Skip to content

Commit 985e0b7

Browse files
Kanishk-BansalKanishk Bansal
andauthored
Fix : patch application of CVE-2025-4802 in glibc (microsoft#14582)
Signed-off-by: Kanishk Bansal <[email protected]> Co-authored-by: Kanishk Bansal <[email protected]>
1 parent 6a0fb93 commit 985e0b7

File tree

22 files changed

+346
-77
lines changed

22 files changed

+346
-77
lines changed

SPECS-EXTENDED/buildah/buildah.spec

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
Summary: A command line tool used for creating OCI Images
2222
Name: buildah
2323
Version: 1.18.0
24-
Release: 31%{?dist}
24+
Release: 32%{?dist}
2525
License: ASL 2.0
2626
Vendor: Microsoft Corporation
2727
Distribution: Azure Linux
@@ -32,7 +32,7 @@ BuildRequires: btrfs-progs-devel
3232
BuildRequires: device-mapper-devel
3333
BuildRequires: git
3434
BuildRequires: glib2-devel
35-
BuildRequires: glibc-static >= 2.38-11%{?dist}
35+
BuildRequires: glibc-static >= 2.38-12%{?dist}
3636
BuildRequires: go-md2man
3737
BuildRequires: go-rpm-macros
3838
BuildRequires: golang
@@ -123,6 +123,9 @@ cp imgtype %{buildroot}/%{_bindir}/%{name}-imgtype
123123
%{_datadir}/%{name}/test
124124

125125
%changelog
126+
* Thu Aug 28 2025 Kanishk Bansal <[email protected]> - 1.18.0-32
127+
- Bump to rebuild with updated glibc
128+
126129
* Thu May 22 2025 Kanishk Bansal <[email protected]> - 1.18.0-31
127130
- Bump to rebuild with updated glibc
128131

SPECS-EXTENDED/catatonit/catatonit.spec

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Distribution: Azure Linux
33

44
Name: catatonit
55
Version: 0.1.7
6-
Release: 19%{?dist}
6+
Release: 20%{?dist}
77
Summary: A signal-forwarding process manager for containers
88
License: GPLv3+
99
URL: https://github.com/openSUSE/catatonit
@@ -13,7 +13,7 @@ BuildRequires: automake
1313
BuildRequires: file
1414
BuildRequires: gcc
1515
BuildRequires: git
16-
BuildRequires: glibc-static >= 2.38-11%{?dist}
16+
BuildRequires: glibc-static >= 2.38-12%{?dist}
1717
BuildRequires: libtool
1818
BuildRequires: make
1919

@@ -61,6 +61,9 @@ ln -s %{_libexecdir}/%{name}/%{name} %{buildroot}%{_libexecdir}/podman/%{name}
6161
%{_libexecdir}/podman/%{name}
6262

6363
%changelog
64+
* Thu Aug 28 2025 Kanishk Bansal <[email protected]> - 0.1.7-20
65+
- Bump to rebuild with updated glibc
66+
6467
* Thu May 22 2025 Kanishk Bansal <[email protected]> - 0.1.7-19
6568
- Bump to rebuild with updated glibc
6669

SPECS-EXTENDED/dyninst/dyninst.spec

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: An API for Run-time Code Generation
22
License: LGPLv2+
33
Name: dyninst
4-
Release: 21%{?dist}
4+
Release: 22%{?dist}
55
Vendor: Microsoft Corporation
66
Distribution: Azure Linux
77
URL: http://www.dyninst.org
@@ -31,7 +31,7 @@ BuildRequires: tbb tbb-devel
3131

3232
# Extra requires just for the testsuite
3333
BuildRequires: gcc-gfortran libstdc++-static libxml2-devel
34-
BuildRequires: glibc-static >= 2.38-11%{?dist}
34+
BuildRequires: glibc-static >= 2.38-12%{?dist}
3535

3636
# Testsuite files should not provide/require anything
3737
%{?filter_setup:
@@ -194,6 +194,9 @@ echo "%{_libdir}/dyninst" > %{buildroot}/etc/ld.so.conf.d/%{name}-%{_arch}.conf
194194
%attr(644,root,root) %{_libdir}/dyninst/testsuite/*.a
195195

196196
%changelog
197+
* Thu Aug 28 2025 Kanishk Bansal <[email protected]> - 10.1.0-22
198+
- Bump to rebuild with updated glibc
199+
197200
* Thu May 22 2025 Kanishk Bansal <[email protected]> - 10.1.0-21
198201
- Bump to rebuild with updated glibc
199202

SPECS-EXTENDED/podman/podman.spec

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535

3636
Name: podman
3737
Version: 4.1.1
38-
Release: 29%{?dist}
38+
Release: 30%{?dist}
3939
License: ASL 2.0 and BSD and ISC and MIT and MPLv2.0
4040
Summary: Manage Pods, Containers and Container Images
4141
Vendor: Microsoft Corporation
@@ -50,7 +50,7 @@ BuildRequires: go-md2man
5050
BuildRequires: golang
5151
BuildRequires: gcc
5252
BuildRequires: glib2-devel
53-
BuildRequires: glibc-static >= 2.38-11%{?dist}
53+
BuildRequires: glibc-static >= 2.38-12%{?dist}
5454
BuildRequires: git
5555
BuildRequires: go-rpm-macros
5656
BuildRequires: gpgme-devel
@@ -386,6 +386,9 @@ cp -pav test/system %{buildroot}/%{_datadir}/%{name}/test/
386386

387387
# rhcontainerbot account currently managed by lsm5
388388
%changelog
389+
* Thu Aug 28 2025 Kanishk Bansal <[email protected]> - 4.1.1-30
390+
- Bump to rebuild with updated glibc
391+
389392
* Thu May 22 2025 Kanishk Bansal <[email protected]> - 4.1.1-29
390393
- Bump to rebuild with updated glibc
391394

SPECS/busybox/busybox.spec

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Statically linked binary providing simplified versions of system commands
22
Name: busybox
33
Version: 1.36.1
4-
Release: 14%{?dist}
4+
Release: 15%{?dist}
55
License: GPLv2
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -19,7 +19,7 @@ Patch5: CVE-2023-42366.patch
1919
Patch6: CVE-2023-39810.patch
2020
Patch7: CVE-2022-48174.patch
2121
BuildRequires: gcc
22-
BuildRequires: glibc-static >= 2.38-11%{?dist}
22+
BuildRequires: glibc-static >= 2.38-12%{?dist}
2323
BuildRequires: libselinux-devel >= 1.27.7-2
2424
BuildRequires: libsepol-devel
2525
%if 0%{?with_check}
@@ -106,6 +106,9 @@ SKIP_KNOWN_BUGS=1 ./runtest
106106
%{_mandir}/man1/busybox.petitboot.1.gz
107107

108108
%changelog
109+
* Thu Aug 28 2025 Kanishk Bansal <[email protected]> - 1.36.1-15
110+
- Bump to rebuild with updated glibc
111+
109112
* Mon Jul 07 2025 Kanishk Bansal <[email protected]> - 1.36.1-14
110113
- Patch CVE-2022-48174
111114

SPECS/flannel/flannel.spec

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Summary: Simple and easy way to configure a layer 3 network fabric designed for Kubernetes
44
Name: flannel
55
Version: 0.24.2
6-
Release: 16%{?dist}
6+
Release: 17%{?dist}
77
License: ASL 2.0
88
Vendor: Microsoft Corporation
99
Distribution: Azure Linux
@@ -18,7 +18,7 @@ Patch3: CVE-2025-30204.patch
1818
Patch4: CVE-2024-51744.patch
1919
BuildRequires: gcc
2020
BuildRequires: glibc-devel
21-
BuildRequires: glibc-static >= 2.38-11%{?dist}
21+
BuildRequires: glibc-static >= 2.38-12%{?dist}
2222
BuildRequires: golang < 1.25
2323
BuildRequires: kernel-headers
2424

@@ -52,6 +52,9 @@ install -p -m 755 -t %{buildroot}%{_bindir} ./dist/flanneld
5252
%{_bindir}/flanneld
5353

5454
%changelog
55+
* Thu Aug 28 2025 Kanishk Bansal <[email protected]> - 0.24.2-17
56+
- Bump to rebuild with updated glibc
57+
5558
* Sun Aug 31 2025 Andrew Phelps <[email protected]> - 0.24.2-16
5659
- Set BR for golang to < 1.25
5760

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
From 4335cd9b58d1449abfba1bb5060970785940a399 Mon Sep 17 00:00:00 2001
2+
From: Florian Weimer <[email protected]>
3+
Date: Mon, 23 Dec 2024 13:57:55 +0100
4+
Subject: [PATCH] support: Add support_record_failure_barrier
5+
6+
This can be used to stop execution after a TEST_COMPARE_BLOB
7+
failure, for example.
8+
9+
(cherry picked from commit d0b8aa6de4529231fadfe604ac2c434e559c2d9e)
10+
---
11+
support/check.h | 3 +++
12+
support/support_record_failure.c | 10 ++++++++++
13+
2 files changed, 13 insertions(+)
14+
15+
diff --git a/support/check.h b/support/check.h
16+
index 0a9fff484f..632fe5298a 100644
17+
--- a/support/check.h
18+
+++ b/support/check.h
19+
@@ -207,6 +207,9 @@ void support_record_failure_reset (void);
20+
failures or not. */
21+
int support_record_failure_is_failed (void);
22+
23+
+/* Terminate the process if any failures have been encountered so far. */
24+
+void support_record_failure_barrier (void);
25+
+
26+
__END_DECLS
27+
28+
#endif /* SUPPORT_CHECK_H */
29+
diff --git a/support/support_record_failure.c b/support/support_record_failure.c
30+
index 711f08801b..8466b895dc 100644
31+
--- a/support/support_record_failure.c
32+
+++ b/support/support_record_failure.c
33+
@@ -112,3 +112,13 @@ support_record_failure_is_failed (void)
34+
synchronization for reliable test error reporting anyway. */
35+
return __atomic_load_n (&state->failed, __ATOMIC_RELAXED);
36+
}
37+
+
38+
+void
39+
+support_record_failure_barrier (void)
40+
+{
41+
+ if (__atomic_load_n (&state->failed, __ATOMIC_RELAXED))
42+
+ {
43+
+ puts ("error: exiting due to previous errors");
44+
+ exit (1);
45+
+ }
46+
+}
47+
--
48+
2.43.7
49+

SPECS/glibc/glibc.spec

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
Summary: Main C library
1111
Name: glibc
1212
Version: 2.38
13-
Release: 11%{?dist}
13+
Release: 12%{?dist}
1414
License: BSD AND GPLv2+ AND Inner-Net AND ISC AND LGPLv2+ AND MIT
1515
Vendor: Microsoft Corporation
1616
Distribution: Azure Linux
@@ -45,6 +45,10 @@ Patch16: CVE-2024-33600.patch
4545
# Patch of CVE-2024-33601 fixes CVE-2024-33602 also
4646
Patch17: CVE-2024-33601.patch
4747
Patch18: CVE-2025-0395.patch
48+
Patch19: CVE-2025-4802.patch
49+
# Add test for CVE-2025-4802. Requires additional patch for a support function
50+
Patch20: add_support_record_failure_barrier.patch
51+
Patch21: test-CVE-2025-4802.patch
4852

4953
# Patches for testing
5054
Patch100: 0001-Remove-Wno-format-cflag-from-tests.patch
@@ -367,6 +371,10 @@ grep "^FAIL: nptl/tst-mutex10" tests.sum >/dev/null && n=$((n+1)) ||:
367371
%exclude %{_libdir}/locale/C.utf8
368372

369373
%changelog
374+
* Thu Aug 28 2025 Kanishk Bansal <[email protected]> - 2.38-12
375+
- Fix Patch application of CVE-2025-4802
376+
- Add test for CVE-2025-4802
377+
370378
* Thu May 22 2025 Kanishk Bansal <[email protected]> - 2.38-11
371379
- Patch CVE-2023-4527, CVE-2023-4806, CVE-2024-33599, CVE-2024-33600, CVE-2024-33601, CVE-2025-0395, CVE-2025-4802
372380
- Fix CVE-2023-5156

0 commit comments

Comments
 (0)