mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-12 06:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

glibc: fix CVE-2026-5435

Browse Source 
resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)

Specifically, CERT, TKEY, TSIG, OPT.  This removes the buggy
implementations of TSIG, fixing bug 34033, and partially
fixing bug 34069.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-5435
[2] https://sourceware.org/bugzilla/show_bug.cgi?id=34033
[3] https://sourceware.org/git/?p=glibc.git;a=commit;h=ca44a6609c29a683b03575fa035c6d17aa591e72

(From OE-Core rev: 336e429b4d0048964cf883c187438ca7c5aca2ea)

Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: This patch will change output of a debug and deprecated function.
     Upstream chose to remove the vulnerable implementation instead of
     fixing it.
     See: https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0011
]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Hemanth Kumar M D
2026-08-19 02:26:34 -07:00
committed by Richard Purdie
parent ca1fb3108c
commit 83b4945732
2 changed files with 138 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

137
meta/recipes-core/glibc/glibc/0024-CVE-2026-5435.patch Normal file
View File

@@ -0,0 +1,137 @@
From 5d41b8e5aaec3580e4a05d93c5ff2fc69bb3d5a7 Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Fri, 19 Jun 2026 18:22:20 +0200
Subject: [PATCH] resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)
Specifically, CERT, TKEY, TSIG, OPT. This removes the buggy
implementations of TSIG, fixing bug 34033, and partially
fixing bug 34069.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
CVE: CVE-2026-5435
Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=patch;h=ca44a6609c29a683b03575fa035c6d17aa591e72]
Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com>
---
resolv/ns_print.c | 96 -----------------------------------------------
1 file changed, 96 deletions(-)
diff --git a/resolv/ns_print.c b/resolv/ns_print.c
index cef2212fd2..882a86e58e 100644
--- a/resolv/ns_print.c
+++ b/resolv/ns_print.c
@@ -434,96 +434,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
break;
}
- case ns_t_cert: {
- u_int c_type, key_tag, alg;
- int n;
- unsigned int siz;
- char base64_cert[8192], tmp[40];
- const char *leader;
-
- c_type = ns_get16(rdata); rdata += NS_INT16SZ;
- key_tag = ns_get16(rdata); rdata += NS_INT16SZ;
- alg = (u_int) *rdata++;
-
- len = SPRINTF((tmp, "%d %d %d ", c_type, key_tag, alg));
- T(addstr(tmp, len, &buf, &buflen));
- siz = (edata-rdata)*4/3 + 4; /* "+4" accounts for trailing \0 */
- if (siz > sizeof(base64_cert) * 3/4) {
- const char *str = "record too long to print";
- T(addstr(str, strlen(str), &buf, &buflen));
- }
- else {
- len = b64_ntop(rdata, edata-rdata, base64_cert, siz);
-
- if (len < 0)
- goto formerr;
- else if (len > 15) {
- T(addstr(" (", 2, &buf, &buflen));
- leader = "\n\t\t";
- spaced = 0;
- }
- else
- leader = " ";
-
- for (n = 0; n < len; n += 48) {
- T(addstr(leader, strlen(leader),
- &buf, &buflen));
- T(addstr(base64_cert + n, MIN(len - n, 48),
- &buf, &buflen));
- }
- if (len > 15)
- T(addstr(" )", 2, &buf, &buflen));
- }
- break;
- }
-
- case ns_t_tkey: {
- /* KJD - need to complete this */
- u_long t;
- int mode, err, keysize;
-
- /* Algorithm name. */
- T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
- T(addstr(" ", 1, &buf, &buflen));
-
- /* Inception. */
- t = ns_get32(rdata); rdata += NS_INT32SZ;
- len = SPRINTF((tmp, "%lu ", t));
- T(addstr(tmp, len, &buf, &buflen));
-
- /* Expiration. */
- t = ns_get32(rdata); rdata += NS_INT32SZ;
- len = SPRINTF((tmp, "%lu ", t));
- T(addstr(tmp, len, &buf, &buflen));
-
- /* Mode , Error, Key Size. */
- /* Priority, Weight, Port. */
- mode = ns_get16(rdata); rdata += NS_INT16SZ;
- err = ns_get16(rdata); rdata += NS_INT16SZ;
- keysize = ns_get16(rdata); rdata += NS_INT16SZ;
- len = SPRINTF((tmp, "%u %u %u ", mode, err, keysize));
- T(addstr(tmp, len, &buf, &buflen));
-
- /* XXX need to dump key, print otherdata length & other data */
- break;
- }
-
- case ns_t_tsig: {
- /* BEW - need to complete this */
- int n;
-
- T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen));
- T(addstr(" ", 1, &buf, &buflen));
- rdata += 8; /*%< time */
- n = ns_get16(rdata); rdata += INT16SZ;
- rdata += n; /*%< sig */
- n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */
- sprintf(buf, "%d", ns_get16(rdata));
- rdata += INT16SZ;
- addlen(strlen(buf), &buf, &buflen);
- break;
- }
-
case ns_t_a6: {
struct in6_addr a;
int pbyte, pbit;
@@ -557,12 +467,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
break;
}
- case ns_t_opt: {
- len = SPRINTF((tmp, "%u bytes", class));
- T(addstr(tmp, len, &buf, &buflen));
- break;
- }
-
default:
snprintf (errbuf, sizeof (errbuf), "unknown RR type %d", type);
comment = errbuf;
--
2.49.0

1
meta/recipes-core/glibc/glibc_2.39.bb
View File

@@ -56,6 +56,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://0022-Avoid-hardcoded-build-time-paths-in-the-output-binar.patch \
file://0023-qemu-stale-process.patch \
file://0001-stdlib-Add-single-threaded-fast-path-to-rand.patch \
file://0024-CVE-2026-5435.patch \
"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build-${TARGET_SYS}"