Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package hivex for openSUSE:Factory checked in at 2026-11-06 19:47:40 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/hivex (Old) and /work/SRC/openSUSE:Factory/.hivex.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "hivex" Fri Nov 6 19:47:40 2026 rev:27 rq:1395485 version:1.3.24 Changes: -------- --- /work/SRC/openSUSE:Factory/hivex/hivex.changes 2026-07-17 18:52:12.262782587 +0200 +++ /work/SRC/openSUSE:Factory/.hivex.new.3759290/hivex.changes 2026-11-06 19:53:48.910727486 +0100 @@ -1,0 +2,7 @@ +Tue Nov 3 09:15:01 MST 2026 - [email protected] + +- bsc#1289202 - VUL-0: CVE-2026-120740: hivex: Denial of Service + via out-of-bounds read in big-data block processing + CVE-2026-120740-Avoid-out-of-bounds-read-in-db-record.patch + +------------------------------------------------------------------- New: ---- CVE-2026-120740-Avoid-out-of-bounds-read-in-db-record.patch ----------(New B)---------- New: via out-of-bounds read in big-data block processing CVE-2026-120740-Avoid-out-of-bounds-read-in-db-record.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ hivex.spec ++++++ --- /var/tmp/diff_new_pack.Zd0CRk/_old 2026-11-06 19:53:50.622799172 +0100 +++ /var/tmp/diff_new_pack.Zd0CRk/_new 2026-11-06 19:53:50.627799382 +0100 @@ -31,6 +31,9 @@ Source2: http://libguestfs.org/download/hivex/%{name}-%{version}.tar.gz.sig Source3: %{name}.keyring Source4: %{name}.rpmlintrc + +Patch1: CVE-2026-120740-Avoid-out-of-bounds-read-in-db-record.patch + BuildRequires: autoconf BuildRequires: automake BuildRequires: gcc ++++++ CVE-2026-120740-Avoid-out-of-bounds-read-in-db-record.patch ++++++ Subject: lib/value.c: Avoid out of bounds read in "db" record (CVE-2026-120740) From: Richard W.M. Jones [email protected] Sun Nov 1 11:50:20 2026 +0000 Date: Tue Nov 3 08:11:42 2026 +0000: Git: aa9acb0e2e980913ecf9fb47c561fe7988089e89 A "db" record in the registry references a list of blocks which get concatenated together to return the value. The list of blocks itself is list of values stored in a block, with the number of values declared in the nr_blocks field of the db record. nr_blocks is read from the file, therefore controlled by an attacker. We did not check that nr_blocks does not exceed the size of the actual length of the block containing the list of values, or indeed of the entire hive file. Thus an attacker could cause hivex to read past the end of the hive file, resulting in (most likely) a denial of service, or reading other memory from the process. The commit adds the check. Reported-by: HaiND (Nguyen Dinh Hai), Post and Telecommunication Institute of Technology Link: https://hackmd.io/@haindpwn/hivex-value-db-blocklist-oob-read Link: https://access.redhat.com/security/cve/CVE-2026-120740 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2565405 Fixes: https://github.com/libguestfs/hivex/issues/39 diff --git a/lib/value.c b/lib/value.c index 3257b53..862453e 100644 --- a/lib/value.c +++ b/lib/value.c @@ -408,6 +408,16 @@ hivex_value_value (hive_h *h, hive_value_h value, } struct ntreg_value_list *bl = (struct ntreg_value_list *) ((char *) h->addr + blocklist_offset); + /* nr_blocks is an attacker-controlled field from the db record. + * The block list array must fit inside its own block. + */ + size_t bllen = block_len (h, blocklist_offset, NULL); + if (4 + nr_blocks * 4 > bllen) { + SET_ERRNO (EFAULT, "db block list is too long (%zu, %zu)", + nr_blocks, len); + free (ret); + return NULL; + } size_t i, off; for (i = off = 0; i < nr_blocks; ++i) { size_t subblock_offset = le32toh (bl->offset[i]);
