- Fix uint16_t overflow in FCGI demux record length (CVE-2026-55203)
Resolves: RHEL-211067 - Fix NULL pointer dereference in hpack_dht_insert() (CVE-2026-55204) Resolves: RHEL-211085
This commit is contained in:
Oyvind Albrigtsen
parent
ce5685395b
commit
2d1cf48b6d
@ -0,0 +1,37 @@
|
||||
From 5985276735777634d8c85f1d73bb7764aab0d6dd Mon Sep 17 00:00:00 2001
|
||||
From: Tristan Madani <tristan@talencesecurity.com>
|
||||
Date: Tue, 16 Jun 2026 10:46:03 +0200
|
||||
Subject: [PATCH] BUG/MEDIUM: mux-fcgi: fix uint16_t overflow in drl += drp
|
||||
|
||||
The FCGI demux record length field (drl) is uint16_t. In the
|
||||
ignore_record path, the expression "fconn->drl += fconn->drp" overflows
|
||||
to 0 when contentLength=65535 and paddingLength>=1. This causes the
|
||||
state machine to consider the record complete without consuming any
|
||||
buffer data. The remaining buffer contents are then parsed as new FCGI
|
||||
record headers.
|
||||
|
||||
The same drl+=drp pattern at lines 2382/2418/2475 is not affected
|
||||
because drl is guaranteed to be 0 at those points (all content bytes
|
||||
are consumed before reaching end_transfer).
|
||||
|
||||
Widen drl from uint16_t to uint32_t so that the addition of drp
|
||||
(uint8_t, max 255) cannot overflow.
|
||||
|
||||
Reported-by: Tristan (@TristanInSec)
|
||||
---
|
||||
src/mux_fcgi.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/mux_fcgi.c b/src/mux_fcgi.c
|
||||
index c956b58add56..8d81ff8499de 100644
|
||||
--- a/src/mux_fcgi.c
|
||||
+++ b/src/mux_fcgi.c
|
||||
@@ -54,7 +54,7 @@ struct fcgi_conn {
|
||||
uint32_t flags; /* Connection flags: FCGI_CF_* */
|
||||
|
||||
int16_t dsi; /* dmux stream ID (<0 = idle ) */
|
||||
- uint16_t drl; /* demux record length (if dsi >= 0) */
|
||||
+ uint32_t drl; /* demux record length (if dsi >= 0) */
|
||||
uint8_t drt; /* demux record type (if dsi >= 0) */
|
||||
uint8_t drp; /* demux record padding (if dsi >= 0) */
|
||||
|
||||
@ -0,0 +1,37 @@
|
||||
From 9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513 Mon Sep 17 00:00:00 2001
|
||||
From: Tristan Madani <tristan@talencesecurity.com>
|
||||
Date: Tue, 16 Jun 2026 10:42:10 +0200
|
||||
Subject: [PATCH] BUG/MINOR: hpack-tbl: add missing NULL check after
|
||||
hpack_dht_defrag()
|
||||
|
||||
hpack_dht_insert() has three call sites for hpack_dht_defrag(). Two of
|
||||
them (lines 293 and 306) correctly check for a NULL return and bail out
|
||||
with -1. The third (line 353, data-space defrag path) assigns the return
|
||||
value to dht and immediately dereferences it without a NULL check.
|
||||
|
||||
When pool_head_hpack_tbl is exhausted, hpack_dht_alloc() returns NULL,
|
||||
hpack_dht_defrag() propagates it, and line 354 dereferences NULL+0x0a
|
||||
(offsetof wrap), crashing the worker with SIGSEGV.
|
||||
|
||||
Add a NULL check consistent with the two other call sites.
|
||||
|
||||
This must be backported to all stable versions.
|
||||
|
||||
Reported-by: Tristan (@TristanInSec)
|
||||
---
|
||||
src/hpack-tbl.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/src/hpack-tbl.c b/src/hpack-tbl.c
|
||||
index 990d2f7ddf93..92a6f4435510 100644
|
||||
--- a/src/hpack-tbl.c
|
||||
+++ b/src/hpack-tbl.c
|
||||
@@ -351,6 +351,8 @@ int hpack_dht_insert(struct hpack_dht *dht, struct ist name, struct ist value)
|
||||
else {
|
||||
/* need to defragment the table before inserting upfront */
|
||||
dht = hpack_dht_defrag(dht);
|
||||
+ if (!dht)
|
||||
+ return -1;
|
||||
wrap = dht->wrap + 1;
|
||||
head = dht->head + 1;
|
||||
dht->dte[head].addr = dht->dte[dht->front].addr - (name.len + value.len);
|
||||
15
haproxy.spec
15
haproxy.spec
@ -8,7 +8,7 @@
|
||||
|
||||
Name: haproxy
|
||||
Version: 3.0.5
|
||||
Release: 7%{?dist}
|
||||
Release: 8%{?dist}
|
||||
Summary: HAProxy reverse proxy for high availability environments
|
||||
|
||||
License: GPL-2.0-or-later
|
||||
@ -23,6 +23,8 @@ Source5: %{name}.sysusers
|
||||
Source6: halog.1
|
||||
Patch0: RHEL-126653-CVE-2025-11230-fix-denial-of-service-vulnerability-in-mjson-library.patch
|
||||
Patch1: RHEL-170588-peers-fix-OOB-heap-write-in-dictionary-cache-update.patch
|
||||
Patch2: RHEL-211067-CVE-2026-55203-fix-uint16_t-overflow-in-mux-fcgi.patch
|
||||
Patch3: RHEL-211085-CVE-2026-55204-add-missing-NULL-check-after-hpack_dht_defrag.patch
|
||||
|
||||
BuildRequires: gcc
|
||||
BuildRequires: lua-devel
|
||||
@ -52,7 +54,10 @@ availability environments. Indeed, it can:
|
||||
|
||||
%prep
|
||||
%setup -q
|
||||
%autopatch -p1
|
||||
%patch -p1 -P 0
|
||||
%patch -p1 -P 1
|
||||
%patch -p1 -P 2
|
||||
%patch -p1 -P 3
|
||||
|
||||
%build
|
||||
make %{?_smp_mflags} CPU="generic" TARGET="linux-glibc" USE_OPENSSL=1 USE_PCRE2=1 USE_SLZ=1 USE_LUA=1 USE_CRYPT_H=1 USE_SYSTEMD=1 USE_LINUX_TPROXY=1 USE_GETADDRINFO=1 USE_PROMEX=1 DEFINE=-DMAX_SESS_STKCTR=12 ADDINC="%{build_cflags}" ADDLIB="%{build_ldflags}"
|
||||
@ -134,6 +139,12 @@ echo "d /var/lib/haproxy 0755 root root - -" > %{buildroot}%{_tmpfilesdir}/%{nam
|
||||
%{_tmpfilesdir}/%{name}.conf
|
||||
|
||||
%changelog
|
||||
* Mon Aug 10 2026 Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.0.5-8
|
||||
- Fix uint16_t overflow in FCGI demux record length (CVE-2026-55203)
|
||||
Resolves: RHEL-211067
|
||||
- Fix NULL pointer dereference in hpack_dht_insert() (CVE-2026-55204)
|
||||
Resolves: RHEL-211085
|
||||
|
||||
* Tue May 5 2026 Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.0.5-7
|
||||
- peers: fix OOB heap write in dictionary cache update
|
||||
Resolves: RHEL-170588
|
||||
|
||||
Loading…
Reference in New Issue
Block a user