From fb919d63bea83649f19a38b876778d06dd1b2943 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Tue, 14 Jul 2026 13:28:26 +0000 Subject: [PATCH] Fix CVE-2026-47783: SASL timing side-channel in memcached Backport upstream commit d13f282b4bce to fix CVE-2026-47783, a timing side-channel vulnerability in SASL password database authentication. The patch uses constant-time safe_memcmp() for username and password comparisons, zero-fills the buffer before each fgets call, and removes the early break to ensure the entire password file is always scanned, eliminating measurable timing differences between valid and invalid usernames. CVE: CVE-2026-47783 Upstream patches: - https://github.com/memcached/memcached/commit/d13f282b4bce33a9c33b8a1bbf07f12114160fed.patch Resolves: RHEL-179085 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- memcached-1.6.23-CVE-2026-47783.patch | 56 +++++++++++++++++++++++++++ memcached.spec | 11 +++++- 2 files changed, 66 insertions(+), 1 deletion(-) create mode 100644 memcached-1.6.23-CVE-2026-47783.patch diff --git a/memcached-1.6.23-CVE-2026-47783.patch b/memcached-1.6.23-CVE-2026-47783.patch new file mode 100644 index 0000000..f314278 --- /dev/null +++ b/memcached-1.6.23-CVE-2026-47783.patch @@ -0,0 +1,56 @@ +From 62ba3cb04cc4a8e573a46b7e8cefd3b212c42876 Mon Sep 17 00:00:00 2001 +From: Sarthak Munshi +Date: Sat, 21 Mar 2026 15:20:25 -0700 +Subject: [PATCH] Fix timing side-channel in SASL password database + authentication + +sasl_server_userdb_checkpass() broke out of the password file loop +early when a valid username was found, creating a measurable timing +difference between valid and invalid usernames. Additionally, the +password comparison used memcmp() which returns early on the first +differing byte, potentially leaking password bytes via timing analysis. + +Fix both issues with minimal changes per reviewer feedback: +- Clear buffer to zero before each fgets so comparisons past the + stored password hit known zero bytes +- Use safe_memcmp() for both username and password comparisons + (constant-time, volatile-qualified) +- Remove the early break so the entire file is always scanned +--- + sasl_defs.c | 21 ++++++++++----------- + 1 file changed, 10 insertions(+), 11 deletions(-) + +diff --git a/sasl_defs.c b/sasl_defs.c +index e73a570..98a1f75 100644 +--- a/sasl_defs.c ++++ b/sasl_defs.c +@@ -71,19 +71,18 @@ static int sasl_server_userdb_checkpass(sasl_conn_t *conn, + char buffer[MAX_ENTRY_LEN]; + bool ok = false; + +- while ((fgets(buffer, sizeof(buffer), pwfile)) != NULL) { +- if (memcmp(user, buffer, unmlen) == 0 && buffer[unmlen] == ':') { +- /* This is the correct user */ +- ++unmlen; +- if (memcmp(pass, buffer + unmlen, passlen) == 0 && +- (buffer[unmlen + passlen] == ':' || /* Additional tokens */ +- buffer[unmlen + passlen] == '\n' || /* end of line */ +- buffer[unmlen + passlen] == '\r'|| /* dos format? */ +- buffer[unmlen + passlen] == '\0')) { /* line truncated */ ++ while (1) { ++ memset(buffer, 0, sizeof(buffer)); ++ if (fgets(buffer, sizeof(buffer), pwfile) == NULL) ++ break; ++ if (safe_memcmp(user, buffer, unmlen) && buffer[unmlen] == ':') { ++ if (safe_memcmp(pass, buffer + unmlen + 1, passlen) && ++ (buffer[unmlen + 1 + passlen] == ':' || ++ buffer[unmlen + 1 + passlen] == '\n' || ++ buffer[unmlen + 1 + passlen] == '\r' || ++ buffer[unmlen + 1 + passlen] == '\0')) { + ok = true; + } +- +- break; + } + } + (void)fclose(pwfile); diff --git a/memcached.spec b/memcached.spec index ee7a422..0af1eef 100644 --- a/memcached.spec +++ b/memcached.spec @@ -12,7 +12,7 @@ Name: memcached Version: 1.6.23 -Release: 7%{?dist} +Release: 8%{?dist} Epoch: 0 Summary: High Performance, Distributed Memory Object Cache @@ -25,6 +25,9 @@ Source2: https://releases.pagure.org/memcached-selinux/memcached-selinux- Source3: memcached.conf Patch1: memcached-unit.patch +# https://issues.redhat.com/browse/RHEL-179085 +# https://github.com/memcached/memcached/commit/d13f282b4bce33a9c33b8a1bbf07f12114160fed +Patch2: memcached-1.6.23-CVE-2026-47783.patch BuildRequires: make BuildRequires: gcc libevent-devel systemd @@ -71,6 +74,7 @@ optimised for use with this version of memcached. # and SELinux policy sources into memcached-selinux-X.X %setup -q -b 2 %patch 1 -p1 -b .unit +%patch 2 -p1 -b .CVE-2026-47783 %build %configure \ @@ -174,6 +178,11 @@ fi %license ../%{selinuxmoduledir}/COPYING %changelog +* Tue Jul 14 2026 RHEL Packaging Agent - 0:1.6.23-8 +- Fix timing side-channel in SASL password database authentication + (CVE-2026-47783) +- Resolves: RHEL-179085 + * Tue Oct 29 2024 Troy Dawson - 0:1.6.23-7 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018