Bug 918412 (CVE-2023-5156)

Summary:	<sys-libs/glibc-2.37-r6: memory leak regression in CVE-2023-4806 patch
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	ajak, hydrapolic, toolchain
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://www.openwall.com/lists/oss-security/2023/10/03/4
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=914281
Whiteboard:	A3 [glsa+]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2023-11-24 17:56:08 UTC

CVE-2023-5156:

A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.

This seems to be the patch, doesn't seem like we have it?

https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=ec6b95c3303c700eb89eebeda2d7264cc184a796

Comment 1 John Helmert III archtester

2024-02-01 05:36:14 UTC

Seems there's a fix in 2.39:

https://sourceware.org/pipermail/libc-announce/2024/000038.html

Comment 2 Larry the Git Cow gentoo-dev

2024-02-02 03:03:28 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=1b3d5c5b8102daf085b27905a139c5e8c4c7d591

commit 1b3d5c5b8102daf085b27905a139c5e8c4c7d591
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2024-02-02 03:02:44 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2024-02-02 03:03:23 +0000

    [ GLSA 202402-01 ] glibc: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/918412
    Bug: https://bugs.gentoo.org/923352
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Sam James <sam@gentoo.org>

 glsa-202402-01.xml | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)

Comment 3 Sam James archtester

2024-02-02 03:09:07 UTC

We added it in 2.38-4 first (https://gitweb.gentoo.org/fork/glibc.git/commit/?h=gentoo/2.38&id=4239cf689516ca2bab013994feed150cffc9e4fa).

Comment 4 John Helmert III archtester

2024-02-02 03:28:29 UTC

Oops, missed that this was backported into Gentoo a while ago, in particular in 2.37-8:

https://gitweb.gentoo.org/fork/glibc.git/commit/?id=c75b76f8e1fb4ff0787ec408cb8f08b8a8f2e041