diff --git a/SOURCES/0016-Avoid-duplicate-subrequest-finalization.patch b/SOURCES/0016-Avoid-duplicate-subrequest-finalization.patch new file mode 100644 index 0000000..fa040d8 --- /dev/null +++ b/SOURCES/0016-Avoid-duplicate-subrequest-finalization.patch @@ -0,0 +1,66 @@ +From 13c54029cf3a3a6dbb954ee839665de00f95aa5b Mon Sep 17 00:00:00 2001 +From: Roman Arutyunyan +Date: Mon, 29 Jun 2026 21:49:27 +0400 +Subject: [PATCH] Avoid duplicate subrequest finalization + +Previously, if a subrequest was posted twice, it could be finalized in +both calls, excessively reducing r->main->count and potentially leading +to a use-after-free. + +The fix is to avoid posting a request if it's already posted. Also, +as a hardening measure, r->write_event_handler is now reset to a no-op +handler during active subrequest finalization. + +The problem manifests itself in ngx_http_ssi_filter_module during +unbuffered proxying. If a subrequest is created for an SSI include +statement while the main request has some data postponed by another +include, this subrequest becomes double-posted when the main request +data is flushed. The first post comes from ngx_http_subrequest() and +the second one comes from ngx_http_postpone_filter(). In case of a +quick subrequest finalization, the above mentioned problem happens. + +Reported by P4P3R-HAK. +--- + src/http/ngx_http_request.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c +index 85571a0..a28f569 100644 +--- a/src/http/ngx_http_request.c ++++ b/src/http/ngx_http_request.c +@@ -2455,6 +2455,14 @@ ngx_http_post_request(ngx_http_request_t *r, ngx_http_posted_request_t *pr) + { + ngx_http_posted_request_t **p; + ++ for (p = &r->main->posted_requests; *p; p = &(*p)->next) { ++ if ((*p)->request == r) { ++ ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, ++ "http request already posted"); ++ return NGX_OK; ++ } ++ } ++ + if (pr == NULL) { + pr = ngx_palloc(r->pool, sizeof(ngx_http_posted_request_t)); + if (pr == NULL) { +@@ -2465,8 +2473,6 @@ ngx_http_post_request(ngx_http_request_t *r, ngx_http_posted_request_t *pr) + pr->request = r; + pr->next = NULL; + +- for (p = &r->main->posted_requests; *p; p = &(*p)->next) { /* void */ } +- + *p = pr; + + return NGX_OK; +@@ -2586,6 +2592,8 @@ ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc) + + r->main->count--; + ++ r->write_event_handler = ngx_http_request_empty_handler; ++ + if (pr->postponed && pr->postponed->request == r) { + pr->postponed = pr->postponed->next; + } +-- +2.44.0 + diff --git a/SOURCES/0017-Fixed-uninitialized-memory-read-caused-by-stale-rege.patch b/SOURCES/0017-Fixed-uninitialized-memory-read-caused-by-stale-rege.patch new file mode 100644 index 0000000..cec27e2 --- /dev/null +++ b/SOURCES/0017-Fixed-uninitialized-memory-read-caused-by-stale-rege.patch @@ -0,0 +1,51 @@ +From 805de017e6ba2d81208eabdb74643b0a52eb896b Mon Sep 17 00:00:00 2001 +From: Pavel Pautov +Date: Fri, 15 May 2026 00:48:50 -0700 +Subject: [PATCH] Fixed uninitialized memory read caused by stale regex + captures. + +When ngx_http_regex_exec() reallocates r->captures array, it doesn't update +r->ncaptures value, if regex didn't match. So the next use of unnamed regex +capture triggers uninitialized read and potential buffer overrun. + +This config demonstrates the issue: + map test $my_map { + volatile; + + ~mismatch(.*) 1; # reallocates r->captures in subrequests + + default ""; + } + + server { + location ~(.*) { # sets r->ncaptures + slice 50; + + # $1 will read from uninitialized memory in slice subrequests + proxy_set_header Test $my_map$1; + + proxy_set_header Range $slice_range; + proxy_pass http://backend; + } + } + +The issue was introduced by 746fba0d79c6. +--- + src/http/ngx_http_variables.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/http/ngx_http_variables.c b/src/http/ngx_http_variables.c +index 16ffda3..47d7848 100644 +--- a/src/http/ngx_http_variables.c ++++ b/src/http/ngx_http_variables.c +@@ -2624,6 +2624,7 @@ ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s) + + if (r->captures == NULL || r->realloc_captures) { + r->realloc_captures = 0; ++ r->ncaptures = 0; + + r->captures = ngx_palloc(r->pool, len * sizeof(int)); + if (r->captures == NULL) { +-- +2.44.0 + diff --git a/SPECS/nginx.spec b/SPECS/nginx.spec index 33865e3..fd7ba1e 100644 --- a/SPECS/nginx.spec +++ b/SPECS/nginx.spec @@ -30,7 +30,7 @@ Name: nginx Epoch: 1 Version: 1.24.0 -Release: 3%{?dist}.3.alma.1 +Release: 3%{?dist}.4.alma.1 Summary: A high performance web server and reverse proxy server Group: System Environment/Daemons @@ -114,6 +114,14 @@ Patch14: 0014-Added-max_headers-directive.patch # upstream patch - https://github.com/nginx/nginx/commit/26d824ec3a2f819300edce0ab3b055751c9843ff.patch Patch15: 0015-Upstream-limit-header-length-for-HTTP-2-and-gRPC.patch +# https://redhat.atlassian.net/browse/RHEL-219313 +# upstream patch - https://github.com/nginx/nginx/commit/ddde692db11ab8238e9ca661007f64c9f6d764d2.patch +Patch16: 0016-Avoid-duplicate-subrequest-finalization.patch + +# https://redhat.atlassian.net/browse/RHEL-217956 +# upstream patch - https://github.com/nginx/nginx/commit/b99f804ad38a60ceb07bc429598d5b2c4e70e336.patch +Patch17: 0017-Fixed-uninitialized-memory-read-caused-by-stale-rege.patch + %if 0%{?with_gperftools} BuildRequires: gperftools-devel %endif @@ -280,6 +288,8 @@ Requires: zlib-devel %patch -P13 -p1 %patch -P14 -p1 %patch -P15 -p1 +%patch -P16 -p1 +%patch -P17 -p1 cp %{SOURCE200} %{SOURCE210} %{SOURCE10} %{SOURCE12} . @@ -592,9 +602,15 @@ fi %{nginx_srcdir}/ %changelog -* Mon Jul 13 2026 Eduard Abdullin - 1:1.24.0-3.3.alma.1 +* Mon Aug 24 2026 Eduard Abdullin - 1:1.24.0-3.4.alma.1 - Debrand for AlmaLinux +* Sun Aug 09 2026 Luboš Uhliarik - 1:1.24.0-3.4 +- Resolves: RHEL-217957 - nginx:1.24/nginx: NGINX: Memory disclosure and + denial of service in ngx_http_slice_module (CVE-2026-60005) +- Resolves: RHEL-219309 - nginx:1.24/nginx: NGINX: Heap buffer over-read + allows memory modification or denial of service (CVE-2026-56434) + * Tue Jul 07 2026 Luboš Uhliarik - 1:1.24.0-3.3 - Resolves: RHEL-191779 - nginx: "HTTP/2 bomb" nginx fix breaks module ABI causing crashes