mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-10 08:14:09 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/clamav: add patch for CVE-2026-20217

Browse Source 
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
This commit is contained in:
Titouan Christophe
2026-09-02 15:16:28 +02:00
committed by Raphaël Mélotte
parent 014e7301c7
commit 83c2d9e1ef
2 changed files with 49 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
package/clamav/0002-libclamav-fix-pespin-cleanup-bitmap-tracking-47.patch Normal file
View File

@@ -0,0 +1,46 @@
From: "Val S." <valsnyde@cisco.com>
Date: Tue, 16 Jun 2026 11:43:04 -0400
Subject: Libclamav: fix PESpin cleanup bitmap tracking (#47)
The PESpin unpacker mixes heap-owned section buffers with pointers
back into the original PE image. Its final cleanup loop is supposed
to walk a copy of the ownership bitmap and free only the entries
that were allocated by the unpacker.
That loop checked bitmap but shifted bitman instead. When the low
bit was set, bitmap never changed and the loop could free every
entry in sects, including pointers into the input buffer. A crafted
sample can drive this path after an allocation failure and crash in
free() with an invalid pointer.
Shift bitmap in the cleanup loop so the free decision advances one
section at a time using the same working bitmap that the condition
already tests. This matches the existing intent of saving bitmap as
a disposable free bitmap copy and avoids touching the original
bitman state.
Credit: Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen of Tencent Xuanwu Lab.
CLAM-2961
---
Upstream: https://github.com/Cisco-Talos/clamav/commit/2410b002feb151500fa6cdee3233fe97c9fe865a
CVE: CVE-2026-20217
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
---
libclamav/spin.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libclamav/spin.c b/libclamav/spin.c
index a741fb83be..d0470b317a 100644
--- a/libclamav/spin.c
+++ b/libclamav/spin.c
@@ -508,7 +508,7 @@ int unspin(char *src, int ssize, struct cli_exe_section *sections, int sectcnt,
for (j = 0; j < sectcnt; j++) {
if (bitmap & 1)
free(sects[j]);
- bitman = bitman >> 1 & 0x7fffffff;
+ bitmap = bitmap >> 1 & 0x7fffffff;
}
free(sects);
return 1; /* :( */

3
package/clamav/clamav.mk
View File

@@ -27,6 +27,9 @@ CLAMAV_IGNORE_CVES += CVE-2016-1405
# 0001-fix-possible-panic-when-scanning-some-html-files.patch
CLAMAV_IGNORE_CVES += CVE-2026-20031
# 0002-libclamav-fix-pespin-cleanup-bitmap-tracking-47.patch
CLAMAV_IGNORE_CVES += CVE-2026-20217
CLAMAV_DEPENDENCIES = \
bzip2 \
host-pkgconf \