z572 pushed a commit to branch core-packages-team
in repository guix.
commit e64403c27705999230e0e39ed7add1ff58cf8800
Author: Janneke Nieuwenhuizen <[email protected]>
AuthorDate: Fri Jan 24 17:03:35 2025 +0100
squash! (?): gnu: glibc: Update to 2.40. -- Add patch for CVE-2025-0.
* gnu/packages/patches/glibc-2.40-CVE-2025-0.patch: New file.
* gnu/local.mk (dist_patch_DATA):Register it.
* gnu/packages/base.scm (%glibc-patches): Add it.
Change-Id: Ib08bf91c82b9ed0c76a9aaea93ca23301703bb38
---
gnu/local.mk | 1 +
gnu/packages/base.scm | 1 +
gnu/packages/patches/glibc-2.40-CVE-2025-0.patch | 63 ++++++++++++++++++++++++
3 files changed, 65 insertions(+)
diff --git a/gnu/local.mk b/gnu/local.mk
index 9d6fadfb94..2248a5b98b 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1446,6 +1446,7 @@ dist_patch_DATA =
\
%D%/packages/patches/glibc-2.39-git-updates.patch \
%D%/packages/patches/glibc-2.39-fmod-libm-a.patch \
%D%/packages/patches/glibc-2.40-dl-cache.patch \
+ %D%/packages/patches/glibc-2.40-CVE-2025-0.patch \
%D%/packages/patches/glibc-CVE-2019-7309.patch \
%D%/packages/patches/glibc-CVE-2019-9169.patch \
%D%/packages/patches/glibc-CVE-2019-19126.patch \
diff --git a/gnu/packages/base.scm b/gnu/packages/base.scm
index 9df1eeb1d6..d7f77c7a94 100644
--- a/gnu/packages/base.scm
+++ b/gnu/packages/base.scm
@@ -902,6 +902,7 @@ the store.")
;; "glibc-allow-kernel-2.6.32.patch"
"glibc-reinstate-prlimit64-fallback.patch"
"glibc-supported-locales.patch"
+ "glibc-2.40-CVE-2025-0.patch"
"glibc-2.37-hurd-clock_t_centiseconds.patch"
"glibc-2.37-hurd-local-clock_gettime_MONOTONIC.patch"
"glibc-hurd-mach-print.patch"
diff --git a/gnu/packages/patches/glibc-2.40-CVE-2025-0.patch
b/gnu/packages/patches/glibc-2.40-CVE-2025-0.patch
new file mode 100644
index 0000000000..9dd4eee074
--- /dev/null
+++ b/gnu/packages/patches/glibc-2.40-CVE-2025-0.patch
@@ -0,0 +1,63 @@
+From 7d4b6bcae91f29d7b4daf15bab06b66cf1d2217c Mon Sep 17 00:00:00 2001
+From: Siddhesh Poyarekar <[email protected]>
+Date: Tue, 21 Jan 2025 16:11:06 -0500
+Subject: [PATCH] Fix underallocation of abort_msg_s struct (CVE-2025-0395)
+
+Include the space needed to store the length of the message itself, in
+addition to the message string. This resolves BZ #32582.
+
+Signed-off-by: Siddhesh Poyarekar <[email protected]>
+Reviewed: Adhemerval Zanella <[email protected]>
+(cherry picked from commit 68ee0f704cb81e9ad0a78c644a83e1e9cd2ee578)
+---
+ assert/assert.c | 4 +++-
+ sysdeps/posix/libc_fatal.c | 4 +++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/assert/assert.c b/assert/assert.c
+index c29629f5f6..b6e37d694c 100644
+--- a/assert/assert.c
++++ b/assert/assert.c
+@@ -18,6 +18,7 @@
+ #include <assert.h>
+ #include <atomic.h>
+ #include <ldsodefs.h>
++#include <libc-pointer-arith.h>
+ #include <libintl.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+@@ -65,7 +66,8 @@ __assert_fail_base (const char *fmt, const char *assertion,
const char *file,
+ (void) __fxprintf (NULL, "%s", str);
+ (void) fflush (stderr);
+
+- total = (total + 1 + GLRO(dl_pagesize) - 1) & ~(GLRO(dl_pagesize) - 1);
++ total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1,
++ GLRO(dl_pagesize));
+ struct abort_msg_s *buf = __mmap (NULL, total, PROT_READ | PROT_WRITE,
+ MAP_ANON | MAP_PRIVATE, -1, 0);
+ if (__glibc_likely (buf != MAP_FAILED))
+diff --git a/sysdeps/posix/libc_fatal.c b/sysdeps/posix/libc_fatal.c
+index f9e3425e04..089c47b04b 100644
+--- a/sysdeps/posix/libc_fatal.c
++++ b/sysdeps/posix/libc_fatal.c
+@@ -20,6 +20,7 @@
+ #include <errno.h>
+ #include <fcntl.h>
+ #include <ldsodefs.h>
++#include <libc-pointer-arith.h>
+ #include <paths.h>
+ #include <stdarg.h>
+ #include <stdbool.h>
+@@ -105,7 +106,8 @@ __libc_message_impl (const char *fmt, ...)
+ {
+ WRITEV_FOR_FATAL (fd, iov, iovcnt, total);
+
+- total = (total + 1 + GLRO(dl_pagesize) - 1) & ~(GLRO(dl_pagesize) - 1);
++ total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1,
++ GLRO(dl_pagesize));
+ struct abort_msg_s *buf = __mmap (NULL, total,
+ PROT_READ | PROT_WRITE,
+ MAP_ANON | MAP_PRIVATE, -1, 0);
+--
+2.46.0
+
