From 0adba001b4dbc831d9b339e99b1c4103e1850133 Mon Sep 17 00:00:00 2001 From: Titouan Christophe Date: Mon, 2 Feb 2026 15:15:04 +0100 Subject: [PATCH] package/glibc: security bump to v2.41-123 This contains backports for the following vulnerabilities: - CVE-2025-15281: Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process. https://www.cve.org/CVERecord?id=CVE-2025-15281 - CVE-2026-0861: Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc. Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments. https://www.cve.org/CVERecord?id=CVE-2026-0861 - CVE-2026-0915: Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver. https://www.cve.org/CVERecord?id=CVE-2026-0915 Signed-off-by: Titouan Christophe (cherry picked from commit 18de297a5ad3d1fc1b44f54ae69289ca10200ad5) Signed-off-by: Thomas Perale --- package/glibc/glibc.hash | 2 +- package/glibc/glibc.mk | 11 ++++++++++- package/localedef/localedef.mk | 2 +- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/package/glibc/glibc.hash b/package/glibc/glibc.hash index 0deba84dc7..a7f1daacf9 100644 --- a/package/glibc/glibc.hash +++ b/package/glibc/glibc.hash @@ -1,5 +1,5 @@ # Locally calculated (fetched from Github) -sha256 166b6e7637bb45cb9352e4813005f83dd48f03ef634d3e9e94a30aa5a0300fab glibc-2.41-70-g1502c248d58cb99a203731707987a4342926e830.tar.gz +sha256 7ed7900a90fd1b05fd49a25b1877515c6c3f1ab9ea9248af9d5d0e7fdb3fdd82 glibc-2.41-123-gfb4db64a04ad6c96cd1fbb7e02eb59323b1f2ac2.tar.gz # Hashes for license files sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 COPYING diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk index 37752416ba..3f519bfdca 100644 --- a/package/glibc/glibc.mk +++ b/package/glibc/glibc.mk @@ -7,7 +7,7 @@ # Generate version string using: # git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2- # When updating the version, please also update localedef -GLIBC_VERSION = 2.41-70-g1502c248d58cb99a203731707987a4342926e830 +GLIBC_VERSION = 2.41-123-gfb4db64a04ad6c96cd1fbb7e02eb59323b1f2ac2 # Upstream doesn't officially provide an https download link. # There is one (https://sourceware.org/git/glibc.git) but it's not reliable, @@ -39,6 +39,15 @@ GLIBC_IGNORE_CVES += CVE-2025-8058 # https://security-tracker.debian.org/tracker/CVE-2010-4756 GLIBC_IGNORE_CVES += CVE-2010-4756 +# Fixed by glibc-2.41-121-g1e2c1ea4307197ccece0cda574bcfebf9080894c +GLIBC_IGNORE_CVES += CVE-2026-0861 + +# Fixed by glibc-2.41-122-g15c9839a0b853f552b4ed9047841b6223f3c104d +GLIBC_IGNORE_CVES += CVE-2026-0915 + +# Fixed by glibc-2.41-123-gfb4db64a04ad6c96cd1fbb7e02eb59323b1f2ac2 +GLIBC_IGNORE_CVES += CVE-2025-15281 + # glibc is part of the toolchain so disable the toolchain dependency GLIBC_ADD_TOOLCHAIN_DEPENDENCY = NO diff --git a/package/localedef/localedef.mk b/package/localedef/localedef.mk index c76a8d82a0..925998a5f4 100644 --- a/package/localedef/localedef.mk +++ b/package/localedef/localedef.mk @@ -7,7 +7,7 @@ # Use the same VERSION and SITE as target glibc # As in glibc.mk, generate version string using: # git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2- -LOCALEDEF_VERSION = 2.41-70-g1502c248d58cb99a203731707987a4342926e830 +LOCALEDEF_VERSION = 2.41-123-gfb4db64a04ad6c96cd1fbb7e02eb59323b1f2ac2 LOCALEDEF_SOURCE = glibc-$(LOCALEDEF_VERSION).tar.gz LOCALEDEF_SITE = $(call github,bminor,glibc,$(LOCALEDEF_VERSION)) HOST_LOCALEDEF_DL_SUBDIR = glibc