From bc82731a17707c2e888481944eaa644f1c5b7d9a Mon Sep 17 00:00:00 2001 From: Jan Friesse Date: Fri, 4 Sep 2026 14:33:26 +0200 Subject: [PATCH] - Resolves: RHEL-251531 - totempg: Replace assert with check in deliver_fn (fixes CVE-2026-81665) Signed-off-by: Jan Friesse --- ...lace-assert-with-check-in-deliver_fn.patch | 46 +++++++++++++++++++ corosync.spec | 9 +++- 2 files changed, 54 insertions(+), 1 deletion(-) create mode 100644 RHEL-251531-totempg-Replace-assert-with-check-in-deliver_fn.patch diff --git a/RHEL-251531-totempg-Replace-assert-with-check-in-deliver_fn.patch b/RHEL-251531-totempg-Replace-assert-with-check-in-deliver_fn.patch new file mode 100644 index 0000000..257e64f --- /dev/null +++ b/RHEL-251531-totempg-Replace-assert-with-check-in-deliver_fn.patch @@ -0,0 +1,46 @@ +From 5148bf07dffa61bcfa92ca2c058e7d0f0a981cf3 Mon Sep 17 00:00:00 2001 +From: Jan Friesse +Date: Wed, 2 Sep 2026 15:53:33 +0200 +Subject: [PATCH] totempg: Replace assert with check in deliver_fn + +If assert() is compiled out in release builds, a +new message could be appended past the end of the assembly buffer, +resulting in a buffer overflow. + +To prevent this, replace the assertion with a standard runtime bounds +check. If the incoming message exceeds the maximum buffer size, it is +now safely logged and ignored. + +Fixes: CVE-2026-81665 + +Reported-by: Tristan Madani +Signed-off-by: Jan Friesse +Reviewed-by: Tristan Madani +Reviewed-by: Fabio M. Di Nitto +--- + exec/totempg.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/exec/totempg.c b/exec/totempg.c +index d9beb899..b086bad9 100644 +--- a/exec/totempg.c ++++ b/exec/totempg.c +@@ -659,7 +659,14 @@ static void totempg_deliver_fn ( + return ; + } + +- assert((assembly->index+msg_len) < sizeof(assembly->data)); ++ if (assembly->index + msg_len >= sizeof(assembly->data)) { ++ log_printf(LOG_WARNING, ++ "Message (totempg_mcast) received from node " CS_PRI_NODE_ID ++ " would create too long message of %u bytes... Ignoring.", ++ nodeid, assembly->index + msg_len); ++ ++ return ; ++ } + memcpy (&assembly->data[assembly->index], &data[datasize], + msg_len - datasize); + +-- +2.47.3 + diff --git a/corosync.spec b/corosync.spec index 5da9d52..96cad21 100644 --- a/corosync.spec +++ b/corosync.spec @@ -23,13 +23,14 @@ Name: corosync Summary: The Corosync Cluster Engine and Application Programming Interfaces Version: 3.1.8 -Release: 1%{?gitver}%{?dist}.1 +Release: 1%{?gitver}%{?dist}.2 License: BSD URL: http://corosync.github.io/corosync/ Source0: http://build.clusterlabs.org/corosync/releases/%{name}-%{version}%{?gittarver}.tar.gz Patch0: RHEL-163805-totemsrp-Return-error-if-sanity-check-fails.patch Patch1: RHEL-163826-totemsrp-Fix-integer-overflow-in-memb_join_sanity.patch +Patch2: RHEL-251531-totempg-Replace-assert-with-check-in-deliver_fn.patch %if %{with spausedd} Source1: https://github.com/jfriesse/spausedd/releases/download/%{spausedd_version}/spausedd-%{spausedd_version}.tar.gz @@ -96,6 +97,7 @@ BuildRequires: pkgconfig(vmguestlib) %patch0 -p1 -b .RHEL-163805 %patch1 -p1 -b .RHEL-163826 +%patch2 -p1 -b .RHEL-251531 %build %if %{with runautogen} @@ -395,6 +397,11 @@ fi %endif %changelog +* Fri Sep 04 2026 Jan Friesse - 3.1.8-1.2 +- Resolves: RHEL-251531 + +- totempg: Replace assert with check in deliver_fn (fixes CVE-2026-81665) + * Fri Apr 10 2026 Jan Friesse - 3.1.8-1.1 - Resolves: RHEL-163805 - Resolves: RHEL-163826