Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package glibc for openSUSE:Factory checked in at 2026-10-07 19:31:33 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/glibc (Old) and /work/SRC/openSUSE:Factory/.glibc.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "glibc" Wed Oct 7 19:31:33 2026 rev:309 rq:1382471 version:2.44 Changes: -------- --- /work/SRC/openSUSE:Factory/glibc/glibc.changes 2026-09-15 12:48:14.563488410 +0200 +++ /work/SRC/openSUSE:Factory/.glibc.new.3698736/glibc.changes 2026-10-07 19:31:34.883075495 +0200 @@ -1,0 +2,12 @@ +Thu Oct 1 07:53:31 UTC 2026 - Andreas Schwab <[email protected]> + +- resolv-search-list-trunc.patch: resolv: Fix assertion failure on search + list truncation (CVE-2026-8674, bsc#1281297, BZ #31026) +- elf-origin-open-normalized.patch: elf: Open the normalized $ORIGIN rpath + in AT_SECURE programs (CVE-2026-86805, bsc#1282509, BZ #34360) +- power8-strncasecmp-overread.patch: powerpc: Fix one byte overread in + strncasecmp (CVE-2026-97399, bsc#1283147, BZ #34683) +- realloc-mmap-non-mremap.patch: realloc: Fix mmap non-mremap reallocation + case (BZ #34697) + +------------------------------------------------------------------- New: ---- elf-origin-open-normalized.patch power8-strncasecmp-overread.patch realloc-mmap-non-mremap.patch resolv-search-list-trunc.patch ----------(New B)---------- New: list truncation (CVE-2026-8674, bsc#1281297, BZ #31026) - elf-origin-open-normalized.patch: elf: Open the normalized $ORIGIN rpath in AT_SECURE programs (CVE-2026-86805, bsc#1282509, BZ #34360) New: in AT_SECURE programs (CVE-2026-86805, bsc#1282509, BZ #34360) - power8-strncasecmp-overread.patch: powerpc: Fix one byte overread in strncasecmp (CVE-2026-97399, bsc#1283147, BZ #34683) New: strncasecmp (CVE-2026-97399, bsc#1283147, BZ #34683) - realloc-mmap-non-mremap.patch: realloc: Fix mmap non-mremap reallocation case (BZ #34697) New: - resolv-search-list-trunc.patch: resolv: Fix assertion failure on search list truncation (CVE-2026-8674, bsc#1281297, BZ #31026) ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ glibc.spec ++++++ --- /var/tmp/diff_new_pack.Zh1Gw1/_old 2026-10-07 19:31:36.659149639 +0200 +++ /var/tmp/diff_new_pack.Zh1Gw1/_new 2026-10-07 19:31:36.661149723 +0200 @@ -361,6 +361,14 @@ Patch1007: eucjisx-pending-char-reset.patch # PATCH-FIX-UPSTREAM libio: Fix CVE-2026-18374 heap buffer overflow in ccs= handling (CVE-2026-18374, BZ #34574) Patch1008: libio-fopen-ccs.patch +# PATCH-FIX-UPSTREAM resolv: Fix assertion failure on search list truncation (CVE-2026-8674, BZ #31026) +Patch1009: resolv-search-list-trunc.patch +# PATCH-FIX-UPSTREAM elf: Open the normalized $ORIGIN rpath in AT_SECURE programs (CVE-2026-86805, BZ #34360) +Patch1019: elf-origin-open-normalized.patch +# PATCH-FIX-UPSTREAM powerpc: Fix one byte overread in strncasecmp (CVE-2026-97399, BZ #34683) +Patch1020: power8-strncasecmp-overread.patch +# PATCH-FIX-UPSTREAM realloc: Fix mmap non-mremap reallocation case (BZ #34697) +Patch1021: realloc-mmap-non-mremap.patch %endif ### ++++++ elf-origin-open-normalized.patch ++++++ ++++ 877 lines (skipped) ++++++ power8-strncasecmp-overread.patch ++++++ >From e622f82ea8797704ac8f761f88ed3e429e97fedd Mon Sep 17 00:00:00 2001 From: Sachin Monga <[email protected]> Date: Thu, 1 Oct 2026 00:51:23 +0530 Subject: [PATCH] powerpc: Fix one byte overread in strncasecmp (bug 34683, CVE-2026-97399) The Power8 strncasecmp (strcasecmp.S with USE_AS_STRNCASECMP) touches s1[n]/s2[n] in three places when the first n bytes compare equal and contain no NUL: L(loop) preloads the next byte before its bdnz; L(loop1) increments then loads before its bdnz; and L(bytebybyte) loads s1[0]/s2[0] before checking r5. A caller that maps exactly n readable bytes can get SIGSEGV if byte n falls on an unmapped page. The L(bytebybyte) site was identified by Florian Weimer; the original AISLE report covered only the two loops. Fix all three sites: guard L(bytebybyte) with a r5 == 0 check, split the bdnz/load pairs in L(loop) and L(loop1) so the load only runs when the count is still positive, and preload rCHAR1/rCHAR2 in L(lessthan4) after confirming r5 != 0. strcasecmp is unaffected; its generated code is unchanged. Add string/test-strncasecmp-nonarray.c, built on the test-Xncmp-nonarray.c skeleton: maps a PROT_NONE page past both buffers and sweeps all start offsets and lengths. Runs as an xtest. Reported-by: AISLE in partnership with Red Hat Suggested-by: Florian Weimer <[email protected]> --- string/Makefile | 4 +-- string/test-strncasecmp-nonarray.c | 4 +++ sysdeps/powerpc/powerpc64/power8/strcasecmp.S | 25 +++++++++++++++---- 3 files changed, 26 insertions(+), 7 deletions(-) create mode 100644 string/test-strncasecmp-nonarray.c diff --git a/string/Makefile b/string/Makefile index 46087828da..518db49b4c 100644 --- a/string/Makefile +++ b/string/Makefile @@ -250,8 +250,8 @@ endif # This test allocates a lot of memory and can run for a long time. xtests += tst-strcoll-overflow -# This test runs for a long time. -xtests += test-strncmp-nonarray +# These tests run for a long time. +xtests += test-strncasecmp-nonarray test-strncmp-nonarray # This test needs libdl. ifeq (yes,$(build-shared)) diff --git a/string/test-strncasecmp-nonarray.c b/string/test-strncasecmp-nonarray.c new file mode 100644 index 0000000000..d68e58d5ec --- /dev/null +++ b/string/test-strncasecmp-nonarray.c @@ -0,0 +1,4 @@ +#define TEST_IDENTIFIER strncasecmp +#define TEST_NAME "strncasecmp" +typedef char CHAR; +#include "test-Xncmp-nonarray.c" diff --git a/sysdeps/powerpc/powerpc64/power8/strcasecmp.S b/sysdeps/powerpc/powerpc64/power8/strcasecmp.S index 3c45e9ea50..8de75fb7e5 100644 --- a/sysdeps/powerpc/powerpc64/power8/strcasecmp.S +++ b/sysdeps/powerpc/powerpc64/power8/strcasecmp.S @@ -355,6 +355,14 @@ L(bytebybyte): offset and string descriptors are only updated in the end of loop unrolling. */ ld rLOC, LOCALE_CTYPE_TOLOWER(rLOC) +#ifdef USE_AS_STRNCASECMP + /* This entry point can be reached from the vector loop with + r5 == 0 (the last vector chunk ended exactly at the `n' + boundary). Do not read s1[0]/s2[0] in that case: those + bytes are s1[n]/s2[n], one past the caller's bound. */ + cmpdi cr7, r5, 0 + beq cr7, L(retnull) +#endif lbz rCHAR1, 0(rSTR1) /* Load char from s1 */ lbz rCHAR2, 0(rSTR2) /* Load char from s2 */ #ifdef USE_AS_STRNCASECMP @@ -405,19 +413,23 @@ L(loop): cmpw cr1, rLWR1, rLWR2 crorc 4*cr1+eq,eq,4*cr1+eq beq cr1, L(done) +#ifdef USE_AS_STRNCASECMP + /* Test the remaining count before touching the next byte. */ + bdnz L(loop_load) + b L(lessthan4) +L(loop_load): +#endif lbz rCHAR1, 0(rSTR1) /* Load char from s1 */ lbz rCHAR2, 0(rSTR2) /* Load char from s2 */ -#ifdef USE_AS_STRNCASECMP - bdnz L(loop) -#else b L(loop) -#endif #ifdef USE_AS_STRNCASECMP L(lessthan4): clrldi r5, r5, 62 cmpdi cr7, r5, 0 beq cr7, L(retnull) mtctr r5 + lbz rCHAR1, 0(rSTR1) + lbz rCHAR2, 0(rSTR2) L(loop1): cmpdi rCHAR1, 0 sldi rADDR1, rCHAR1, 2 @@ -427,11 +439,14 @@ L(loop1): cmpw cr1, rLWR1, rLWR2 crorc 4*cr1+eq,eq,4*cr1+eq beq cr1, L(done) + bdnz L(loop1_load) + b L(retnull) +L(loop1_load): addi rSTR1, rSTR1, 1 addi rSTR2, rSTR2, 1 lbz rCHAR1, 0(rSTR1) lbz rCHAR2, 0(rSTR2) - bdnz L(loop1) + b L(loop1) #endif L(done): subf r0, rLWR2, rLWR1 -- 2.56.0 ++++++ realloc-mmap-non-mremap.patch ++++++ >From 1e0512a684809e32170eae42c8f04f61126d77cc Mon Sep 17 00:00:00 2001 From: Samuel Thibault <[email protected]> Date: Mon, 28 Sep 2026 01:23:15 +0200 Subject: [PATCH] realloc: Fix mmap non-mremap reallocation case [BZ #34697] This case was missing copying SIZE_SZ bytes from the old allocation. Fixes commit 614cfd0f8a2820aed54f9745077c7da0e6643bac ("malloc: Change mmap chunk layout"), which went into glibc 2.43. Checked by Wilco Dijkstra <[email protected]> Resolves #34697. --- malloc/malloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/malloc/malloc.c b/malloc/malloc.c index 011ecd6870..a001875f25 100644 --- a/malloc/malloc.c +++ b/malloc/malloc.c @@ -3132,7 +3132,7 @@ __libc_realloc (void *oldmem, size_t bytes) if (newmem == NULL) return NULL; /* propagate failure */ - memcpy (newmem, oldmem, oldsize - CHUNK_HDR_SZ); + memcpy (newmem, oldmem, usable); munmap_chunk (oldp); return newmem; } -- 2.56.0 ++++++ resolv-search-list-trunc.patch ++++++ >From 506ea57086bfb9ce3daff1c14246a1cb532aba0a Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella <[email protected]> Date: Mon, 14 Sep 2026 17:08:03 -0300 Subject: [PATCH] resolv: Fix assertion failure on search list truncation [BZ 31026, CVE-2026-8674] update_from_conf copies the search list into the 256-byte resp->defdname and truncates it when an entry does not fit, then asserts that resolv_conf_matches accepts the result. The truncation check there compared the accumulated size against sizeof (resp->dnsrch) (the pointer array) instead of resp->defdname, and the empty-list case did not account for a first entry that does not fit at all. A long search domain in resolv.conf or LOCALDOMAIN thus aborts any process using the resolver. Check whether the entry fits in the remaining defdname space, matching alloc_buffer_copy_string, and also accept an empty resp->dnsrch when the first entry is too long. Add tests covering both cases through the search and domain directives. Checked on x86_64-linux-gnu and i686-linux-gnu. Reviewed-by: Florian Weimer <[email protected]> --- resolv/resolv_conf.c | 19 +++++++++------ resolv/tst-resolv-res_init-skeleton.c | 35 +++++++++++++++++++++++++++ 2 files changed, 47 insertions(+), 7 deletions(-) diff --git a/resolv/resolv_conf.c b/resolv/resolv_conf.c index d33f32ac1a..a688d4223b 100644 --- a/resolv/resolv_conf.c +++ b/resolv/resolv_conf.c @@ -281,8 +281,12 @@ resolv_conf_matches (const struct __res_state *resp, { if (resp->dnsrch[0] == NULL) { - /* Empty search list. No default domain name. */ - return conf->search_list_size == 0 && resp->defdname[0] == '\0'; + /* Empty search list, or the first entry does not fit in + resp->defdname. No default domain name. */ + return resp->defdname[0] == '\0' + && (conf->search_list_size == 0 + || (strlen (conf->search_list[0]) + 1 + > sizeof (resp->defdname))); } if (resp->dnsrch[0] != resp->defdname) @@ -309,11 +313,12 @@ resolv_conf_matches (const struct __res_state *resp, } else { - /* resp->dnsrch is truncated if the number of elements - exceeds MAXDNSRCH, or if the combined storage space for - the search list exceeds what can be stored in - resp->defdname. */ - if (i == MAXDNSRCH || search_list_size > sizeof (resp->dnsrch)) + /* resp->dnsrch is truncated if the number of elements exceeds + MAXDNSRCH, or if conf->search_list[i] does not fit in the + remaining space of resp->defdname. */ + if (i == MAXDNSRCH + || (search_list_size + strlen (conf->search_list[i]) + 1 + > sizeof (resp->defdname))) break; /* Otherwise, a mismatch indicates a match failure. */ return false; diff --git a/resolv/tst-resolv-res_init-skeleton.c b/resolv/tst-resolv-res_init-skeleton.c index 1e4c59dac9..e51a532c7e 100644 --- a/resolv/tst-resolv-res_init-skeleton.c +++ b/resolv/tst-resolv-res_init-skeleton.c @@ -724,6 +724,41 @@ struct test_case test_cases[] = "nameserver 192.0.2.1\n" "; nameserver[0]: [192.0.2.1]:53\n" }, +/* Search list entries which do not fit in the legacy 256-byte + resp->defdname buffer (bug 31026). LONG244 is 244 characters long, + so it does not fit after "example.com\0" (12 bytes). LONG256 is 256 + characters long, so it does not fit even as the first entry. */ +#define LBL63 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +#define LONG244 LBL63 "." LBL63 "." LBL63 "." \ + "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" +#define LONG256 LBL63 "." LBL63 "." LBL63 "." LBL63 "a" + {.name = "search list truncated at long entry after short entry", + .conf = "nameserver 192.0.2.1\n" + "search example.com " LONG244 "\n", + .expected = "search example.com\n" + "; search[0]: example.com\n" + "; search[1]: " LONG244 "\n" + "nameserver 192.0.2.1\n" + "; nameserver[0]: [192.0.2.1]:53\n" + }, + {.name = "search list truncated at long first entry", + .conf = "nameserver 192.0.2.1\n" + "search " LONG256 " example.com\n", + .expected = "; search[0]: " LONG256 "\n" + "; search[1]: example.com\n" + "nameserver 192.0.2.1\n" + "; nameserver[0]: [192.0.2.1]:53\n" + }, + {.name = "long first entry from the domain directive", + .conf = "nameserver 192.0.2.1\n" + "domain " LONG256 "\n", + .expected = "; search[0]: " LONG256 "\n" + "nameserver 192.0.2.1\n" + "; nameserver[0]: [192.0.2.1]:53\n" + }, +#undef LONG256 +#undef LONG244 +#undef LBL63 {.name = "trust-ad flag", .conf = "options trust-ad\n" "nameserver 192.0.2.1\n", -- 2.55.0
