From patchwork Fri Oct 16 05:21:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100971 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A7F2DCC6B38 for ; Fri, 16 Oct 2026 05:21:16 +0000 (UTC) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15073.1792128072206292822 for ; Thu, 15 Oct 2026 22:21:12 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=LMqCTC7w; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4136; q=dns/txt; s=iport01; t=1792128072; x=1793337672; h=from:to:subject:date:message-id:mime-version: content-transfer-encoding; bh=Rp+2LyYREbqgkm9EovpLECMupBpo0PDdazXn6dOKFBc=; b=LMqCTC7welqi4Ek17YY2hQpVZZGvwb0Bd0cmw1vTLvZZ5ONjlKalp/Nu tO8+0NEPpqFCTQ9JN1aqCdqni0b/5rg558w/ikpNlEnoGhLOeWO5hXvtU kHt4Q7F1b6H+DC9v6K7qejWrKYmCpvlNv9plmTsqnK+hJC2np9GSNBMzh bnrIMWdhrecL5QuDD5eou5fSIEHTXOTyXBnLTYbvWK8MY1SIDmD0tIgHi PxNIunun3p+SIcvI9xvfc4XocQ4QSrBrvDqqpi62uQzz64uAzfWwhZe3t r0OYSak0cRhc4LUA4TWAcTUhl5dCYBm/qzUgQsGajMjPOlfJWWNDrSlFv A==; X-CSE-ConnectionGUID: E9NMI2UfQ+62Lmuh/DtbvA== X-CSE-MsgGUID: RCly8gLsTTGBfLtlwh32KA== X-IPAS-Result: A0AmAAAKs9Fq/5X/Ja1aHQEBAQEJARIBBQUBgXwIAQsBglZ1YENJjHKHN4Ihnh8UgWoPAQEBD0QNBAEBhQWOFwImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgEtCwEYAVkDAQJaIyGDAgGCdAMRvC4bN4F5M4EBgykBPwJDUNlKgWgBCxQBgTgBhT+II10YAYR8JxuBSUSBFAGDaYEFgVwBAQOBJCABPoYfBIMcEoFaGAaVKUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQegkUgAYENARMXAYJmoxqCIaEPhCiMIpU6GjOFW6UUC5h9jgqVOoEVhGmBaDyBRwsHMxoIGxWDIglKGQ+OKwMLC4NggX9ly3YnMgIJMgEBBwIHDgMLgWiQAIF+AQE IronPort-Data: A9a23:IgCmy6xC5W07IZkWDCF6t+dhxyrEfRIJ4+MujC+fZmUNrF6WrkVVx 2IYDW+Gb66CMGH1KNx0bIrgpBwA7cPRm4RjGgFl+1hgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWcsazxMsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJGxnG6g5oNt5OCIQr 9gdNTBKQgyJmcvjldpXSsE07igiBNPgMIVavjRryivUSK98B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cMnWjOX9PYH46tPa1nHDzfhVTqUmeouw85G27IAlZjeOzbISJK4fQLSlTtnyzo nOW8EDiPi01HtK71T6a8in2pcaayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PW0lEO6c9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl/DQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSv1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:qVMgu6AscgMFHgblHemc55DYdb4zR+YMi2TDsHoBKyC9Hfb3qy nDppkmPHzP+VUssQ8b+OxoUZPoKRi3yXcf2+Ys1NmZMDUOwFHJEKhSqa3/3jbnByryssRZ1a tmbuxCLeeYNykesS4/izPIdOrJB7K8gcSVuds= X-Talos-CUID: 9a23:wTKIx2r4ZzPfXypu04KCEBTmUe10VFj8lkreGgzmU0JsVb3SZUOa5ooxxg== X-Talos-MUID: 9a23:uJAfawkLC0t7NYwds7WLdnpYH8N5s6uKE3wxvr8In9WAKiwrYRS02WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536464932" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:21:11 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id 0DC12180001CB for ; Fri, 16 Oct 2026 05:21:11 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id A7B11CC1611; Thu, 15 Oct 2026 22:21:10 -0700 (PDT) From: Yogita Urade To: openembedded-devel@lists.openembedded.org Subject: [oe][meta-oe][wrynose][PATCH 1/4] redis: fix CVE-2026-23479 Date: Thu, 15 Oct 2026 22:21:07 -0700 Message-Id: <20261016052110.184934-1-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:21:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131049 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/redis/redis/commit/c14e9925e571c3c8ecbeb8632fe834faa32175ea [2] https://nvd.nist.gov/vuln/detail/CVE-2026-23479 Signed-off-by: Yogita Urade --- .../redis/redis-8.0.6/CVE-2026-23479.patch | 77 +++++++++++++++++++ meta-oe/recipes-extended/redis/redis_8.0.6.bb | 1 + 2 files changed, 78 insertions(+) create mode 100644 meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-23479.patch diff --git a/meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-23479.patch b/meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-23479.patch new file mode 100644 index 0000000000..756d6dd746 --- /dev/null +++ b/meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-23479.patch @@ -0,0 +1,77 @@ +From 0fa208a25f95603e255211254097dd34a165fed0 Mon Sep 17 00:00:00 2001 +From: "debing.sun" +Date: Mon, 29 Dec 2025 16:20:41 +0800 +Subject: [PATCH] Fix use-after-free when evicting blocked client during + unblock (CVE-2026-23479) + +When re-executing a pending command after unblocking, check the return value +of `processCommandAndResetClient` and exit if needed. + +CVE: CVE-2026-23479 +Upstream-Status: Backport [https://github.com/redis/redis/commit/c14e9925e571c3c8ecbeb8632fe834faa32175ea] + +(cherry picked from commit c14e9925e571c3c8ecbeb8632fe834faa32175ea) +Signed-off-by: Yogita Urade +--- + src/blocked.c | 8 +++++++- + tests/unit/client-eviction.tcl | 29 +++++++++++++++++++++++++++++ + 2 files changed, 36 insertions(+), 1 deletion(-) + +diff --git a/src/blocked.c b/src/blocked.c +index 86cff0b7f..a35ffb569 100644 +--- a/src/blocked.c ++++ b/src/blocked.c +@@ -676,7 +676,13 @@ static void unblockClientOnKey(client *c, robj *key) { + client *old_client = server.current_client; + server.current_client = c; + enterExecutionUnit(1, 0); +- processCommandAndResetClient(c); ++ if (processCommandAndResetClient(c) == C_ERR) { ++ /* Client was freed during command processing, exit immediately */ ++ exitExecutionUnit(); ++ server.current_client = old_client; ++ return; ++ } ++ + if (!(c->flags & CLIENT_BLOCKED)) { + if (c->flags & CLIENT_MODULE) { + moduleCallCommandUnblockedHandler(c); +diff --git a/tests/unit/client-eviction.tcl b/tests/unit/client-eviction.tcl +index 3caaf9bd4..62e42580c 100644 +--- a/tests/unit/client-eviction.tcl ++++ b/tests/unit/client-eviction.tcl +@@ -607,5 +607,34 @@ start_server {} { + } + } + ++start_server {} { ++ r flushall ++ r client no-evict on ++ r config set maxmemory-clients 0 ++ ++ test "Verify blocked client eviction during unblock does not cause use-after-free" { ++ # Create a deferring client that will be blocked on stream ++ # Use a long stream name to make client memory usage exceed 200000 bytes ++ set rd [redis_deferring_client] ++ $rd XREAD BLOCK 0 STREAMS mystream stream_[string repeat x 200000] $ $ ++ ++ # Wait for the client to be blocked ++ wait_for_condition 50 100 { ++ [s blocked_clients] eq {1} ++ } else { ++ fail "Client was not blocked" ++ } ++ ++ # Now lower MAXMEMORY-CLIENTS to a low value and use ++ # XADD to unblock the blocked client, triggering eviction. ++ r MULTI ++ r CONFIG SET MAXMEMORY-CLIENTS 100000 ;# Put in MULTI to defer blocked client eviction until after EXEC ++ r XADD mystream * field val ++ r EXEC ++ r PING ++ $rd close ++ } ++} ++ + } ;# tags + diff --git a/meta-oe/recipes-extended/redis/redis_8.0.6.bb b/meta-oe/recipes-extended/redis/redis_8.0.6.bb index 67126c9fcf..f09bb8aba2 100644 --- a/meta-oe/recipes-extended/redis/redis_8.0.6.bb +++ b/meta-oe/recipes-extended/redis/redis_8.0.6.bb @@ -16,6 +16,7 @@ SRC_URI = "http://download.redis.io/releases/${BP}.tar.gz \ file://0004-src-Do-not-reset-FINAL_LIBS.patch \ file://0005-Define-_GNU_SOURCE-to-get-PTHREAD_MUTEX_INITIALIZER.patch \ file://CVE-2026-81934.patch \ + file://CVE-2026-23479.patch \ " SRC_URI[sha256sum] = "6d0a9913887a4972536f9da226f1575859c34d86354129163260a5f9c6bd4229" From patchwork Fri Oct 16 05:21:08 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100969 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 700C5CC6B2D for ; Fri, 16 Oct 2026 05:21:16 +0000 (UTC) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15355.1792128072118186622 for ; Thu, 15 Oct 2026 22:21:12 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=hraADFrD; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=5656; q=dns/txt; s=iport01; t=1792128072; x=1793337672; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=jCh4TJRDPXBLk78krjdi2HeJ/JhmCWqlLI/PK2sg4ro=; b=hraADFrDZx9o01NTpws2oG6UJ/N3BCFDua+e6NoH7MlJmuhmqfPG5pJD IWRJQO8sjdUx3AA/mgNbqOOjAYciYqxydNWHIP7xY/ur4fwvLGnshacGH RLeBtISLynTxHHGpZd6yxFZpSki8ECiZBh0kKoNgLbHxY6zOC4HB2BgdI 00OTO+ReYliTHjKjaUhj/S/TL9SQO6BBjYW72jze8NvOFsnfbToViz12Y eHZV5TSxB91Iup88hObqd03gbqicMY0gYol7BTrWBExNl1oGMNKdy/x/j 9X35vD/mFjlwrygBiqqmlhJdBJLBN0o5KqIflNc4Vh5KZG4heXeJqa1nh g==; X-CSE-ConnectionGUID: phVUkw4CRCi0eqrz4Ci3Wg== X-CSE-MsgGUID: GQcXNXVZQaqVHkIKCn7hxQ== X-IPAS-Result: A0BcAgAKs9Fq/5H/Ja1aglmCGD91YENJlCmCIQOLZZI3gX4PAQEBD0QNBAEBhQUCjhUCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDMgEYAT0cAwECLyALIwgZgwIBgjoDNwMRvC4bN4IsgQGDKQE/AkNQ2EsNcoFoAQsUAYE4hUCCf4UkXRgBhHwnG4FJRIEVg2mBBYEaQgEBA4E1hm0EgxwSgVoYBpUpSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6CZYEOARMXAYFoGmSSV5BDgiGgHnGEKIwijz6FfBozhASBV5JAklQLmH2OCoQJkkaEaYFoPIFHCwczGggbFYMiCUoZD44uCwuBFAEJgkKBf2XLdicyAgkyAQEHAgcOAwuBaJABgX0BAQ IronPort-Data: A9a23:hS+UiartKI9MGrz/4b/hPBL7nU1eBmJOZBIvgKrLsJaIsI4StFCzt garIBnTM66JazH9ftB+bt6+9ksH7JOGnNJjQAFurns3QX8QpePIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfvb8U035ZwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0v53P1xN6 qAzEhsMNh2anfDq67PgdeY506zPLOGzVG8ekmtrwTecCbMtRorOBv2ao9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5LVfrSn8/w7pX7WyxFsluZqII84nPYy0p6172F3N/9J4bTFJQFxBfCz o7A10vACSE8BOKt8DOczFKvp8zkm3z7SLtHQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHt5SN UEQ0i4vtrQpskuzQ9/wWhe1rHKJslgbQdU4LgEhwBuGxqyR50OSAXIJC2YRLtcnr8QxAzct0 zdlgu/UONCmi5XNIVr1y1tehWra1fQ9RYPaWRI5cA== IronPort-HdrOrdr: A9a23:RCmFm66pN2l2UtLsHgPXwOTXdLJyesId70hD6qkXc20wTiX2ra 6TdZgguCMczQxhO03I+urwXZVoP0m8yXcd2+B4Vt2ftUvdyQmVxepZgrcKrQeNJ8SHzI5g/J YlVbRiA9vtClU/p8P77A6kV+sE+rC8gceVbSO09QYVcemsAJsQiTtENg== X-Talos-CUID: 9a23:glmUI27yOqLv36bhn9ss7E4qJ8M6Llbn53aILlaiGzpCSeaqRgrF X-Talos-MUID: 9a23:biPBTw3kM4yyAr9Pkl/WTU2nHjUjzJ2lOGY9r6c/stC6FS9RGByb0zSne9py X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="521998292" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:21:11 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id 1238818000443 for ; Fri, 16 Oct 2026 05:21:11 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id AB3DCCBF201; Thu, 15 Oct 2026 22:21:10 -0700 (PDT) From: Yogita Urade To: openembedded-devel@lists.openembedded.org Subject: [oe][meta-oe][wrynose][PATCH 2/4] redis: fix CVE-2026-23631 Date: Thu, 15 Oct 2026 22:21:08 -0700 Message-Id: <20261016052110.184934-2-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016052110.184934-1-yurade@cisco.com> References: <20261016052110.184934-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:21:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131047 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/redis/redis/commit/0cca172a174642bdae03b871615227896274d9bb [2] https://nvd.nist.gov/vuln/detail/CVE-2026-23631 Signed-off-by: Yogita Urade --- .../redis/redis-8.0.6/CVE-2026-23631.patch | 119 ++++++++++++++++++ meta-oe/recipes-extended/redis/redis_8.0.6.bb | 1 + 2 files changed, 120 insertions(+) create mode 100644 meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-23631.patch diff --git a/meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-23631.patch b/meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-23631.patch new file mode 100644 index 0000000000..abb3098820 --- /dev/null +++ b/meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-23631.patch @@ -0,0 +1,119 @@ +From 0cca172a174642bdae03b871615227896274d9bb Mon Sep 17 00:00:00 2001 +From: Ozan Tezcan +Date: Tue, 14 Apr 2026 08:47:04 +0300 +Subject: [PATCH] Fix use-after-free when fullsync happens while replica is + running a timed out script (CVE-2026-23631) + +Fullsync triggers emptyData and scriptingReset which free the scripting/function engine. If a timed out script is still running on the replica, this causes a use-after-free. Delay fullsync processing in readSyncBulkPayload until the script finishes. + +CVE: CVE-2026-23631 +Upstream-Status: Backport [https://github.com/redis/redis/commit/0cca172a174642bdae03b871615227896274d9bb] + +(cherry picked from commit 0cca172a174642bdae03b871615227896274d9bb) +Signed-off-by: Yogita Urade +--- + src/replication.c | 5 ++ + tests/integration/replication.tcl | 77 +++++++++++++++++++++++++++++++ + 2 files changed, 82 insertions(+) + +diff --git a/src/replication.c b/src/replication.c +index 5fab23b1c..489032aed 100644 +--- a/src/replication.c ++++ b/src/replication.c +@@ -2022,6 +2022,11 @@ void replicationAttachToNewMaster(void) { + /* Asynchronously read the SYNC payload we receive from a master */ + #define REPL_MAX_WRITTEN_BEFORE_FSYNC (1024*1024*8) /* 8 MB */ + void readSyncBulkPayload(connection *conn) { ++ /* During full sync, the functions engine is freed right before loading ++ * the RDB. To avoid this happening while a function is still running, ++ * delay full sync processing until it finishes. */ ++ if (isInsideYieldingLongCommand()) return; ++ + char buf[PROTO_IOBUF_LEN]; + ssize_t nread, readlen, nwritten; + int use_diskless_load = useDisklessLoad(); +diff --git a/tests/integration/replication.tcl b/tests/integration/replication.tcl +index 65494f427..412a00740 100644 +--- a/tests/integration/replication.tcl ++++ b/tests/integration/replication.tcl +@@ -1661,3 +1661,80 @@ start_server {tags {"repl external:skip"}} { + } + } + } ++ ++# Fullsync should not free the functions lib ctx while the replica has ++# a timed out function that is still running. ++foreach type {script function} { ++ start_server {tags {"repl external:skip"}} { ++ start_server {} { ++ set master [srv -1 client] ++ set master_host [srv -1 host] ++ set master_port [srv -1 port] ++ set replica [srv 0 client] ++ ++ test "Fullsync should not free scripting engine on a replica while a $type is running" { ++ $master config set repl-diskless-sync yes ++ $master config set repl-diskless-sync-delay 0 ++ # Set small client output buffer limit to trigger fullsync quickly ++ $master config set client-output-buffer-limit "replica 1k 1k 0" ++ $replica config set repl-diskless-load yes ++ $replica config set busy-reply-threshold 1 ;# script timeout in 1 ms ++ ++ # Load function ++ if {$type eq "function"} { ++ $master function load replace {#!lua name=blocklib ++ redis.register_function{ ++ function_name='blockfunc', ++ callback=function() while true do end end, ++ flags={'no-writes'} ++ } ++ } ++ } ++ ++ # Start replication ++ $replica replicaof $master_host $master_port ++ wait_for_sync $replica ++ ++ # Run the blocking script on replica ++ set rd [redis_deferring_client] ++ if {$type eq "script"} { ++ $rd eval {while true do end} 0 ++ } else { ++ $rd fcall_ro blockfunc 0 ++ } ++ ++ # Verify replica replies with BUSY ++ wait_for_condition 50 100 { ++ [catch {$replica ping} e] == 1 && [string match {*BUSY*} $e] ++ } else { ++ fail "$type didn't become busy" ++ } ++ ++ # Fills client output buffer and triggers fullsync ++ populate 5 bigkey 1000000 -1 ++ wait_for_condition 50 100 { ++ [s -1 sync_full] >= 2 ++ } else { ++ fail "Fullsync was not triggered" ++ } ++ ++ # Verify replica is still running the function ++ after 1000 ++ catch {$replica ping} e ++ assert_match {*BUSY*} $e "replica should still reply with BUSY" ++ ++ if {$type eq "script"} { ++ $replica script kill ++ } else { ++ $replica function kill ++ } ++ ++ # Verify replica is responsive again ++ catch {$rd read} result ++ $rd close ++ wait_for_sync $replica ++ assert_equal [$replica ping] "PONG" ++ } ++ } ++ } ++} diff --git a/meta-oe/recipes-extended/redis/redis_8.0.6.bb b/meta-oe/recipes-extended/redis/redis_8.0.6.bb index f09bb8aba2..a83ffbae48 100644 --- a/meta-oe/recipes-extended/redis/redis_8.0.6.bb +++ b/meta-oe/recipes-extended/redis/redis_8.0.6.bb @@ -17,6 +17,7 @@ SRC_URI = "http://download.redis.io/releases/${BP}.tar.gz \ file://0005-Define-_GNU_SOURCE-to-get-PTHREAD_MUTEX_INITIALIZER.patch \ file://CVE-2026-81934.patch \ file://CVE-2026-23479.patch \ + file://CVE-2026-23631.patch \ " SRC_URI[sha256sum] = "6d0a9913887a4972536f9da226f1575859c34d86354129163260a5f9c6bd4229" From patchwork Fri Oct 16 05:21:09 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100972 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 86CEBCCA464 for ; Fri, 16 Oct 2026 05:21:26 +0000 (UTC) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15076.1792128079811246893 for ; Thu, 15 Oct 2026 22:21:19 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Y/HJG9YP; spf=pass (domain: cisco.com, ip: 173.37.86.79, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=14200; q=dns/txt; s=iport01; t=1792128079; x=1793337679; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=hZjdWomV2zTtmFg9BG3HqpMb/Zu9Y7prTW3cFWhNTKE=; b=Y/HJG9YP457MeOnlKv6hCDSeWYqSpERHNhuARDKzdLOfRWhVsecTPpDy B70gE6pD+aCVy7G1+XTdfJAMbi/owMSrwO3LJD/QFY8n7ntQlTafDt02W UXeaVKbZg1/u8uC4m2vEXh7kP4dNjF6kWXisiViwoSPJwuROL6nCeBq06 INdjNJaXYkawlrjSWqMPZ/64PRKi7JiCV4KkL2S36FBCfyNKIlD7NL79l gecrme6JgUguCnlZhECyROJl55JDd8FXRO07DngaD9EcxYGgH//QQzm8h SxMY2RokTR7oSyVog7pQgRclAhF4+o/KQbCBjTjk+hPSlzJ8Rgiaebmlf g==; X-CSE-ConnectionGUID: RAfs5nbATfyAAKL57gzD+Q== X-CSE-MsgGUID: o8EzmEoiSLWnIIK0D9O4rw== X-IPAS-Result: A0BcAgAKs9Fq/5H/Ja1aglmCV3VgQ0mUKYIhA4ETgWuIZ5I3gX4PAQEBD0QNBAEBhQUCjhUCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJyQBPRwDAQIvKxkKCBmDAgGCOgM3AxG8Lhs3gXkzgQGDKQE/AkNQ2UqBaAELFAGBOIVAiCNdGAGCAoJ6JxuBSUSBFYE7gTh2gQWBGkIBAQOBNYZtBIMcEoFaGAZllERIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoJlAXoKCQETFwEXgT0ZHpAFCYMkHQqQHIIhgTWeaXGEKIwij0SFdhozhASBV5JAklQLmH2OCoQJkSplN4RpgWg8gUcLBzMaCBsVO4JnCUoZD44rAgELC4NggX9ly3YnMgIJMgEBBwIHDgMLgWiQAQEmB4FPAQE IronPort-Data: A9a23:AruhCK5ELXWkAQmCXMbT3gxRtG7GchMFZxGqfqrLsTDasY5as4F+v mYbCmmDOffcMTH3eYoiaY+z9U9X6JOGn9FmGgVq/ik3Zn8b8sCt6fZ1gavT04J+CuWZESqLO u1HMoGowPgcFyGa+1H1dOex9RGQ7InQLpLkEunIJyttcgFtTSYlmHpLlvUw6mJSqYDR7zil5 5Wo/KUzBHf/g2QqazpNtfrawP9SlK2aVA0w7wRWic9j5Dcyp1FNZLoDKKe4KWfPQ4U8NoaSW +bZwbilyXjS9hErB8nNuu6TnpoiG+O60aCm0xK6aoD66vRwjnVaPpUTaJLwXXxqZwChxLid/ jniWauYEm/FNoWU8AgUvoIx/ytWZcWq85efSZSzXFD6I0DuKxPRL/tS4E4eB6QW4btxC0hy+ +0xARMpM0+Mlc71+efuIgVsrpxLwMjDJogTvDRkiDreF/tjGcCFSKTR7tge1zA17ixMNa+BP IxCNnw1MUmGOkESUrsUIMpWcOOAl2TlejFVgFmUvqEwpWPUyWSd1ZCwaoqNJ4bWFJ89ckCwo TLr7WHUBRAhEOOZ6Bumql79obPVgnauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8hkOgVtZ3L 00P5jFoqrA/8kGuRNTxUxC05nmesXYht8F4CeY27kSJj6HT+QvcXjhCRT9aY9tgv8gzLdA36 mK0cxrSLWQHmNWopbi1q994cRva1fApEFI/ IronPort-HdrOrdr: A9a23:wNVo56BH8MGDSJLlHemA55DYdb4zR+YMi2TDsHoBLSC9Hfb3qy nDppkmPFrP+VUssRIb6LW90de7IE80nKQdieJ6AV7hZniFhILCFu5fBOXZrwEIYxefysdtkY F9bqN5FNr8SXJ+jcr8/U2ENuxI+qjhzEht7t2utkuEimpRGsdd0zs= X-Talos-CUID: 9a23:Hr0dcGzh/DCVesVyrESFBgUuM84+L3vX5UveMmaRKkI0F7KHZRyprfY= X-Talos-MUID: 9a23:7H+G2w/ym/FH4d0UtnuLNOWQf8A4zrarJUcMqrE5veilFnRcahDBliviFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="528052492" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:21:11 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id 16A3018000596 for ; Fri, 16 Oct 2026 05:21:11 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id AE218CBF202; Thu, 15 Oct 2026 22:21:10 -0700 (PDT) From: Yogita Urade To: openembedded-devel@lists.openembedded.org Subject: [oe][meta-oe][wrynose][PATCH 3/4] redis: fix CVE-2026-25243 Date: Thu, 15 Oct 2026 22:21:09 -0700 Message-Id: <20261016052110.184934-3-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016052110.184934-1-yurade@cisco.com> References: <20261016052110.184934-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:21:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131050 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/redis/redis/commit/b9dde6fc25dec6191b18374335a076a7b31e3d02 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-25243 Signed-off-by: Yogita Urade --- .../redis/redis-8.0.6/CVE-2026-25243.patch | 275 ++++++++++++++++++ meta-oe/recipes-extended/redis/redis_8.0.6.bb | 1 + 2 files changed, 276 insertions(+) create mode 100644 meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-25243.patch diff --git a/meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-25243.patch b/meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-25243.patch new file mode 100644 index 0000000000..64349b14b3 --- /dev/null +++ b/meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-25243.patch @@ -0,0 +1,275 @@ +From b9dde6fc25dec6191b18374335a076a7b31e3d02 Mon Sep 17 00:00:00 2001 +From: Sergei Georgiev +Date: Thu, 27 Nov 2025 11:41:11 +0200 +Subject: [PATCH] Invalid Memory Access in Redis RESTORE Command + (CVE-2026-25243) + +CVE: CVE-2026-25243 +Upstream-Status: Backport [https://github.com/redis/redis/commit/b9dde6fc25dec6191b18374335a076a7b31e3d02] + +Backport Changes: +- In src/rdb.c, the duplicate consumer PEL error path removes + streamFreeNACK(nack), using the 8.0.6 function signature; upstream removes + streamFreeNACK(s, nack). + +(cherry picked from commit b9dde6fc25dec6191b18374335a076a7b31e3d02) +Signed-off-by: Yogita Urade +--- + modules/vector-sets/vset.c | 46 +++++++++++++++-- + src/rdb.c | 6 +-- + src/sds.c | 9 +++- + src/zipmap.c | 7 +++ + tests/integration/corrupt-dump.tcl | 83 ++++++++++++++++++++++++++++++ + tests/unit/dump.tcl | 13 +++++ + 6 files changed, 155 insertions(+), 9 deletions(-) + +diff --git a/modules/vector-sets/vset.c b/modules/vector-sets/vset.c +index 75de69256..ec8e4f0a4 100644 +--- a/modules/vector-sets/vset.c ++++ b/modules/vector-sets/vset.c +@@ -1797,14 +1797,50 @@ void *VectorSetRdbLoad(RedisModuleIO *rdb, int encver) { + uint32_t input_dim = RedisModule_LoadUnsigned(rdb); + if (RedisModule_IsIOError(rdb)) goto ioerr; + uint32_t output_dim = dim; +- size_t matrix_size = sizeof(float) * input_dim * output_dim; + +- vset->proj_matrix = RedisModule_Alloc(matrix_size); +- vset->proj_input_size = input_dim; ++ /* Sanity check dimensions to avoid absurd / degenerate matrices. */ ++ if (input_dim == 0 || output_dim == 0) { ++ RedisModule_LogIOError(rdb, "warning", ++ "Invalid projection matrix dimensions: input_dim=%u, output_dim=%u", ++ (unsigned)input_dim, (unsigned)output_dim); ++ goto ioerr; ++ } + +- // Load projection matrix as a binary blob +- char *matrix_blob = RedisModule_LoadStringBuffer(rdb, NULL); ++ /* Check for overflow in matrix_size = sizeof(float) * input_dim * output_dim. */ ++ #if SIZE_MAX == UINT32_MAX ++ if ((size_t)output_dim > SIZE_MAX / sizeof(float)) { ++ RedisModule_LogIOError(rdb, "warning", ++ "Projection matrix size overflow (output_dim too large): input_dim=%u, output_dim=%u", ++ (unsigned)input_dim, (unsigned)output_dim); ++ goto ioerr; ++ } ++ #endif ++ ++ size_t max_input = SIZE_MAX / (sizeof(float) * (size_t)output_dim); ++ if ((size_t)input_dim > max_input) { ++ RedisModule_LogIOError(rdb, "warning", ++ "Projection matrix size overflow: input_dim=%u, output_dim=%u", ++ (unsigned)input_dim, (unsigned)output_dim); ++ goto ioerr; ++ } ++ ++ size_t matrix_size = sizeof(float) * (size_t)input_dim * (size_t)output_dim; ++ ++ /* Load projection matrix as a binary blob and validate length. */ ++ size_t blob_len = 0; ++ char *matrix_blob = RedisModule_LoadStringBuffer(rdb, &blob_len); + if (matrix_blob == NULL) goto ioerr; ++ ++ if (blob_len != matrix_size) { ++ RedisModule_LogIOError(rdb, "warning", ++ "Mismatching projection matrix length: expected=%zu, got=%zu", ++ matrix_size, blob_len); ++ RedisModule_Free(matrix_blob); ++ goto ioerr; ++ } ++ ++ vset->proj_matrix = RedisModule_Alloc(matrix_size); ++ vset->proj_input_size = input_dim; + memcpy(vset->proj_matrix, matrix_blob, matrix_size); + RedisModule_Free(matrix_blob); + } +diff --git a/src/rdb.c b/src/rdb.c +index c09cd14bc..371353c2c 100644 +--- a/src/rdb.c ++++ b/src/rdb.c +@@ -2573,11 +2573,12 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key, int dbid, int *error) + + /* search for duplicate records */ + sds field = sdstrynewlen(fstr, flen); +- if (!field || dictAdd(dupSearchDict, field, NULL) != DICT_OK || +- !lpSafeToAdd(lp, (size_t)flen + vlen)) { ++ if (!field || !lpSafeToAdd(lp, (size_t)flen + vlen) || ++ dictAdd(dupSearchDict, field, NULL) != DICT_OK) { + rdbReportCorruptRDB("Hash zipmap with dup elements, or big length (%u)", flen); + dictRelease(dupSearchDict); + sdsfree(field); ++ lpFree(lp); + zfree(encoded); + o->ptr = NULL; + decrRefCount(o); +@@ -3068,7 +3069,6 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key, int dbid, int *error) + " loading a stream consumer " + "group"); + decrRefCount(o); +- streamFreeNACK(nack); + return NULL; + } + } +diff --git a/src/sds.c b/src/sds.c +index 7f1429c46..edd0495aa 100644 +--- a/src/sds.c ++++ b/src/sds.c +@@ -90,7 +90,14 @@ sds _sdsnewlen(const void *init, size_t initlen, int trymalloc) { + unsigned char *fp; /* flags pointer. */ + size_t usable; + +- assert(initlen + hdrlen + 1 > initlen); /* Catch size_t overflow */ ++ if (trymalloc) { ++ /* protect against size_t overflow */ ++ if (initlen + hdrlen + 1 <= initlen) ++ return NULL; ++ } else { ++ assert(initlen + hdrlen + 1 > initlen); /* Catch size_t overflow */ ++ } ++ + sh = trymalloc? + s_trymalloc_usable(hdrlen+initlen+1, &usable) : + s_malloc_usable(hdrlen+initlen+1, &usable); +diff --git a/src/zipmap.c b/src/zipmap.c +index 51c64ca81..e3981d810 100644 +--- a/src/zipmap.c ++++ b/src/zipmap.c +@@ -387,6 +387,10 @@ int zipmapValidateIntegrity(unsigned char *zm, size_t size, int deep) { + + /* read the field name length */ + l = zipmapDecodeLength(p); ++ /* Sanity check: length < 254 must be encoded in 1 byte, not 5 bytes */ ++ if (l < ZIPMAP_BIGLEN && s != 1) ++ return 0; ++ + p += s; /* skip the encoded field size */ + p += l; /* skip the field */ + +@@ -402,6 +406,9 @@ int zipmapValidateIntegrity(unsigned char *zm, size_t size, int deep) { + + /* read the value length */ + l = zipmapDecodeLength(p); ++ /* Sanity check: length < 254 must be encoded in 1 byte, not 5 bytes */ ++ if (l < ZIPMAP_BIGLEN && s != 1) ++ return 0; + p += s; /* skip the encoded value size*/ + e = *p++; /* skip the encoded free space (always encoded in one byte) */ + p += l+e; /* skip the value and free space */ +diff --git a/tests/integration/corrupt-dump.tcl b/tests/integration/corrupt-dump.tcl +index ee044c71a..6017723e0 100644 +--- a/tests/integration/corrupt-dump.tcl ++++ b/tests/integration/corrupt-dump.tcl +@@ -941,6 +941,89 @@ test {corrupt payload: fuzzer findings - vector sets with wrong encoding} { + } + } + ++test {corrupt payload: zipmap - element wouldn't fit in listpack} { ++ # Redis converts legacy zipmap encoded hashes to listpacks. ++ # This test creates a zipmap entry with a 1GB value which cannot ++ # fit into a listpack and verifies that RESTORE fails. ++ ++ start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no proto-max-bulk-len 2147483648 client-query-buffer-limit 2147483648]] { ++ proc zipmap_encode_len {len} { ++ if {$len < 254} { ++ return [binary format c $len] ++ } else { ++ return [binary format ci 254 $len] ++ } ++ } ++ r config set sanitize-dump-payload no ++ ++ # Generates Zipmap with 1GB value - should fail lpSafeToAdd check ++ set val_len [expr {1024 * 1024 * 1024 + 1}] ++ ++ # Zipmap has 1 element ++ set zm [binary format c 1] ++ # Field is 1 byte long ++ append zm [zipmap_encode_len 1] ++ append zm "k" ++ # Value is 1GB long ++ append zm [zipmap_encode_len $val_len] ++ append zm [binary format c 0] ++ append zm [string repeat "A" $val_len] ++ # ZIPMAP_END marker ++ append zm [binary format c 255] ++ # Prepend RDB header ++ set zm_len [string length $zm] ++ set rdb_len [binary format cI 0x80 $zm_len] ++ set dump [binary format c 9] ++ append dump $rdb_len ++ append dump $zm ++ append dump [binary format s 9] ++ append dump [binary format w 0] ++ ++ catch {r RESTORE _hash 0 $dump} err ++ assert_match "*Bad data format*" $err ++ } ++} {} {large-memory} ++ ++test {corrupt payload: zipmap - 5 bytes length encoding for a small field} { ++ start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no]] { ++ catch { ++ r restore key 0 "\x09\x11\x01\xfe\x04\x00\x00\x00\x01\x00\xff\x00\x04\x00\x76\x61\x6c\x31\xff\x09\x00\xf9\xd5\xa4\xf7\x7d\x00\x3f\x1b" ++ } err ++ assert_match "*Bad data format*" $err ++ verify_log_message 0 "*integrity check failed*" 0 ++ } ++} ++ ++test {corrupt payload: zipmap - 5 bytes length encoding for a small value} { ++ start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no]] { ++ catch { ++ r restore key 0 "\x09\x0e\x01\x01\x6b\xfe\x04\x00\x00\x00\x00\x76\x61\x6c\x31\xff\x09\x00\xd0\xf9\xe4\x1d\xe4\xfb\x11\x4c" ++ } err ++ assert_match "*Bad data format*" $err ++ verify_log_message 0 "*integrity check failed*" 0 ++ } ++} ++ ++test {corrupt payload: zipmap - 5 bytes length encoding and a huge field} { ++ start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] { ++ catch { ++ r restore key 0 "\x09\x41\x15\x02\x04\x6b\x65\x79\x31\x04\x00\x76\x61\x6c\x31\xfe\x04\x00\x00\x00\xfe\xff\xff\xff\xfd\x00\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\xff\x09\x00\x54\x2f\x0a\xca\x4e\x5c\x49\x9f" ++ } err ++ assert_match "*Bad data format*" $err ++ verify_log_message 0 "*integrity check failed*" 0 ++ } ++} ++ ++test {corrupt payload: stream - duplicated consumer PEL entry} { ++ start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] { ++ catch { ++ r restore key 0 "\x15\x01\x10\x00\x00\x01\x9b\x0d\x56\xa9\xb7\x00\x00\x00\x00\x00\x00\x00\x00\xc3\x39\x40\x42\x15\x42\x00\x00\x00\x11\x00\x02\x01\x00\x01\x01\x01\x86\x66\x69\x65\x6c\x64\x31\x07\x00\x01\x40\x0f\x0a\x00\x01\x86\x76\x61\x6c\x75\x65\x31\x07\x04\x20\x0b\x02\xcd\xd9\x02\xe0\x01\x22\x01\x32\x07\x80\x1a\x04\x32\x07\x06\x01\xff\x02\x81\x00\x00\x01\x9b\x0d\x56\xb7\x90\x00\x81\x00\x00\x01\x9b\x0d\x56\xa9\xb7\x00\x00\x00\x02\x01\x07\x6d\x79\x67\x72\x6f\x75\x70\x81\x00\x00\x01\x9b\x0d\x56\xb7\x90\x00\x02\x02\x00\x00\x01\x9b\x0d\x56\xa9\xb7\x00\x00\x00\x00\x00\x00\x00\x00\x80\xd9\x56\x0d\x9b\x01\x00\x00\x01\x00\x00\x01\x9b\x0d\x56\xb7\x90\x00\x00\x00\x00\x00\x00\x00\x00\x80\xd9\x56\x0d\x9b\x01\x00\x00\x01\x01\x09\x63\x6f\x6e\x73\x75\x6d\x65\x72\x31\x80\xd9\x56\x0d\x9b\x01\x00\x00\x80\xd9\x56\x0d\x9b\x01\x00\x00\x02\x00\x00\x01\x9b\x0d\x56\xa9\xb7\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x9b\x0d\x56\xa9\xb7\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x4b\xe0\x99\x30\x67\x4d\xe5\x87" ++ } err ++ assert_match "*Bad data format*" $err ++ verify_log_message 0 "*Duplicated consumer PEL entry*" 0 ++ } ++} ++ + + } ;# tags + +diff --git a/tests/unit/dump.tcl b/tests/unit/dump.tcl +index 0cd62804a..1ce9bc846 100644 +--- a/tests/unit/dump.tcl ++++ b/tests/unit/dump.tcl +@@ -140,6 +140,19 @@ start_server {tags {"dump"}} { + close_replication_stream $repl + } {} {needs:repl} + ++ test {RESTORE fail with invalid payload size} { ++ # Payload with mismatched size: claims 0xFFFFFFFFFFFFFFF7 bytes (max uint64 - 8) but provides no data ++ # \x00 = String type ++ # \x81 = 64-bit length marker ++ # \xFF\xFF\xFF\xFF\xFF\xFF\xFF\xF7 = 18446744073709551607 in big-endian ++ # \x0c\x00 = RDB version ++ # \x00... = fake CRC64 ++ set encoded "\x00\x81\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xF7\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00" ++ r del test ++ catch {r restore test 0 $encoded} e ++ set e ++ } {*Bad data format*} ++ + test {DUMP of non existing key returns nil} { + r dump nonexisting_key + } {} diff --git a/meta-oe/recipes-extended/redis/redis_8.0.6.bb b/meta-oe/recipes-extended/redis/redis_8.0.6.bb index a83ffbae48..5d4ca143d1 100644 --- a/meta-oe/recipes-extended/redis/redis_8.0.6.bb +++ b/meta-oe/recipes-extended/redis/redis_8.0.6.bb @@ -18,6 +18,7 @@ SRC_URI = "http://download.redis.io/releases/${BP}.tar.gz \ file://CVE-2026-81934.patch \ file://CVE-2026-23479.patch \ file://CVE-2026-23631.patch \ + file://CVE-2026-25243.patch \ " SRC_URI[sha256sum] = "6d0a9913887a4972536f9da226f1575859c34d86354129163260a5f9c6bd4229" From patchwork Fri Oct 16 05:21:10 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 100970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F13BCCA464 for ; Fri, 16 Oct 2026 05:21:16 +0000 (UTC) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15356.1792128072186642700 for ; Thu, 15 Oct 2026 22:21:12 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=KoPrwzfh; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=7394; q=dns/txt; s=iport01; t=1792128072; x=1793337672; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=WczO7E4AckD7Ub0lMaGc8zMNDaDw54OIZMO2aejoYVs=; b=KoPrwzfhK9lYGucAICLKa2e5ieFZY0m56SoprIM6d5rTtqi7meSByQux 0iU+T8J+GTcl4N3pXqgO+SnUIcjQhoYsY+oFCW/N4zceH8DyUlVB2l2tL o4hibENvCwbmYxjzJfGaUXBxsvHDGa32QoLeyc5udpWCGV1Ff+MsNIBSR eWijrVRZknLOYoMCO/1vgi1xbkvxKt+MB90BF0Li8bU5AIm/NSdwoyuG9 7pmLFDWgJZMOjPbjdfjTMWh+z/QulR9eZMgDMmXJg7vwtYOJ45z6XPol9 SonfFJPJLExw8Gy7H3mbD6qBE+QW92kjwIHQLky51f3D7Ph4WdFLKTovl w==; X-CSE-ConnectionGUID: KyRW4Cc/RuS4JBP0FOZnRQ== X-CSE-MsgGUID: KHaaD91pQ4GQK1vpx2BILg== X-IPAS-Result: A0BeAgAKs9Fq/5D/Ja1aglmCV3VgQ0mEV49SgiEDgn6IZ5I3gX4PAQEBD0QNBAEBhQUCjhUCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDIwQkAT0cAwECAwImAgIrGQoIGYMCAYI6AzcDEbwuGzd6fzOBAYMpAT8CQ1DZSoFoAQsUAYEKLoVAgx8BhQNdGAGCAoJ6JxuBSUSBFYNpgQWBGkIBAQOBJCGDc4JqBIINgQ8SgVoYBmWEC5A5SIECHANZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPhcvWBsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPQFuB5IUHoJlAXoTARMXAYEuXTCPVQmWCKAecYQojCKPRIV2GjOFW6UUC5h9jgqECZJGhGmBaDyBRwsHMxoIGxU7gmcJShkPji4LC4NggX9ly3YnMgIJMgEBBwIHDgMLgWiQAAImB4FPAQE IronPort-Data: A9a23:HSomvq0jrhBRb26x7fbD5YVwkn2cJEfYwER7XKvMYLTBsI5bp2AEy WNNXzqBO/beMGT8Ldx/btm/ox4G78KAmNZmTQRo3Hw8FHgiRegpqji6wuYcGwvIc6UvmWo+t 512huHodZ5yEzmE4Ej9atANlFEkvYmQXL3wFeXYDS54QA5gWU8JhAlq8wIDqtYAbeORXUXX5 rsen+WFYAX7gmYtbDpNg06+gEoHUMra6WtwUmMWPZinjHeG/1EJAZQWI72GLneQauF8Au6gS u/f+6qy92Xf8g1FIovNfmHTKxBirhb6ZGBiu1IOM0SQqkEqSh8ajs7XAMEhhXJ/0F1lqTzeJ OJl7vRcQS9xVkHFdX90vxNwS0mSNoUekFPLzOTWXcG7lyX7n3XQL/pGL1AMAtEz8aFNHFoS1 9YgcB4qXBa5vrfjqF67YrEEasULNsLnOsYb/3pn1zycValgSpHYSKKM7thdtNsyrpkRRrCFO IxDNGcpNUicC/FMEg9/5JYWjfqyj3XyWzZZs1mS46Ew5gA/ySQsi+a1aYuKJIXiqcN9vWaRr 06XpnzAXj4jF4WB0Srf2FOIibqa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+rfSnh0qWX9NEN 1dS/TIjq6U3/kGnQtTxGRqirxa5UgU0QdFcFag+rQqK0KeRu1nfDWkfRTkHY9sj3CMreQEXO payt4uBLVRSXHe9EBpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:kOqMwaF8MJ28Q0ibpLqEyseALOsnbusQ8zAXPidKOHtom62j5q STdZsguyMc5Ax9ZJhko6HiBEDiewK4yXcK2+gs1N6ZNWGM0ldAbrsSj7cKqAeOJ8SRzIJgPN 9bE5RWOZnXEUVwi9r87U2TFtYtx8TCzYWT7N2uqUuEiWpRGtldB8ATMHfjLnFL X-Talos-CUID: 9a23:WOAdBWyKFRJo9Q2aXv7IBgU3C/oaLlbWi03NGBOaI14xZpqnT2WprfY= X-Talos-MUID: 9a23:YBMRhg24n8n/YhKWDSQxhkjkaTUjwISnAWxcyI0/5+a9FnVuIyfHphWTTdpy X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536019761" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 05:21:11 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 19AFE18000231 for ; Fri, 16 Oct 2026 05:21:11 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id B3467CBF203; Thu, 15 Oct 2026 22:21:10 -0700 (PDT) From: Yogita Urade To: openembedded-devel@lists.openembedded.org Subject: [oe][meta-oe][wrynose][PATCH 4/4] redis: fix CVE-2026-66373 Date: Thu, 15 Oct 2026 22:21:10 -0700 Message-Id: <20261016052110.184934-4-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016052110.184934-1-yurade@cisco.com> References: <20261016052110.184934-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 05:21:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131048 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/redis/redis/commit/4f62a8bf15c634187d8a87d874f8988032f90b6c [2] https://nvd.nist.gov/vuln/detail/CVE-2026-66373 Signed-off-by: Yogita Urade --- .../redis/redis-8.0.6/CVE-2026-66373.patch | 96 +++++++++++++++++++ meta-oe/recipes-extended/redis/redis_8.0.6.bb | 1 + 2 files changed, 97 insertions(+) create mode 100644 meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-66373.patch diff --git a/meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-66373.patch b/meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-66373.patch new file mode 100644 index 0000000000..3350ad2a70 --- /dev/null +++ b/meta-oe/recipes-extended/redis/redis-8.0.6/CVE-2026-66373.patch @@ -0,0 +1,96 @@ +From 4f62a8bf15c634187d8a87d874f8988032f90b6c Mon Sep 17 00:00:00 2001 +From: sggeorgiev +Date: Thu, 23 Apr 2026 15:46:48 +0300 +Subject: [PATCH] Reject corrupt stream RDB with shared NACK across consumers + (#15081) + +**Summary** + +Detects and rejects corrupt stream RDB payloads where the same NACK +(pending entry) is referenced by more than one consumer, which violates +a stream data-structure. + +**Changes** + +- **`rdbLoadObject` (stream consumer PEL loading)**: Added a guard that +checks `nack->consumer != NULL` before assigning the consumer pointer. +When a second consumer's PEL references a NACK that was already claimed +by a prior consumer, the loader now reports a corrupt RDB error and +aborts instead of silently overwriting the pointer. Without this check, +two consumers share the same `streamNACK`, and freeing the first +consumer's PEL leaves the second with a dangling pointer. +- **`corrupt-dump.tcl`**: Added a regression test that crafts a stream +with two consumers (`consumerA`, `consumerB`) whose PELs both reference +the same entry (`1-0`). The `RESTORE` command is expected to fail with +`"Bad data format"`, and the server must remain responsive (`PING` +succeeds). + +**Benefits** + +- **Fail-fast on corrupt data**: The invariant violation is caught at +load time with a clear diagnostic message rather than manifesting as a +crash later during normal operation. +- **Regression coverage**: The crafted payload in the test ensures this +class of corruption is permanently guarded against. + +CVE: CVE-2026-66373 +Upstream-Status: Backport [https://github.com/redis/redis/commit/4f62a8bf15c634187d8a87d874f8988032f90b6c] + +(cherry picked from commit 4f62a8bf15c634187d8a87d874f8988032f90b6c) +Signed-off-by: Yogita Urade +--- + src/rdb.c | 8 ++++++++ + tests/integration/corrupt-dump.tcl | 18 +++++++++++++++++- + 2 files changed, 25 insertions(+), 1 deletion(-) + +diff --git a/src/rdb.c b/src/rdb.c +index 371353c2c..277ca543c 100644 +--- a/src/rdb.c ++++ b/src/rdb.c +@@ -3060,6 +3060,14 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key, int dbid, int *error) + } + streamNACK *nack = result; + ++ /* If the NACK already has a consumer assigned, the ++ * payload is corrupt — each global PEL entry must be ++ * claimed by exactly one consumer. */ ++ if (nack->consumer != NULL) { ++ rdbReportCorruptRDB("Stream consumer PEL entry already has a consumer assigned"); ++ decrRefCount(o); ++ return NULL; ++ } + /* Set the NACK consumer, that was left to NULL when + * loading the global PEL. Then set the same shared + * NACK structure also in the consumer-specific PEL. */ +diff --git a/tests/integration/corrupt-dump.tcl b/tests/integration/corrupt-dump.tcl +index 6017723e0..b04812e0f 100644 +--- a/tests/integration/corrupt-dump.tcl ++++ b/tests/integration/corrupt-dump.tcl +@@ -1020,10 +1020,26 @@ test {corrupt payload: stream - duplicated consumer PEL entry} { + r restore key 0 "\x15\x01\x10\x00\x00\x01\x9b\x0d\x56\xa9\xb7\x00\x00\x00\x00\x00\x00\x00\x00\xc3\x39\x40\x42\x15\x42\x00\x00\x00\x11\x00\x02\x01\x00\x01\x01\x01\x86\x66\x69\x65\x6c\x64\x31\x07\x00\x01\x40\x0f\x0a\x00\x01\x86\x76\x61\x6c\x75\x65\x31\x07\x04\x20\x0b\x02\xcd\xd9\x02\xe0\x01\x22\x01\x32\x07\x80\x1a\x04\x32\x07\x06\x01\xff\x02\x81\x00\x00\x01\x9b\x0d\x56\xb7\x90\x00\x81\x00\x00\x01\x9b\x0d\x56\xa9\xb7\x00\x00\x00\x02\x01\x07\x6d\x79\x67\x72\x6f\x75\x70\x81\x00\x00\x01\x9b\x0d\x56\xb7\x90\x00\x02\x02\x00\x00\x01\x9b\x0d\x56\xa9\xb7\x00\x00\x00\x00\x00\x00\x00\x00\x80\xd9\x56\x0d\x9b\x01\x00\x00\x01\x00\x00\x01\x9b\x0d\x56\xb7\x90\x00\x00\x00\x00\x00\x00\x00\x00\x80\xd9\x56\x0d\x9b\x01\x00\x00\x01\x01\x09\x63\x6f\x6e\x73\x75\x6d\x65\x72\x31\x80\xd9\x56\x0d\x9b\x01\x00\x00\x80\xd9\x56\x0d\x9b\x01\x00\x00\x02\x00\x00\x01\x9b\x0d\x56\xa9\xb7\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x9b\x0d\x56\xa9\xb7\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x4b\xe0\x99\x30\x67\x4d\xe5\x87" + } err + assert_match "*Bad data format*" $err +- verify_log_message 0 "*Duplicated consumer PEL entry*" 0 ++ verify_log_message 0 "*Stream consumer PEL entry already has a consumer assigned*" 0 + } + } + + ++test {corrupt payload: stream with NACK shared between two consumers} { ++ start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no]] { ++ r debug set-skip-checksum-validation 1 ++ # Payload: stream with entry 1-0, one consumer group (mygroup), ++ # two consumers whose PELs both reference 1-0 (shared NACK). ++ # XACK on one consumer frees the NACK, leaving a dangling ++ # pointer in the other consumer's PEL (use-after-free). ++ catch {r RESTORE mystream 0 "\x1a\x01\x10\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x1d\x1d\x00\x00\x00\x0a\x00\x01\x01\x00\x01\x01\x01\x81\x6b\x02\x00\x01\x02\x01\x00\x01\x00\x01\x81\x76\x02\x04\x01\xff\x01\x01\x00\x01\x00\x00\x00\x01\x01\x07\x6d\x79\x67\x72\x6f\x75\x70\x01\x00\x01\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x01\x64\x42\xb9\x9d\x01\x00\x00\x01\x02\x09\x63\x6f\x6e\x73\x75\x6d\x65\x72\x41\x01\x64\x42\xb9\x9d\x01\x00\x00\x01\x64\x42\xb9\x9d\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x09\x63\x6f\x6e\x73\x75\x6d\x65\x72\x42\x01\x64\x42\xb9\x9d\x01\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x40\x64\x40\x64\x00\x00\x00\x0d\x00\xe7\x12\xf7\xcc\x25\xd5\x0e\x44"} err ++ catch {r XACK mystream mygroup 1-0} _ ++ catch {r XREADGROUP GROUP mygroup consumerA COUNT 10 STREAMS mystream 0} _ ++ catch {r DEL mystream} _ ++ assert_match "*Bad data format*" $err ++ r ping ++ } ++} ++ + } ;# tags + diff --git a/meta-oe/recipes-extended/redis/redis_8.0.6.bb b/meta-oe/recipes-extended/redis/redis_8.0.6.bb index 5d4ca143d1..04641a9dab 100644 --- a/meta-oe/recipes-extended/redis/redis_8.0.6.bb +++ b/meta-oe/recipes-extended/redis/redis_8.0.6.bb @@ -19,6 +19,7 @@ SRC_URI = "http://download.redis.io/releases/${BP}.tar.gz \ file://CVE-2026-23479.patch \ file://CVE-2026-23631.patch \ file://CVE-2026-25243.patch \ + file://CVE-2026-66373.patch \ " SRC_URI[sha256sum] = "6d0a9913887a4972536f9da226f1575859c34d86354129163260a5f9c6bd4229"