations and > +Makefile contexts] > + > +Signed-off-by: Rocket Ma <marocketbd@gmail.com> > +Reviewed-by: Carlos O'Donell <carlos@redhat.com> > +Signed-off-by: Sourav Kumar Pramanik > <souravkumar.pramanik@bmwtechworks.in> > +--- > + libio/Makefile | 1 + > + libio/bug-wgenops-bz33998.c | 54 > ++++++++++++++++++++++++++++++++++++++++++++++ > + libio/wgenops.c | 4 ++-- > + 3 files changed, 57 insertions(+), 2 deletions(-) > + create mode 100644 libio/bug-wgenops-bz33998.c > + > +diff --git a/libio/Makefile b/libio/Makefile > +--- a/libio/Makefile > ++++ b/libio/Makefile > +@@ -83,6 +83,7 @@ tests = \ > + bug-ungetwc1 \ > + bug-ungetwc2 \ > + bug-wfflush \ > ++ bug-wgenops-bz33998 \ > + bug-wmemstream1 \ > + bug-wsetpos \ > + test-fmemopen \ > +diff --git a/libio/bug-wgenops-bz33998.c b/libio/bug-wgenops-bz33998.c > +new file mode 100644 > +--- /dev/null > ++++ b/libio/bug-wgenops-bz33998.c > +@@ -0,0 +1,54 @@ > ++/* Regression test for ungetwc operating on byte stream (BZ #33998) > ++ Copyright (C) 2026 The GNU Toolchain Authors. > ++ This file is part of the GNU C Library. > ++ > ++ The GNU C Library is free software; you can redistribute it and/or > ++ modify it under the terms of the GNU Lesser General Public > ++ License as published by the Free Software Foundation; either > ++ version 2.1 of the License, or (at your option) any later version. > ++ > ++ The GNU C Library is distributed in the hope that it will be useful, > ++ but WITHOUT ANY WARRANTY; without even the implied warranty of > ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the > GNU > ++ Lesser General Public License for more details. > ++ > ++ You should have received a copy of the GNU Lesser General Public > ++ License along with the GNU C Library; if not, see > ++ <https://www.gnu.org/licenses/>. */ > ++ > ++#include "support/temp_file.h" > ++#include "support/xstdio.h" > ++#include "support/xunistd.h" > ++#include <stdlib.h> > ++#include <unistd.h> > ++#include <sys/mman.h> > ++#include <stdio.h> > ++#include <wchar.h> > ++#include <support/check.h> > ++ > ++static int > ++do_test (void) > ++{ > ++ char *filename; > ++ int fd = create_temp_file ("tst-bz33998-", &filename); > ++ TEST_VERIFY (fd != -1); > ++ xwrite (fd, "A", sizeof ("A")); // write "A\0" by design > ++ xclose (fd); > ++ > ++ FILE *fp = xfopen (filename, "r+"); > ++ TEST_COMPARE (getwc (fp), L'A'); > ++ /* If the bug is fixed, then ungetwc should not touch byte stream. > ++ If the bug is not fixed, ungetwc firstly match last read char, L'A', > ++ failed, then the pbackfail branch, matching last read char in byte > ++ stream, that is, '\0' (initialized when setup wide stream). */ > ++ char *old_read_ptr = fp->_IO_read_ptr; > ++ TEST_COMPARE (ungetwc (L'\0', fp), L'\0'); > ++ TEST_VERIFY (fp->_IO_read_ptr == old_read_ptr); > ++ > ++ xfclose (fp); > ++ free (filename); > ++ > ++ return 0; > ++} > ++ > ++#include <support/test-driver.c> > +diff --git a/libio/wgenops.c b/libio/wgenops.c > +--- a/libio/wgenops.c > ++++ b/libio/wgenops.c > +@@ -108,8 +108,8 @@ _IO_wdefault_pbackfail (FILE *fp, wint_t c) > + { > + if (fp->_wide_data->_IO_read_ptr > fp->_wide_data->_IO_read_base > + && !_IO_in_backup (fp) > +- && (wint_t) fp->_IO_read_ptr[-1] == c) > +- --fp->_IO_read_ptr; > ++ && (wint_t) fp->_wide_data->_IO_read_ptr[-1] == c) > ++ --fp->_wide_data->_IO_read_ptr; > + else > + { > + /* Need to handle a filebuf in write mode (switch to read mode). FIXME!*/ > +-- > +2.43.0 > diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes- > core/glibc/glibc_2.39.bb > --- a/meta/recipes-core/glibc/glibc_2.39.bb > +++ b/meta/recipes-core/glibc/glibc_2.39.bb > @@ -64,6 +64,7 @@ SRC_URI = > "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ > file://0029-CVE-2026-6238-0005.patch \ > file://0030-CVE-2026-6238-0006.patch \ > file://CVE-2026-5450.patch \ > + file://CVE-2026-5928.patch \ > " > S = "${WORKDIR}/git" > B = "${WORKDIR}/build-${TARGET_SYS}" > -- > 2.43.0
diff --git a/meta/recipes-core/glibc/glibc/CVE-2026-5928.patch b/meta/recipes-core/glibc/glibc/CVE-2026-5928.patch new file mode 100644 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/CVE-2026-5928.patch @@ -0,0 +1,112 @@ +From ef3bfb5f910011f3780cb06aa47e730035f53285 Mon Sep 17 00:00:00 2001 +From: Rocket Ma <marocketbd@gmail.com> +Date: Fri, 1 May 2026 20:39:07 -0700 +Subject: [PATCH] libio: Fix ungetwc operating on byte stream [BZ #33998] + +* libio/wgenops.c: When _IO_wdefault_pbackfail attempts to push back one +character, it accidently compare the wchar to push back with the last +char from byte stream, instead of wide stream. Under specific coding, +attacker may exploit this to leak information. This commit fix bug +33998, or CVE-2026-5928. + +CVE: CVE-2026-5928 +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=ef3bfb5f910011f3780cb06aa47e730035f53285] +Comment: Refreshed for glibc 2.39[adjusted source hunk locations and +Makefile contexts] + +Signed-off-by: Rocket Ma <marocketbd@gmail.com> +Reviewed-by: Carlos O'Donell <carlos@redhat.com> +Signed-off-by: Sourav Kumar Pramanik <souravkumar.pramanik@bmwtechworks.in> +--- + libio/Makefile | 1 + + libio/bug-wgenops-bz33998.c | 54 ++++++++++++++++++++++++++++++++++++++++++++++ + libio/wgenops.c | 4 ++-- + 3 files changed, 57 insertions(+), 2 deletions(-) + create mode 100644 libio/bug-wgenops-bz33998.c + +diff --git a/libio/Makefile b/libio/Makefile +--- a/libio/Makefile ++++ b/libio/Makefile +@@ -83,6 +83,7 @@ tests = \ + bug-ungetwc1 \ + bug-ungetwc2 \ + bug-wfflush \ ++ bug-wgenops-bz33998 \ + bug-wmemstream1 \ + bug-wsetpos \ + test-fmemopen \ +diff --git a/libio/bug-wgenops-bz33998.c b/libio/bug-wgenops-bz33998.c +new file mode 100644 +--- /dev/null ++++ b/libio/bug-wgenops-bz33998.c +@@ -0,0 +1,54 @@ ++/* Regression test for ungetwc operating on byte stream (BZ #33998) ++ Copyright (C) 2026 The GNU Toolchain Authors. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ <https://www.gnu.org/licenses/>. */ ++ ++#include "support/temp_file.h" ++#include "support/xstdio.h" ++#include "support/xunistd.h" ++#include <stdlib.h> ++#include <unistd.h> ++#include <sys/mman.h> ++#include <stdio.h> ++#include <wchar.h> ++#include <support/check.h> ++ ++static int ++do_test (void) ++{ ++ char *filename; ++ int fd = create_temp_file ("tst-bz33998-", &filename); ++ TEST_VERIFY (fd != -1); ++ xwrite (fd, "A", sizeof ("A")); // write "A\0" by design ++ xclose (fd); ++ ++ FILE *fp = xfopen (filename, "r+"); ++ TEST_COMPARE (getwc (fp), L'A'); ++ /* If the bug is fixed, then ungetwc should not touch byte stream. ++ If the bug is not fixed, ungetwc firstly match last read char, L'A', ++ failed, then the pbackfail branch, matching last read char in byte ++ stream, that is, '\0' (initialized when setup wide stream). */ ++ char *old_read_ptr = fp->_IO_read_ptr; ++ TEST_COMPARE (ungetwc (L'\0', fp), L'\0'); ++ TEST_VERIFY (fp->_IO_read_ptr == old_read_ptr); ++ ++ xfclose (fp); ++ free (filename); ++ ++ return 0; ++} ++ ++#include <support/test-driver.c> +diff --git a/libio/wgenops.c b/libio/wgenops.c +--- a/libio/wgenops.c ++++ b/libio/wgenops.c +@@ -108,8 +108,8 @@ _IO_wdefault_pbackfail (FILE *fp, wint_t c) + { + if (fp->_wide_data->_IO_read_ptr > fp->_wide_data->_IO_read_base + && !_IO_in_backup (fp) +- && (wint_t) fp->_IO_read_ptr[-1] == c) +- --fp->_IO_read_ptr; ++ && (wint_t) fp->_wide_data->_IO_read_ptr[-1] == c) ++ --fp->_wide_data->_IO_read_ptr; + else + { + /* Need to handle a filebuf in write mode (switch to read mode). FIXME!*/ +-- +2.43.0 diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb --- a/meta/recipes-core/glibc/glibc_2.39.bb +++ b/meta/recipes-core/glibc/glibc_2.39.bb @@ -64,6 +64,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0029-CVE-2026-6238-0005.patch \ file://0030-CVE-2026-6238-0006.patch \ file://CVE-2026-5450.patch \ + file://CVE-2026-5928.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}"