From 4c0d7aad439e0aaabbd799daf8afa6dc2fdea7e2 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Tue, 28 Jul 2026 08:53:02 +0000 Subject: [PATCH] sort: fix heap buffer under-read CVE-2025-5278 Backport upstream fix for CVE-2025-5278 (sort: heap buffer under-read CWE-127) to coreutils-8.30. The fix adds proper bounds-checked pointer arithmetic in sort's begfield_uni and limfield_uni functions, replacing unsafe MIN(lim, ptr + offset) with a remaining_bytes check. A new test case (tests/misc/sort-field-limit.sh) is included. CVE: CVE-2025-5278 Upstream patches: - https://github.com/coreutils/coreutils/commit/8c9602e3a145e9596dc1a63c6ed67865814b6633.patch Resolves: RHEL-216927 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- coreutils-8.30-CVE-2025-5278.patch | 104 +++++++++++++++++++++++++++++ coreutils.spec | 9 ++- 2 files changed, 112 insertions(+), 1 deletion(-) create mode 100644 coreutils-8.30-CVE-2025-5278.patch diff --git a/coreutils-8.30-CVE-2025-5278.patch b/coreutils-8.30-CVE-2025-5278.patch new file mode 100644 index 0000000..1508ab7 --- /dev/null +++ b/coreutils-8.30-CVE-2025-5278.patch @@ -0,0 +1,104 @@ +From 77e832339494a93b8cf2e19e177c3a71494cbf87 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?P=C3=A1draig=20Brady?= +Date: Tue, 20 May 2025 16:03:44 +0100 +Subject: [PATCH] sort: fix buffer under-read (CWE-127) + +* src/sort.c (begfield): Check pointer adjustment +to avoid Out-of-range pointer offset (CWE-823). +(limfield): Likewise. +* tests/sort/sort-field-limit.sh: Add a new test, +which triggers with ASAN or Valgrind. +* tests/local.mk: Reference the new test. +Fixes https://bugs.gnu.org/78507 + +(cherry picked from commit 8c9602e3a145e9596dc1a63c6ed67865814b6633) +--- + src/sort.c | 12 ++++++++++-- + tests/local.mk | 1 + + tests/misc/sort-field-limit.sh | 35 ++++++++++++++++++++++++++++++++++ + 3 files changed, 46 insertions(+), 2 deletions(-) + create mode 100755 tests/misc/sort-field-limit.sh + +diff --git a/src/sort.c b/src/sort.c +index 9abab9d..a24ddb5 100644 +--- a/src/sort.c ++++ b/src/sort.c +@@ -1786,7 +1786,11 @@ begfield_uni (const struct line *line, const struct keyfield *key) + ++ptr; + + /* Advance PTR by SCHAR (if possible), but no further than LIM. */ +- ptr = MIN (lim, ptr + schar); ++ size_t remaining_bytes = lim - ptr; ++ if (schar < remaining_bytes) ++ ptr += schar; ++ else ++ ptr = lim; + + return ptr; + } +@@ -1946,7 +1950,11 @@ limfield_uni (const struct line *line, const struct keyfield *key) + ++ptr; + + /* Advance PTR by ECHAR (if possible), but no further than LIM. */ +- ptr = MIN (lim, ptr + echar); ++ size_t remaining_bytes = lim - ptr; ++ if (echar < remaining_bytes) ++ ptr += echar; ++ else ++ ptr = lim; + } + + return ptr; +diff --git a/tests/local.mk b/tests/local.mk +index 1f19f1b..7118703 100644 +--- a/tests/local.mk ++++ b/tests/local.mk +@@ -361,6 +361,7 @@ all_tests = \ + tests/misc/sort-debug-keys.sh \ + tests/misc/sort-debug-warn.sh \ + tests/misc/sort-discrim.sh \ ++ tests/misc/sort-field-limit.sh \ + tests/misc/sort-files0-from.pl \ + tests/misc/sort-float.sh \ + tests/misc/sort-mb-tests.sh \ +diff --git a/tests/misc/sort-field-limit.sh b/tests/misc/sort-field-limit.sh +new file mode 100755 +index 0000000..52d8e1d +--- /dev/null ++++ b/tests/misc/sort-field-limit.sh +@@ -0,0 +1,35 @@ ++#!/bin/sh ++# From 7.2-9.7, this would trigger an out of bounds mem read ++ ++# Copyright (C) 2025 Free Software Foundation, Inc. ++ ++# This program is free software: you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation, either version 3 of the License, or ++# (at your option) any later version. ++ ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++ ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++ ++. "${srcdir=.}/tests/init.sh"; path_prepend_ ./src ++print_ver_ sort ++getlimits_ ++ ++# This issue triggers with valgrind or ASAN ++valgrind --error-exitcode=1 sort --version 2>/dev/null && ++ VALGRIND='valgrind --error-exitcode=1' ++ ++{ printf '%s\n' aa bb; } > in || framework_failure_ ++ ++_POSIX2_VERSION=200809 $VALGRIND sort +0.${SIZE_MAX}R in > out || fail=1 ++compare in out || fail=1 ++ ++_POSIX2_VERSION=200809 $VALGRIND sort +1 -1.${SIZE_MAX}R in > out || fail=1 ++compare in out || fail=1 ++ ++Exit $fail diff --git a/coreutils.spec b/coreutils.spec index 9b8d129..304e051 100644 --- a/coreutils.spec +++ b/coreutils.spec @@ -1,7 +1,7 @@ Summary: A set of basic GNU tools commonly used in shell scripts Name: coreutils Version: 8.30 -Release: 20%{?dist} +Release: 21%{?dist} License: GPLv3+ Group: System Environment/Base Url: https://www.gnu.org/software/coreutils/ @@ -107,6 +107,10 @@ Patch908: coreutils-getgrouplist.patch #(upstream did some SELinux implementation unlike with RedHat patch) Patch950: coreutils-selinux.patch +# sort: fix buffer under-read (CVE-2025-5278) +# https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633 +Patch951: coreutils-8.30-CVE-2025-5278.patch + Conflicts: filesystem < 3 # To avoid clobbering installs Conflicts: coreutils-single @@ -296,6 +300,9 @@ fi %license COPYING %changelog +* Tue Jul 28 2026 RHEL Packaging Agent - 8.30-21 +- sort: fix buffer under-read CVE-2025-5278 (RHEL-216927) + * Wed Jun 10 2026 Lukáš Zaoral - 8.30-20 - unexpand: fix heap overflow when a wide blank overshoots a tab stop (RHEL-182699)