rpms/corosync
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Resolves: RHEL-251544

Browse Source 
- totempg: Replace assert with check in deliver_fn
  (fixes CVE-2026-81665)

Signed-off-by: Jan Friesse <jfriesse@redhat.com>
This commit is contained in:
Jan Friesse 2026-09-04 14:24:34 +02:00
parent f7b7f4f0c9
commit 5ba7dd7489
2 changed files with 53 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
RHEL-251544-totempg-Replace-assert-with-check-in-deliver_fn.patch Normal file
View File

@ -0,0 +1,46 @@
From 5148bf07dffa61bcfa92ca2c058e7d0f0a981cf3 Mon Sep 17 00:00:00 2001
From: Jan Friesse <jfriesse@redhat.com>
Date: Wed, 2 Sep 2026 15:53:33 +0200
Subject: [PATCH] totempg: Replace assert with check in deliver_fn
If assert() is compiled out in release builds, a
new message could be appended past the end of the assembly buffer,
resulting in a buffer overflow.
To prevent this, replace the assertion with a standard runtime bounds
check. If the incoming message exceeds the maximum buffer size, it is
now safely logged and ignored.
Fixes: CVE-2026-81665
Reported-by: Tristan Madani <tristan@talencesecurity.com>
Signed-off-by: Jan Friesse <jfriesse@redhat.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Fabio M. Di Nitto <fdinitto@redhat.com>
---
exec/totempg.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/exec/totempg.c b/exec/totempg.c
index d9beb899..b086bad9 100644
--- a/exec/totempg.c
+++ b/exec/totempg.c
@@ -659,7 +659,14 @@ static void totempg_deliver_fn (
return ;
}
- assert((assembly->index+msg_len) < sizeof(assembly->data));
+ if (assembly->index + msg_len >= sizeof(assembly->data)) {
+ log_printf(LOG_WARNING,
+ "Message (totempg_mcast) received from node " CS_PRI_NODE_ID
+ " would create too long message of %u bytes... Ignoring.",
+ nodeid, assembly->index + msg_len);
+
+ return ;
+ }
memcpy (&assembly->data[assembly->index], &data[datasize],
msg_len - datasize);
--
2.47.3

8
corosync.spec
View File

@ -15,13 +15,14 @@
Name: corosync
Summary: The Corosync Cluster Engine and Application Programming Interfaces
Version: 3.1.10
Release: 2%{?dist}
Release: 3%{?dist}
License: BSD-3-Clause
URL: http://corosync.github.io/corosync/
Source0: https://github.com/%{name}/%{name}/releases/download/v%{version}/%{name}-%{version}%{?gittarver}.tar.gz
Patch0: RHEL-163817-totemsrp-Return-error-if-sanity-check-fails.patch
Patch1: RHEL-163838-totemsrp-Fix-integer-overflow-in-memb_join_sanity.patch
Patch2: RHEL-251544-totempg-Replace-assert-with-check-in-deliver_fn.patch
# Runtime bits
# The automatic dependency overridden in favor of explicit version lock
@ -292,6 +293,11 @@ network splits)
%endif
%changelog
* Fri Sep 04 2026 Jan Friesse <jfriesse@redhat.com> - 3.1.10-3
- Resolves: RHEL-251544
- totempg: Replace assert with check in deliver_fn (fixes CVE-2026-81665)
* Thu Apr 09 2026 Jan Friesse <jfriesse@redhat.com> - 3.1.10-2
- Resolves: RHEL-163817
- Resolves: RHEL-163838