diff mbox series

[meta-webserver,scarthgap] meta-webserver: nginx: fix CVE-2026-15176

Message ID 20261103101002.791759-1-joaomarcos.costa@bootlin.com
State New
Headers show
Series [meta-webserver,scarthgap] meta-webserver: nginx: fix CVE-2026-15176 | expand

Commit Message

Joao Marcos Costa Nov. 3, 2026, 10:10 a.m. UTC 
From: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com>

This commit comes from between versions 1.30.5 and 1.30.6 of nginx, and
fixes buffer overflow vulnerability [1] when using alias with rewrite.

There is no direct mention to the CVE in the original commit message or title,
so one needs to look each commit between the two versions to find one that fixes
the root cause (i.e. buffer overflow with aliases).

[1] https://lists.openembedded.org/g/openembedded-devel/message/131009

Signed-off-by: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com>
---
 .../nginx/nginx-1.24.0/CVE-2026-15176.patch   | 52 +++++++++++++++++++
 .../recipes-httpd/nginx/nginx_1.24.0.bb       |  1 +
 2 files changed, 53 insertions(+)
 create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2026-15176.patch
diff mbox series

Patch

diff --git a/meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2026-15176.patch b/meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2026-15176.patch
new file mode 100644
index 0000000000..9165604318
--- /dev/null
+++ b/meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2026-15176.patch
@@ -0,0 +1,52 @@ 
+From 52732d739d5b1c406064e255a467ed160369508a Mon Sep 17 00:00:00 2001
+From: Roman Arutyunyan <arut@nginx.com>
+Date: Fri, 10 Jul 2026 20:10:12 +0400
+Subject: [PATCH] Avoid post-rewrite URI to path mapping with alias
+
+Previously, after a "rewrite" had changed the URI, and before a new
+location was chosen, the new URI might not match the current location
+prefix.  This becomes a problem when the location uses "alias", which
+is why normally such inconsistency is detected by checking the
+r->valid_location flag.  Meanwhile this flag only handles the
+inconsistency when using the "break" directive or parameter.  However
+in absence of those, there's still an inconsistency window from URI
+change up until the end of the current set of rewrite directives.
+URI to path mapping within this window might result in a buffer
+overflow if location's prefix was longer than the rewritten URI.
+
+The following example resulted in a buffer overflow with the request
+"/foo/1":
+
+location /foo/ {
+    alias /bar/;
+    rewrite ^/foo/.*$ /x;
+    return 200 $request_filename;
+}
+
+Alternatively, $request_filename might be used in access log format,
+"set", "if", "add_header", etc.
+
+The fix is to reject URI mapping in ngx_http_map_uri_to_path() if the
+r->uri_changed flag is set.
+
+CVE: CVE-2026-15176
+Upstream-Status: Backport [https://github.com/nginx/nginx/commit/ce1da78900b07e72f37a25f55e6606220ac45902]
+Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com>
+
+---
+ src/http/ngx_http_core_module.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c
+index b1872bcdd..22e1c69f4 100644
+--- a/src/http/ngx_http_core_module.c
++++ b/src/http/ngx_http_core_module.c
+@@ -1891,7 +1891,7 @@ ngx_http_map_uri_to_path(ngx_http_request_t *r, ngx_str_t *path,
+ 
+     alias = clcf->alias;
+ 
+-    if (alias && !r->valid_location) {
++    if (alias && (!r->valid_location || r->uri_changed)) {
+         ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,
+                       "\"alias\" cannot be used in location \"%V\" "
+                       "where URI was rewritten", &clcf->name);
diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.24.0.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.24.0.bb
index b5707d83eb..8dab9f3326 100644
--- a/meta-webserver/recipes-httpd/nginx/nginx_1.24.0.bb
+++ b/meta-webserver/recipes-httpd/nginx/nginx_1.24.0.bb
@@ -25,6 +25,7 @@  SRC_URI:append = " \
                   file://CVE-2026-42533-3.patch \
                   file://CVE-2026-42533-4.patch \
                   file://CVE-2026-42533-5.patch \
+                  file://CVE-2026-15176.patch \
 "
 
 SRC_URI[sha256sum] = "77a2541637b92a621e3ee76776c8b7b40cf6d707e69ba53a940283e30ff2f55d"