From: Peter Marko <[email protected]> Pick patch referencing this CVE from 3.41 branch (oldest release still receiving security updates).
Signed-off-by: Peter Marko <[email protected]> --- .../glibc/glibc/0048-CVE-2026-97399.patch | 128 ++++++++++++++++++ meta/recipes-core/glibc/glibc_2.39.bb | 1 + 2 files changed, 129 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/0048-CVE-2026-97399.patch diff --git a/meta/recipes-core/glibc/glibc/0048-CVE-2026-97399.patch b/meta/recipes-core/glibc/glibc/0048-CVE-2026-97399.patch new file mode 100644 index 00000000000..c5aec0802c9 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0048-CVE-2026-97399.patch @@ -0,0 +1,128 @@ +From f247c0a2fb5b3e48a771d2d23efc9a45c64e957d Mon Sep 17 00:00:00 2001 +From: Sachin Monga <[email protected]> +Date: Thu, 1 Oct 2026 00:51:23 +0530 +Subject: [PATCH] powerpc: Fix one byte overread in strncasecmp (bug 34683, + CVE-2026-97399) + +The Power8 strncasecmp (strcasecmp.S with USE_AS_STRNCASECMP) touches +s1[n]/s2[n] in three places when the first n bytes compare equal and +contain no NUL: L(loop) preloads the next byte before its bdnz; +L(loop1) increments then loads before its bdnz; and L(bytebybyte) loads +s1[0]/s2[0] before checking r5. A caller that maps exactly n readable bytes +can get SIGSEGV if byte n falls on an unmapped page. + +The L(bytebybyte) site was identified by Florian Weimer; the +original AISLE report covered only the two loops. + +Fix all three sites: guard L(bytebybyte) with a r5 == 0 check, split the +bdnz/load pairs in L(loop) and L(loop1) so the load only runs when the +count is still positive, and preload rCHAR1/rCHAR2 in L(lessthan4) after +confirming r5 != 0. strcasecmp is unaffected; its generated code is +unchanged. + +Add string/test-strncasecmp-nonarray.c, built on the test-Xncmp-nonarray.c +skeleton: maps a PROT_NONE page past both buffers and sweeps all start +offsets and lengths. Runs as an xtest. + +Reported-by: AISLE in partnership with Red Hat +Suggested-by: Florian Weimer <[email protected]> +(cherry picked from commit e622f82ea8797704ac8f761f88ed3e429e97fedd) + +CVE: CVE-2026-97399 +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=f247c0a2fb5b3e48a771d2d23efc9a45c64e957d] +Signed-off-by: Peter Marko <[email protected]> +--- + string/Makefile | 4 +-- + string/test-strncasecmp-nonarray.c | 4 +++ + sysdeps/powerpc/powerpc64/power8/strcasecmp.S | 25 +++++++++++++++---- + 3 files changed, 26 insertions(+), 7 deletions(-) + create mode 100644 string/test-strncasecmp-nonarray.c + +diff --git a/string/Makefile b/string/Makefile +index c83b195e2e..d7437cd915 100644 +--- a/string/Makefile ++++ b/string/Makefile +@@ -238,8 +238,8 @@ endif + # This test allocates a lot of memory and can run for a long time. + xtests += tst-strcoll-overflow + +-# This test runs for a long time. +-xtests += test-strncmp-nonarray ++# These tests run for a long time. ++xtests += test-strncasecmp-nonarray test-strncmp-nonarray + + # This test needs libdl. + ifeq (yes,$(build-shared)) +diff --git a/string/test-strncasecmp-nonarray.c b/string/test-strncasecmp-nonarray.c +new file mode 100644 +index 0000000000..d68e58d5ec +--- /dev/null ++++ b/string/test-strncasecmp-nonarray.c +@@ -0,0 +1,4 @@ ++#define TEST_IDENTIFIER strncasecmp ++#define TEST_NAME "strncasecmp" ++typedef char CHAR; ++#include "test-Xncmp-nonarray.c" +diff --git a/sysdeps/powerpc/powerpc64/power8/strcasecmp.S b/sysdeps/powerpc/powerpc64/power8/strcasecmp.S +index 7ce53407b8..838b8bf75f 100644 +--- a/sysdeps/powerpc/powerpc64/power8/strcasecmp.S ++++ b/sysdeps/powerpc/powerpc64/power8/strcasecmp.S +@@ -355,6 +355,14 @@ L(bytebybyte): + offset and string descriptors are only updated in the end + of loop unrolling. */ + ld rLOC, LOCALE_CTYPE_TOLOWER(rLOC) ++#ifdef USE_AS_STRNCASECMP ++ /* This entry point can be reached from the vector loop with ++ r5 == 0 (the last vector chunk ended exactly at the `n' ++ boundary). Do not read s1[0]/s2[0] in that case: those ++ bytes are s1[n]/s2[n], one past the caller's bound. */ ++ cmpdi cr7, r5, 0 ++ beq cr7, L(retnull) ++#endif + lbz rCHAR1, 0(rSTR1) /* Load char from s1 */ + lbz rCHAR2, 0(rSTR2) /* Load char from s2 */ + #ifdef USE_AS_STRNCASECMP +@@ -405,19 +413,23 @@ L(loop): + cmpw cr1, rLWR1, rLWR2 + crorc 4*cr1+eq,eq,4*cr1+eq + beq cr1, L(done) ++#ifdef USE_AS_STRNCASECMP ++ /* Test the remaining count before touching the next byte. */ ++ bdnz L(loop_load) ++ b L(lessthan4) ++L(loop_load): ++#endif + lbz rCHAR1, 0(rSTR1) /* Load char from s1 */ + lbz rCHAR2, 0(rSTR2) /* Load char from s2 */ +-#ifdef USE_AS_STRNCASECMP +- bdnz L(loop) +-#else + b L(loop) +-#endif + #ifdef USE_AS_STRNCASECMP + L(lessthan4): + clrldi r5, r5, 62 + cmpdi cr7, r5, 0 + beq cr7, L(retnull) + mtctr r5 ++ lbz rCHAR1, 0(rSTR1) ++ lbz rCHAR2, 0(rSTR2) + L(loop1): + cmpdi rCHAR1, 0 + sldi rADDR1, rCHAR1, 2 +@@ -427,11 +439,14 @@ L(loop1): + cmpw cr1, rLWR1, rLWR2 + crorc 4*cr1+eq,eq,4*cr1+eq + beq cr1, L(done) ++ bdnz L(loop1_load) ++ b L(retnull) ++L(loop1_load): + addi rSTR1, rSTR1, 1 + addi rSTR2, rSTR2, 1 + lbz rCHAR1, 0(rSTR1) + lbz rCHAR2, 0(rSTR2) +- bdnz L(loop1) ++ b L(loop1) + #endif + L(done): + subf r0, rLWR2, rLWR1 diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb index 66250fbdb2a..3e377f66875 100644 --- a/meta/recipes-core/glibc/glibc_2.39.bb +++ b/meta/recipes-core/glibc/glibc_2.39.bb @@ -80,6 +80,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0045-CVE-2026-86805-CVE-2026-95818-03.patch \ file://0046-CVE-2026-86805-CVE-2026-95818-04.patch \ file://0047-CVE-2026-89092.patch \ + file://0048-CVE-2026-97399.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#248469): https://lists.openembedded.org/g/openembedded-core/message/248469 Mute This Topic: https://lists.openembedded.org/mt/121892965/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
