diff --git a/0001-fix-cve-2024-33599.patch b/0001-fix-cve-2024-33599.patch new file mode 100644 index 0000000000000000000000000000000000000000..7336751f509083df5e0d89d9ae2c6a4c4c782956 --- /dev/null +++ b/0001-fix-cve-2024-33599.patch @@ -0,0 +1,32 @@ +From 4472b1141766bec30d6bf984e01de73396303380 Mon Sep 17 00:00:00 2001 +Florian Weimer +Date: Tue, 19 Nov 2024 17:02:06 +0800 +Subject: [PATCH 1/2] fix-cve-2024-33599 + +--- + nscd/netgroupcache.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/nscd/netgroupcache.c b/nscd/netgroupcache.c +index 06b7d7b6..05623086 100644 +--- a/nscd/netgroupcache.c ++++ b/nscd/netgroupcache.c +@@ -502,12 +502,13 @@ addinnetgrX (struct database_dyn *db, int fd, request_header *req, + = (struct indataset *) mempool_alloc (db, + sizeof (*dataset) + req->key_len, + 1); +- struct indataset dataset_mem; + bool cacheable = true; + if (__glibc_unlikely (dataset == NULL)) + { + cacheable = false; +- dataset = &dataset_mem; ++ /* The alloca is safe because nscd_run_worker verfies that ++ key_len is not larger than MAXKEYLEN. */ ++ dataset = alloca (sizeof (*dataset) + req->key_len); + } + + datahead_init_pos (&dataset->head, sizeof (*dataset) + req->key_len, +-- +2.27.0 + diff --git a/0002-fix-cve-2024-33600.patch b/0002-fix-cve-2024-33600.patch new file mode 100644 index 0000000000000000000000000000000000000000..3c849ca2798d0662051e574e7adc5e773f04b637 --- /dev/null +++ b/0002-fix-cve-2024-33600.patch @@ -0,0 +1,83 @@ +From c35ef5ed25ba47bbb301e0902e305734a166a786 Mon Sep 17 00:00:00 2001 +Florian Weimer +Date: Tue, 19 Nov 2024 17:14:24 +0800 +Subject: [PATCH 2/2] fix-cve-2024-33600 + +--- + nscd/netgroupcache.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/nscd/netgroupcache.c b/nscd/netgroupcache.c +index 05623086..ef87c2b0 100644 +--- a/nscd/netgroupcache.c ++++ b/nscd/netgroupcache.c +@@ -147,7 +147,7 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req, + /* No such service. */ + cacheable = do_notfound (db, fd, req, key, &dataset, &total, &timeout, + &key_copy); +- goto writeout; ++ goto maybe_cache_add; + } + + memset (&data, '\0', sizeof (data)); +@@ -348,7 +348,7 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req, + { + cacheable = do_notfound (db, fd, req, key, &dataset, &total, &timeout, + &key_copy); +- goto writeout; ++ goto maybe_cache_add; + } + + total = buffilled; +@@ -410,14 +410,11 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req, + } + + if (he == NULL && fd != -1) +- { +- /* We write the dataset before inserting it to the database +- since while inserting this thread might block and so would +- unnecessarily let the receiver wait. */ +- writeout: ++ /* We write the dataset before inserting it to the database ++ since while inserting this thread might block and so would ++ unnecessarily let the receiver wait. */ + writeall (fd, &dataset->resp, dataset->head.recsize); +- } +- ++maybe_cache_add: + if (cacheable) + { + /* If necessary, we also propagate the data to disk. */ +@@ -513,14 +510,15 @@ addinnetgrX (struct database_dyn *db, int fd, request_header *req, + + datahead_init_pos (&dataset->head, sizeof (*dataset) + req->key_len, + sizeof (innetgroup_response_header), +- he == NULL ? 0 : dh->nreloads + 1, result->head.ttl); ++ he == NULL ? 0 : dh->nreloads + 1, ++ result == NULL ? db->negtimeout : result->head.ttl); + /* Set the notfound status and timeout based on the result from + getnetgrent. */ +- dataset->head.notfound = result->head.notfound; ++ dataset->head.notfound = result == NULL || result->head.notfound; + dataset->head.timeout = timeout; + + dataset->resp.version = NSCD_VERSION; +- dataset->resp.found = result->resp.found; ++ dataset->resp.found = result != NULL && result->resp.found; + /* Until we find a matching entry the result is 0. */ + dataset->resp.result = 0; + +@@ -568,7 +566,9 @@ addinnetgrX (struct database_dyn *db, int fd, request_header *req, + goto out; + } + +- if (he == NULL) ++ /* addgetnetgrentX may have already sent a notfound response. Do ++ not send another one. */ ++ if (he == NULL && dataset->resp.found) + { + /* We write the dataset before inserting it to the database + since while inserting this thread might block and so would +-- +2.27.0 + diff --git a/glibc.spec b/glibc.spec index 551ce96c51316f4825e1032a668fb0b45b27f8ba..83622e42a659fe4ceec2dc5502a5a99430fd9823 100644 --- a/glibc.spec +++ b/glibc.spec @@ -1,4 +1,4 @@ -%define anolis_release 4 +%define anolis_release 5 %bcond_without testsuite %bcond_without benchtests @@ -154,6 +154,12 @@ Patch3044: 0016-LoongArch-Simplify-the-autoconf-check-for-static-PIE.patch Patch3045: 0017-nptl-Add-thread_pointer.h-for-LoongArch.patch Patch3046: 0018-nptl-fix-__builtin_thread_pointer-detection-on-Loong.patch +#https://sourceware.org/git/?p=glibc.git;a=commit;h=87801a8fd06db1d654eea3e4f7626ff476a9bdaa +Patch3047: 0001-fix-cve-2024-33599.patch +#https://sourceware.org/git/?p=glibc.git;a=commit;h=b048a482f088e53144d26a61c390bed0210f49f2 +#https://sourceware.org/git/?p=glibc.git;a=commit;h=7835b00dbce53c3c87bbbb1754a95fb5e58187aa +Patch3048: 0002-fix-cve-2024-33600.patch + BuildRequires: audit-libs-devel >= 1.1.3 libcap-devel systemtap-sdt-devel BuildRequires: procps-ng util-linux gawk sed >= 3.95 gettext BuildRequires: python3 python3-devel @@ -1106,6 +1112,9 @@ update_gconv_modules_cache () %{_libdir}/libpthread_nonshared.a %changelog +* Tue Nov 19 2024 yangxinyu - 2.38-5 +- fix CVE-2024-33599 CVE-2024-33600 + * Thu Nov 07 2024 Peng Fan - 2.38-4 - Sync from glibc upstream