From 7f444a972b8adb87eaaa1bd7d2425c8f694f989b Mon Sep 17 00:00:00 2001
From: Arjun Shankar <arjun@redhat.com>
Date: Fri, 28 Mar 2025 00:20:52 +0100
Subject: [PATCH] nscd: Fix an unlikely TTL issue in the netgroup cache
 (RHEL-35280)

Resolves: RHEL-35280
---
 glibc-RHEL-35280.patch | 30 ++++++++++++++++++++++++++++++
 glibc.spec             |  6 +++++-
 2 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 glibc-RHEL-35280.patch

diff --git a/glibc-RHEL-35280.patch b/glibc-RHEL-35280.patch
new file mode 100644
index 0000000..f8fedf4
--- /dev/null
+++ b/glibc-RHEL-35280.patch
@@ -0,0 +1,30 @@
+commit 4bbca1a44691a6e9adcee5c6798a707b626bc331
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Thu May 2 17:06:19 2024 +0200
+
+    nscd: Use time_t for return type of addgetnetgrentX
+    
+    Using int may give false results for future dates (timeouts after the
+    year 2028).
+    
+    Fixes commit 04a21e050d64a1193a6daab872bca2528bda44b ("CVE-2024-33601,
+    CVE-2024-33602: nscd: netgroup: Use two buffers in addgetnetgrentX
+    (bug 31680)").
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+
+diff --git a/nscd/netgroupcache.c b/nscd/netgroupcache.c
+index dd180f8083e7c9f9..b118b55af2d7c9a0 100644
+--- a/nscd/netgroupcache.c
++++ b/nscd/netgroupcache.c
+@@ -681,8 +681,8 @@ readdinnetgr (struct database_dyn *db, struct hashentry *he,
+       .key_len = he->len
+     };
+ 
+-  int timeout = addinnetgrX (db, -1, &req, db->data + he->key, he->owner,
+-			     he, dh);
++  time_t timeout = addinnetgrX (db, -1, &req, db->data + he->key, he->owner,
++				he, dh);
+   if (timeout < 0)
+     timeout = 0;
+   return timeout;
diff --git a/glibc.spec b/glibc.spec
index aa414e1..30ed19a 100644
--- a/glibc.spec
+++ b/glibc.spec
@@ -115,7 +115,7 @@ end \
 Summary: The GNU libc libraries
 Name: glibc
 Version: %{glibcversion}
-Release: %{glibcrelease}.15
+Release: %{glibcrelease}.16
 
 # In general, GPLv2+ is used by programs, LGPLv2+ is used for
 # libraries.
@@ -1261,6 +1261,7 @@ Patch1026: glibc-RHEL-8381-10.patch
 Patch1027: glibc-RHEL-78390.patch
 Patch1028: glibc-RHEL-83306-1.patch
 Patch1029: glibc-RHEL-83306-2.patch
+Patch1030: glibc-RHEL-35280.patch
 
 ##############################################################################
 # Continued list of core "glibc" package information:
@@ -2922,6 +2923,9 @@ fi
 %{_libdir}/libpthread_nonshared.a
 
 %changelog
+* Thu Mar 27 2025 Arjun Shankar <arjun@redhat.com> - 2.28-251.16
+- nscd: Fix an unlikely TTL issue in the netgroup cache (RHEL-35280)
+
 * Thu Mar 20 2025 Arjun Shankar <arjun@redhat.com> - 2.28-251.15
 - CVE-2025-0395: Fix a buffer overflow in assert (RHEL-83306)