mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-09 07:51:59 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/rsyslog: upstream patch CVE-2026-19654

Browse Source 
- CVE-2026-19654:
    A unauthenticated remote peer may lead rsyslogd to crash due to a flaw
    in the optional imptcp module. A crafted input sequence during
    oversize-frame recovery can cause an invalid internal message length
    and terminate rsyslogd. No confidentiality or integrity impact,
    privilege escalation, or code execution has been identified. imtcp and
    the default imptcp framing modes are not affected.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-19654
  - 07b3c40a5a

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Thomas Perale
2026-08-26 21:11:59 +02:00
committed by Julien Olivain
parent d0619dfc6b
commit 52ae04257a
2 changed files with 50 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
package/rsyslog/0001-imptcp-guard-regex-framing-match-at-line-start.patch Normal file
View File

@@ -0,0 +1,47 @@
From 07b3c40a5a78c79ed9109251f842ca7e955dd586 Mon Sep 17 00:00:00 2001
From: Rainer Gerhards <rgerhards@adiscon.com>
Date: Mon, 20 Jul 2026 17:19:28 +0200
Subject: [PATCH] imptcp: guard regex framing match at line start
Why
A regex match at the beginning of the receive buffer can form a
negative message length after oversize-frame recovery.
Impact
Regex-framed imptcp listeners reject that invalid transition instead
of submitting a negative message length.
Before/After
Before: a match with a zero line offset submitted an invalid length.
After: only a match following an existing line can submit a frame.
Technical Overview
Mirror the line-offset guard used by the shared imtcp parser.
Leave existing regex framing and oversize recovery behavior unchanged.
Security advisory:
https://github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29
Reported-by: Raphael Eikenberg (@eikendev)
With the help of AI-Agents: Codex
---
CVE: CVE-2026-19654
Upstream: https://github.com/rsyslog/rsyslog/commit/07b3c40a5a78c79ed9109251f842ca7e955dd586
Signed-off-by: Thomas Perale <thomas.perale@mind.be
---
plugins/imptcp/imptcp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/plugins/imptcp/imptcp.c b/plugins/imptcp/imptcp.c
index 838e1648fc..90a7d6f7ed 100644
--- a/plugins/imptcp/imptcp.c
+++ b/plugins/imptcp/imptcp.c
@@ -1009,7 +1009,7 @@ static rsRetVal ATTR_NONNULL() processDataRcvd_regexFraming(ptcpsess_t *const __
pThis->iCurrLine = pThis->iMsg;
} else {
const int isMatch = !regexec(&inst->start_preg, (char *)pThis->pMsg + pThis->iCurrLine, 0, NULL, 0);
- if (isMatch) {
+ if (pThis->iCurrLine > 0 && isMatch) {
DBGPRINTF("regex match (%d), framing line: %s\n", pThis->iCurrLine, pThis->pMsg);
strcpy((char *)pThis->pMsg_save, (char *)pThis->pMsg + pThis->iCurrLine);
pThis->iMsg = pThis->iCurrLine - 1;

3
package/rsyslog/rsyslog.mk
View File

@@ -12,6 +12,9 @@ RSYSLOG_CPE_ID_VENDOR = rsyslog
RSYSLOG_DEPENDENCIES = zlib libestr liblogging libfastjson host-pkgconf
RSYSLOG_CONF_ENV = ac_cv_prog_cc_c99='-std=c99'
# 0001-imptcp-guard-regex-framing-match-at-line-start.patch
RSYSLOG_IGNORE_CVES += CVE-2026-19654
ifeq ($(BR2_PACKAGE_RSYSLOG_EXTRA_PLUGINS),y)
RSYSLOG_PLUGINS = imdiag imfile impstats imptcp \
mmanon mmaudit mmfields mmjsonparse mmpstrucdata mmsequence mmutf8fix \