From 5ba7dd7489dc2ad102234a9d692382eced7c3e25 Mon Sep 17 00:00:00 2001 From: Jan Friesse Date: Fri, 4 Sep 2026 14:24:34 +0200 Subject: [PATCH] - Resolves: RHEL-251544 - totempg: Replace assert with check in deliver_fn (fixes CVE-2026-81665) Signed-off-by: Jan Friesse --- ...lace-assert-with-check-in-deliver_fn.patch | 46 +++++++++++++++++++ corosync.spec | 8 +++- 2 files changed, 53 insertions(+), 1 deletion(-) create mode 100644 RHEL-251544-totempg-Replace-assert-with-check-in-deliver_fn.patch diff --git a/RHEL-251544-totempg-Replace-assert-with-check-in-deliver_fn.patch b/RHEL-251544-totempg-Replace-assert-with-check-in-deliver_fn.patch new file mode 100644 index 0000000..257e64f --- /dev/null +++ b/RHEL-251544-totempg-Replace-assert-with-check-in-deliver_fn.patch @@ -0,0 +1,46 @@ +From 5148bf07dffa61bcfa92ca2c058e7d0f0a981cf3 Mon Sep 17 00:00:00 2001 +From: Jan Friesse +Date: Wed, 2 Sep 2026 15:53:33 +0200 +Subject: [PATCH] totempg: Replace assert with check in deliver_fn + +If assert() is compiled out in release builds, a +new message could be appended past the end of the assembly buffer, +resulting in a buffer overflow. + +To prevent this, replace the assertion with a standard runtime bounds +check. If the incoming message exceeds the maximum buffer size, it is +now safely logged and ignored. + +Fixes: CVE-2026-81665 + +Reported-by: Tristan Madani +Signed-off-by: Jan Friesse +Reviewed-by: Tristan Madani +Reviewed-by: Fabio M. Di Nitto +--- + exec/totempg.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/exec/totempg.c b/exec/totempg.c +index d9beb899..b086bad9 100644 +--- a/exec/totempg.c ++++ b/exec/totempg.c +@@ -659,7 +659,14 @@ static void totempg_deliver_fn ( + return ; + } + +- assert((assembly->index+msg_len) < sizeof(assembly->data)); ++ if (assembly->index + msg_len >= sizeof(assembly->data)) { ++ log_printf(LOG_WARNING, ++ "Message (totempg_mcast) received from node " CS_PRI_NODE_ID ++ " would create too long message of %u bytes... Ignoring.", ++ nodeid, assembly->index + msg_len); ++ ++ return ; ++ } + memcpy (&assembly->data[assembly->index], &data[datasize], + msg_len - datasize); + +-- +2.47.3 + diff --git a/corosync.spec b/corosync.spec index ecd6e11..98d5a23 100644 --- a/corosync.spec +++ b/corosync.spec @@ -15,13 +15,14 @@ Name: corosync Summary: The Corosync Cluster Engine and Application Programming Interfaces Version: 3.1.10 -Release: 2%{?dist} +Release: 3%{?dist} License: BSD-3-Clause URL: http://corosync.github.io/corosync/ Source0: https://github.com/%{name}/%{name}/releases/download/v%{version}/%{name}-%{version}%{?gittarver}.tar.gz Patch0: RHEL-163817-totemsrp-Return-error-if-sanity-check-fails.patch Patch1: RHEL-163838-totemsrp-Fix-integer-overflow-in-memb_join_sanity.patch +Patch2: RHEL-251544-totempg-Replace-assert-with-check-in-deliver_fn.patch # Runtime bits # The automatic dependency overridden in favor of explicit version lock @@ -292,6 +293,11 @@ network splits) %endif %changelog +* Fri Sep 04 2026 Jan Friesse - 3.1.10-3 +- Resolves: RHEL-251544 + +- totempg: Replace assert with check in deliver_fn (fixes CVE-2026-81665) + * Thu Apr 09 2026 Jan Friesse - 3.1.10-2 - Resolves: RHEL-163817 - Resolves: RHEL-163838