Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package corosync for openSUSE:Factory checked in at 2026-09-08 16:52:26 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/corosync (Old) and /work/SRC/openSUSE:Factory/.corosync.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "corosync" Tue Sep 8 16:52:26 2026 rev:86 rq:1376050 version:3.1.10 Changes: -------- --- /work/SRC/openSUSE:Factory/corosync/corosync.changes 2026-04-04 19:06:55.599917813 +0200 +++ /work/SRC/openSUSE:Factory/.corosync.new.1265/corosync.changes 2026-09-08 16:52:51.825809985 +0200 @@ -1,0 +2,8 @@ +Mon Sep 7 02:43:52 UTC 2026 - Nicholas Yang <[email protected]> + +- Add a patch to fix CVE-2026-81665 (bsc#1278738) + * 0002-totempg-Replace-assert-with-check-in-deliver_fn.patch +- Add a patch to fix CVE-2026-81666 (bsc#1278739) + * 0001-totemsrp-Fix-int-overflow-in-commit_token_sanity.patch + +------------------------------------------------------------------- New: ---- 0001-totemsrp-Fix-int-overflow-in-commit_token_sanity.patch 0002-totempg-Replace-assert-with-check-in-deliver_fn.patch ----------(New B)---------- New:- Add a patch to fix CVE-2026-81666 (bsc#1278739) * 0001-totemsrp-Fix-int-overflow-in-commit_token_sanity.patch New:- Add a patch to fix CVE-2026-81665 (bsc#1278738) * 0002-totempg-Replace-assert-with-check-in-deliver_fn.patch - Add a patch to fix CVE-2026-81666 (bsc#1278739) ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ corosync.spec ++++++ --- /var/tmp/diff_new_pack.kErmfB/_old 2026-09-08 16:52:52.897854915 +0200 +++ /var/tmp/diff_new_pack.kErmfB/_new 2026-09-08 16:52:52.898854957 +0200 @@ -41,6 +41,8 @@ Source1: %{name}.tmpfiles.d.conf Patch0: 0001-harden-services-with-systemd-sandboxing.patch Patch1: 820.patch +Patch2: 0001-totemsrp-Fix-int-overflow-in-commit_token_sanity.patch +Patch3: 0002-totempg-Replace-assert-with-check-in-deliver_fn.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build ++++++ 0001-totemsrp-Fix-int-overflow-in-commit_token_sanity.patch ++++++ >From 83920f2e36b5f1acd7dcf033c0820043cc29f82a Mon Sep 17 00:00:00 2001 From: Jan Friesse <[email protected]> Date: Wed, 2 Sep 2026 15:08:31 +0200 Subject: [PATCH 1/2] totemsrp: Fix int overflow in commit_token_sanity This commit addresses an integer overflow (wraparound) vulnerability in the check_memb_commit_token_sanity function. Previously, on 32-bit systems, a large unsigned network value for addr_entries (>= 153391690) could cause an integer overflow when multiplied by the sizes of the srp_addr and memb_commit_token_memb_entry structures. This wraparound resulted in a required_len that was smaller than the actual required memory size, potentially bypassing the subsequent message length bounds check. To fix this, we now reject the message if addr_entries exceeds PROCESSOR_COUNT_MAX before any multiplication or addition occurs. Fixes: CVE-2026-81666 Reported-by: Tristan Madani <[email protected]> Signed-off-by: Jan Friesse <[email protected]> Reviewed-by: Tristan Madani <[email protected]> Reviewed-by: Fabio M. Di Nitto <[email protected]> --- exec/totemsrp.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/exec/totemsrp.c b/exec/totemsrp.c index 67596911..1802bb34 100644 --- a/exec/totemsrp.c +++ b/exec/totemsrp.c @@ -3829,6 +3829,14 @@ static int check_memb_commit_token_sanity( addr_entries = swab32(addr_entries); } + if (addr_entries > PROCESSOR_COUNT_MAX) { + log_printf (instance->totemsrp_log_level_security, + "Received commit_token message addr_entries exceeds the maximum " + "allowed value... ignoring."); + + return (-1); + } + required_len = sizeof(struct memb_commit_token) + (addr_entries * (sizeof(struct srp_addr) + sizeof(struct memb_commit_token_memb_entry))); if (msg_len < required_len) { -- 2.55.0 ++++++ 0002-totempg-Replace-assert-with-check-in-deliver_fn.patch ++++++ >From 5148bf07dffa61bcfa92ca2c058e7d0f0a981cf3 Mon Sep 17 00:00:00 2001 From: Jan Friesse <[email protected]> Date: Wed, 2 Sep 2026 15:53:33 +0200 Subject: [PATCH 2/2] totempg: Replace assert with check in deliver_fn If assert() is compiled out in release builds, a new message could be appended past the end of the assembly buffer, resulting in a buffer overflow. To prevent this, replace the assertion with a standard runtime bounds check. If the incoming message exceeds the maximum buffer size, it is now safely logged and ignored. Fixes: CVE-2026-81665 Reported-by: Tristan Madani <[email protected]> Signed-off-by: Jan Friesse <[email protected]> Reviewed-by: Tristan Madani <[email protected]> Reviewed-by: Fabio M. Di Nitto <[email protected]> --- exec/totempg.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/exec/totempg.c b/exec/totempg.c index d9beb899..b086bad9 100644 --- a/exec/totempg.c +++ b/exec/totempg.c @@ -659,7 +659,14 @@ static void totempg_deliver_fn ( return ; } - assert((assembly->index+msg_len) < sizeof(assembly->data)); + if (assembly->index + msg_len >= sizeof(assembly->data)) { + log_printf(LOG_WARNING, + "Message (totempg_mcast) received from node " CS_PRI_NODE_ID + " would create too long message of %u bytes... Ignoring.", + nodeid, assembly->index + msg_len); + + return ; + } memcpy (&assembly->data[assembly->index], &data[datasize], msg_len - datasize); -- 2.55.0
