From 539333a04f5647f75f8eb98926a8787c47813fe3 Mon Sep 17 00:00:00 2001 From: eabdullin Date: Mon, 23 Feb 2026 13:52:23 +0000 Subject: [PATCH] Import from CS git --- ...low-when-unpacking-message-address-l.patch | 52 +++++++++++++++++++ SPECS/munge.spec | 50 ++++++++++-------- 2 files changed, 79 insertions(+), 23 deletions(-) create mode 100644 SOURCES/Fix-buffer-overflow-when-unpacking-message-address-l.patch diff --git a/SOURCES/Fix-buffer-overflow-when-unpacking-message-address-l.patch b/SOURCES/Fix-buffer-overflow-when-unpacking-message-address-l.patch new file mode 100644 index 0000000..1648899 --- /dev/null +++ b/SOURCES/Fix-buffer-overflow-when-unpacking-message-address-l.patch @@ -0,0 +1,52 @@ +From bf40cc27c4ce8451d4b062c9de0b67ec40894812 Mon Sep 17 00:00:00 2001 +From: Chris Dunlap +Date: Mon, 26 Jan 2026 20:42:40 -0800 +Subject: [PATCH] Fix buffer overflow when unpacking message address length + +Add validation that addr_len does not exceed the size of the addr +field before copying IP address data in _msg_unpack(). + +The m_msg structure contains a 4-byte struct in_addr for the IP +address. When unpacking a MUNGE_MSG_DEC_RSP message, the addr_len +field (uint8_t) was read from untrusted message data and used directly +in _copy() without validation. An attacker setting addr_len to 255 +causes _copy() to write 251 bytes past the end of the addr field, +corrupting subsequent structure members. + +This buffer overflow corrupts munged's internal state and can +be exploited by a local attacker to leak conf->mac_key and other +cryptographic secrets from process memory. With the leaked key, +an attacker can forge arbitrary MUNGE credentials to impersonate any +user to services that rely on MUNGE for authentication. + +Any local user can trigger this by connecting to munged's Unix socket +and sending a crafted MUNGE_MSG_DEC_RSP message. While message type +validation in job_exec() will reject response-type messages, this +validation occurs after m_msg_recv() has already called _msg_unpack() +to process the message body. The buffer overflow occurs during the +unpacking phase, before the message type is validated and rejected. + +A working proof-of-concept exploit exists that demonstrates key +leakage and credential forgery. + +Reported-by: Titouan Lazard +Security: CVE-2026-25506 +--- + src/libcommon/m_msg.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/libcommon/m_msg.c b/src/libcommon/m_msg.c +index 38e01ae3dd81..eaeaf0b8bc3e 100644 +--- a/src/libcommon/m_msg.c ++++ b/src/libcommon/m_msg.c +@@ -686,6 +686,7 @@ _msg_unpack (m_msg_t m, m_msg_type_t type, const void *src, int srclen) + else if ( _copy (m->realm_str, p, m->realm_len, p, q, &p) < 0) ; + else if (!_unpack (&(m->ttl), &p, sizeof (m->ttl), q)) ; + else if (!_unpack (&(m->addr_len), &p, sizeof (m->addr_len), q)) ; ++ else if (m->addr_len > sizeof (m->addr)) goto err; + else if ( _copy (&(m->addr), p, m->addr_len, p, q, &p) < 0) ; + else if (!_unpack (&(m->time0), &p, sizeof (m->time0), q)) ; + else if (!_unpack (&(m->time1), &p, sizeof (m->time1), q)) ; +-- +2.52.0 + diff --git a/SPECS/munge.spec b/SPECS/munge.spec index 8ef61c2..890c57e 100644 --- a/SPECS/munge.spec +++ b/SPECS/munge.spec @@ -1,19 +1,21 @@ Name: munge Version: 0.5.13 -Release: 1%{?dist} +Release: 3%{?dist} Summary: Enables uid & gid authentication across a host cluster -Group: Applications/System # The libs and devel package is GPLv3+ and LGPLv3+ where as the main package is GPLv3 only. License: GPLv3+ and LGPLv3+ URL: https://dun.github.io/munge/ Source0: https://github.com/dun/munge/releases/download/munge-%{version}/munge-%{version}.tar.xz Source1: create-munge-key Source2: munge.logrotate +Patch01: Fix-buffer-overflow-when-unpacking-message-address-l.patch -BuildRequires: systemd-units -BuildRequires: zlib-devel bzip2-devel libgcrypt-devel +BuildRequires: gcc +BuildRequires: systemd-rpm-macros +BuildRequires: zlib-devel bzip2-devel openssl-devel Requires: munge-libs = %{version}-%{release} +Requires: logrotate Requires(pre): shadow-utils @@ -21,7 +23,6 @@ Requires(post): systemd Requires(preun): systemd Requires(postun): systemd - %description MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use @@ -35,7 +36,6 @@ methods. %package devel Summary: Development files for uid * gid authentication across a host cluster -Group: Applications/System Requires: munge-libs%{?_isa} = %{version}-%{release} %description devel @@ -43,7 +43,6 @@ Header files for developing using MUNGE. %package libs Summary: Runtime libs for uid * gid authentication across a host cluster -Group: Applications/System %description libs Runtime libraries for using MUNGE. @@ -51,11 +50,13 @@ Runtime libraries for using MUNGE. %prep %setup -q +%patch -P 1 -p1 cp -p %{SOURCE1} create-munge-key cp -p %{SOURCE2} munge.logrotate %build -%configure --disable-static --with-crypto-lib=libgcrypt +%configure --disable-static --with-crypto-lib=openssl +echo "d /run/munge 0755 munge munge -" > src/etc/munge.tmpfiles.conf.in # Get rid of some rpaths for /usr/sbin sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool @@ -63,9 +64,7 @@ make %{?_smp_mflags} %install - -rm -rf %{buildroot} -make install DESTDIR=%{buildroot} +%make_install # Install extra files. install -p -m 755 create-munge-key %{buildroot}/%{_sbindir}/create-munge-key @@ -88,12 +87,7 @@ chmod 700 %{buildroot}%{_sysconfdir}/munge # i.e it is not actually included in the rpm, only the record # of it is. touch %{buildroot}%{_var}/run/munge/munged.pid - -%clean -rm -rf %{buildroot} - -%postun -%systemd_postun_with_restart munge.service +mv %{buildroot}%{_var}/run %{buildroot} %preun %systemd_preun munge.service @@ -109,8 +103,10 @@ exit 0 %post %systemd_post munge.service -%post libs -p /sbin/ldconfig -%postun libs -p /sbin/ldconfig +%postun +%systemd_postun_with_restart munge.service + +%ldconfig_scriptlets libs %files %{_bindir}/munge @@ -126,14 +122,15 @@ exit 0 %{_unitdir}/munge.service %attr(0700,munge,munge) %dir %{_var}/log/munge -%attr(0700,munge,munge) %dir %{_sysconfdir}/munge -%attr(0755,munge,munge) %dir %{_var}/run/munge/ -%attr(0644,munge,munge) %ghost %{_var}/run/munge/munged.pid %attr(0700,munge,munge) %dir %{_var}/lib/munge +%attr(0700,munge,munge) %dir %{_sysconfdir}/munge +%attr(0755,munge,munge) %dir /run/munge/ +%attr(0644,munge,munge) %ghost /run/munge/munged.pid %config(noreplace) %{_tmpfilesdir}/munge.conf %config(noreplace) %{_sysconfdir}/logrotate.d/munge +%license COPYING COPYING.LESSER %doc AUTHORS %doc JARGON META NEWS QUICKSTART README %doc doc @@ -141,7 +138,6 @@ exit 0 %files libs %{_libdir}/libmunge.so.2 %{_libdir}/libmunge.so.2.0.0 -%doc COPYING COPYING.LESSER %files devel %{_includedir}/munge.h @@ -165,6 +161,14 @@ exit 0 %changelog +* Sun Feb 15 2026 Kamal Heib - 0.5.13-3 +- Fix CVE-2026-25506 +- Resolves: RHEL-148521 + +* Fri Apr 24 2020 Honggang Li - 0.5.13-2 +- Don't create temporary files in legacy directory +- Resolves: bz1805956 + * Thu Jul 19 2018 Jarod Wilson - 0.5.13-1 - Update to upstream 0.5.13 release