diff --git a/glibc.spec b/glibc.spec
index 485042c..1469e0c 100644
--- a/glibc.spec
+++ b/glibc.spec
@@ -1,6 +1,6 @@
-%define glibcsrcdir glibc-2.28.9000-319-gce035c6e90
+%define glibcsrcdir glibc-2.28.9000-345-g7b36d26b22
 %define glibcversion 2.28.9000
-%define glibcrelease 23%{?dist}
+%define glibcrelease 24%{?dist}
 # Pre-release tarballs are pulled in from git using a command that is
 # effectively:
 #
@@ -1905,6 +1905,18 @@ fi
 %files -f compat-libpthread-nonshared.filelist -n compat-libpthread-nonshared
 
 %changelog
+* Mon Dec 03 2018 Florian Weimer <fweimer@redhat.com> - 2.28.9000-24
+- Auto-sync with upstream branch master,
+  commit 7b36d26b22d147ffc347f427f9fd584700578a94:
+- CVE-2018-19591: if_nametoindex: Fix descriptor for overlong name (#1654000)
+- Mutex: Add pthread mutex tunables
+- stdlib: assert on NULL function pointer in atexit etc. (swbz#20544)
+- Enable VDSO on i386 statically linked programs
+- posix: Use posix_spawn on system
+- posix: Use posix_spawn on popen (swbz#17490, swbz#22834)
+- Fix _dl_profile_fixup data-dependency issue (swbz#23690)
+- Enable VDSO for static linking on aarch64
+
 * Thu Nov 29 2018 Carlos O'Donell <carlos@redhat.com> - 2.28.9000-23
 - Move requirement on libgcc from glibc-devel to glibc (#1352973)
 
diff --git a/sources b/sources
index 8daabbe..c9121d1 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (glibc-2.28.9000-319-gce035c6e90.tar.xz) = 3252a00548fe841fd7948efd00a116266959850e6c1f5ba7477895d5b8864e66f0a5275fff9c119b547826f9cb15f076078b0814879f2df6131196a88c79ed30
+SHA512 (glibc-2.28.9000-345-g7b36d26b22.tar.xz) = 36c87c881c3af2910d87b6ef08bf488c07a4074d284c667caf82f4c1bf068583cbf0412b2e974f1a611944efccfbf9012e52ba11a958bc1c119060b50d284c7f