From 0e7daa2717f9d2ad902697102128d02b7df97ffd Mon Sep 17 00:00:00 2001 From: Titouan Christophe Date: Mon, 27 Oct 2025 10:31:45 +0100 Subject: [PATCH] package/libglib2: add patch for CVE-2025-7039 Backport upstream patch, that was released in GLib 2.84.4 [1], such that we can apply it onto GLib 2.82 in Buildroot LTS This fixes the following vulnerability: - CVE-2025-7039: A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations. https://www.cve.org/CVERecord?id=CVE-2025-7039 [1] https://gitlab.gnome.org/GNOME/glib/-/releases/2.84.4 Signed-off-by: Titouan Christophe (cherry picked from commit 3252f45279b0104785c45e121a432a3335779a08) Signed-off-by: Thomas Perale --- ...x-computation-of-temporary-file-name.patch | 46 +++++++++++++++++++ package/libglib2/libglib2.mk | 3 ++ 2 files changed, 49 insertions(+) create mode 100644 package/libglib2/0002-gfileutils-fix-computation-of-temporary-file-name.patch diff --git a/package/libglib2/0002-gfileutils-fix-computation-of-temporary-file-name.patch b/package/libglib2/0002-gfileutils-fix-computation-of-temporary-file-name.patch new file mode 100644 index 0000000000..a297361ceb --- /dev/null +++ b/package/libglib2/0002-gfileutils-fix-computation-of-temporary-file-name.patch @@ -0,0 +1,46 @@ +From 61e963284889ddb4544e6f1d5261c16120f6fcc3 Mon Sep 17 00:00:00 2001 +From: Michael Catanzaro +Date: Tue, 1 Jul 2025 10:58:07 -0500 +Subject: [PATCH] gfileutils: fix computation of temporary file name + +We need to ensure that the value we use to index into the letters array +is always positive. + +Fixes #3716 + +CVE: CVE-2025-7039 +Upstream: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4674 +Signed-off-by: Titouan Christophe +--- + glib/gfileutils.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/glib/gfileutils.c b/glib/gfileutils.c +index c7d3339d1c..286b1b154f 100644 +--- a/glib/gfileutils.c ++++ b/glib/gfileutils.c +@@ -1538,9 +1538,9 @@ get_tmp_file (gchar *tmpl, + static const char letters[] = + "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"; + static const int NLETTERS = sizeof (letters) - 1; +- gint64 value; +- gint64 now_us; +- static int counter = 0; ++ guint64 value; ++ guint64 now_us; ++ static guint counter = 0; + + g_return_val_if_fail (tmpl != NULL, -1); + +@@ -1559,7 +1559,7 @@ get_tmp_file (gchar *tmpl, + + for (count = 0; count < 100; value += 7777, ++count) + { +- gint64 v = value; ++ guint64 v = value; + + /* Fill in the random bits. */ + XXXXXX[0] = letters[v % NLETTERS]; +-- +GitLab + diff --git a/package/libglib2/libglib2.mk b/package/libglib2/libglib2.mk index b8c853b752..e0ef652593 100644 --- a/package/libglib2/libglib2.mk +++ b/package/libglib2/libglib2.mk @@ -25,6 +25,9 @@ endif # 0001-gstring-Fix-overflow-check-when-expanding-the-string.patch LIBGLIB2_IGNORE_CVES += CVE-2025-6052 +# 0002-gfileutils-fix-computation-of-temporary-file-name.patch +LIBGLIB2_IGNORE_CVES += CVE-2025-7039 + HOST_LIBGLIB2_CONF_OPTS = \ -Ddtrace=false \ -Dglib_debug=disabled \