Patch memcached for CVE-2021-43519 (#12229)

Co-authored-by: Sam Meluch <[email protected]>
Co-authored-by: KavyaSree2610 <[email protected]>
Co-authored-by: jslobodzian <[email protected]>

Author: 4 people

SPECS/memcached/CVE-2021-43519.patch

@@ -0,0 +1,39 @@
+From 1bab87b86d590c50057a5c3b48a00caf1cff807e Mon Sep 17 00:00:00 2001
+From: Kanishk Bansal <[email protected]>
+Date: Wed, 5 Feb 2025 09:27:34 +0000
+Subject: [PATCH] Address CVE-2021-43519
+
+---
+ vendor/lua/src/ldo.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/vendor/lua/src/ldo.c b/vendor/lua/src/ldo.c
+index 7135079..ca558fd 100644
+--- a/vendor/lua/src/ldo.c
++++ b/vendor/lua/src/ldo.c
+@@ -728,11 +728,10 @@ static void resume (lua_State *L, void *ud) {
+   StkId firstArg = L->top - n;  /* first argument */
+   CallInfo *ci = L->ci;
+   if (L->status == LUA_OK)  /* starting a coroutine? */
+-    ccall(L, firstArg - 1, LUA_MULTRET, 1);  /* just call its body */
++    ccall(L, firstArg - 1, LUA_MULTRET, 0);  /* just call its body */
+   else {  /* resuming from previous yield */
+     lua_assert(L->status == LUA_YIELD);
+     L->status = LUA_OK;  /* mark that it is running (again) */
+-    luaE_incCstack(L);  /* control the C stack */
+     if (isLua(ci)) {  /* yielded inside a hook? */
+       L->top = firstArg;  /* discard arguments */
+       luaV_execute(L, ci);  /* just continue running Lua code */
+@@ -783,6 +782,9 @@ LUA_API int lua_resume (lua_State *L, lua_State *from, int nargs,
+   else if (L->status != LUA_YIELD)  /* ended with errors? */
+     return resume_error(L, "cannot resume dead coroutine", nargs);
+   L->nCcalls = (from) ? getCcalls(from) : 0;
++  if (getCcalls(L) >= LUAI_MAXCCALLS)
++    return resume_error(L, "C stack overflow", nargs);
++  L->nCcalls++;
+   luai_userstateresume(L, nargs);
+   api_checknelems(L, (L->status == LUA_OK) ? nargs + 1 : nargs);
+   status = luaD_rawrunprotected(L, resume, &nargs);
+-- 
+2.43.0
+

SPECS/memcached/memcached.spec

@@ -7,14 +7,15 @@
 Summary:        High Performance, Distributed Memory Object Cache
 Name:           memcached
 Version:        1.6.27
-Release:        1%{?dist}
+Release:        2%{?dist}
 License:        BSD
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
 URL:            https://www.memcached.org/
 Source0:        https://www.memcached.org/files/%{name}-%{version}.tar.gz
 Source1:        memcached.sysconfig
 Patch0:         memcached-unit.patch
+Patch1:         CVE-2021-43519.patch
 BuildRequires:  gcc
 BuildRequires:  libevent-devel
 BuildRequires:  systemd-devel
@@ -129,6 +130,9 @@ exit 0
 %{_unitdir}/memcached.service
 
 %changelog
+* Wed Feb 05 2025 Kanishk Bansal <[email protected]> - 1.6.27-2
+- Address CVE-2021-43519
+
 * Wed May 08 2024 Osama Esmail <[email protected]> - 1.6.27-1
 - Upgrading to 1.6.27
 - Separating out memcached-service into a subpackage