Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 918412 (CVE-2023-5156) - <sys-libs/glibc-2.37-r6: memory leak regression in CVE-2023-4806 patch
Summary: <sys-libs/glibc-2.37-r6: memory leak regression in CVE-2023-4806 patch
Status: RESOLVED FIXED
Alias: CVE-2023-5156
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: http://www.openwall.com/lists/oss-sec...
Whiteboard: A3 [glsa+]
Keywords:
Depends on:
Blocks:
 
Reported: 2023-11-24 17:56 UTC by John Helmert III
Modified: 2024-02-02 03:28 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-11-24 17:56:08 UTC 
CVE-2023-5156:

A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.

This seems to be the patch, doesn't seem like we have it?

https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=ec6b95c3303c700eb89eebeda2d7264cc184a796
Comment 1 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2024-02-01 05:36:14 UTC 
Seems there's a fix in 2.39:

https://sourceware.org/pipermail/libc-announce/2024/000038.html
Comment 2 Larry the Git Cow gentoo-dev 2024-02-02 03:03:28 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=1b3d5c5b8102daf085b27905a139c5e8c4c7d591

commit 1b3d5c5b8102daf085b27905a139c5e8c4c7d591
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2024-02-02 03:02:44 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2024-02-02 03:03:23 +0000

    [ GLSA 202402-01 ] glibc: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/918412
    Bug: https://bugs.gentoo.org/923352
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Sam James <sam@gentoo.org>

 glsa-202402-01.xml | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
Comment 4 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2024-02-02 03:28:29 UTC 
Oops, missed that this was backported into Gentoo a while ago, in particular in 2.37-8:

https://gitweb.gentoo.org/fork/glibc.git/commit/?id=c75b76f8e1fb4ff0787ec408cb8f08b8a8f2e041