|
| 1 | +From 320a9e12e379c819fb3bfe14590d0f8bdff20115 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Siddhesh Poyarekar <siddhesh@gotplt.org> |
| 3 | +Date: Thu, 15 Jan 2026 06:06:40 -0500 |
| 4 | +Subject: [PATCH] memalign: reinstate alignment overflow check (CVE-2026-0861) |
| 5 | + |
| 6 | +The change to cap valid sizes to PTRDIFF_MAX inadvertently dropped the |
| 7 | +overflow check for alignment in memalign functions, _mid_memalign and |
| 8 | +_int_memalign. Reinstate the overflow check in _int_memalign, aligned |
| 9 | +with the PTRDIFF_MAX change since that is directly responsible for the |
| 10 | +CVE. The missing _mid_memalign check is not relevant (and does not have |
| 11 | +a security impact) and may need a different approach to fully resolve, |
| 12 | +so it has been omitted. |
| 13 | + |
| 14 | +CVE-Id: CVE-2026-0861 |
| 15 | +Vulnerable-Commit: 9bf8e29ca136094f73f69f725f15c51facc97206 |
| 16 | +Reported-by: Igor Morgenstern, Aisle Research |
| 17 | +Fixes: BZ #33796 |
| 18 | +Reviewed-by: Wilco Dijkstra <Wilco.Dijkstra@arm.com> |
| 19 | +Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org> |
| 20 | +(cherry picked from commit c9188d333717d3ceb7e3020011651f424f749f93) |
| 21 | +Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> |
| 22 | +Upstream-reference: https://github.com/bminor/glibc/commit/744b63026a29f7eedbbc8e3a01a7f48a6eb0a085.patch |
| 23 | +--- |
| 24 | + malloc/malloc.c | 7 +++++-- |
| 25 | + malloc/tst-malloc-too-large.c | 10 ++-------- |
| 26 | + 2 files changed, 7 insertions(+), 10 deletions(-) |
| 27 | + |
| 28 | +diff --git a/malloc/malloc.c b/malloc/malloc.c |
| 29 | +index d0bbbf37..70bf56d1 100644 |
| 30 | +--- a/malloc/malloc.c |
| 31 | ++++ b/malloc/malloc.c |
| 32 | +@@ -5042,7 +5042,7 @@ _int_memalign (mstate av, size_t alignment, size_t bytes) |
| 33 | + INTERNAL_SIZE_T size; |
| 34 | + |
| 35 | + nb = checked_request2size (bytes); |
| 36 | +- if (nb == 0) |
| 37 | ++ if (nb == 0 || alignment > PTRDIFF_MAX) |
| 38 | + { |
| 39 | + __set_errno (ENOMEM); |
| 40 | + return NULL; |
| 41 | +@@ -5058,7 +5058,10 @@ _int_memalign (mstate av, size_t alignment, size_t bytes) |
| 42 | + we don't find anything in those bins, the common malloc code will |
| 43 | + scan starting at 2x. */ |
| 44 | + |
| 45 | +- /* Call malloc with worst case padding to hit alignment. */ |
| 46 | ++ /* Call malloc with worst case padding to hit alignment. ALIGNMENT is a |
| 47 | ++ power of 2, so it tops out at (PTRDIFF_MAX >> 1) + 1, leaving plenty of |
| 48 | ++ space to add MINSIZE and whatever checked_request2size adds to BYTES to |
| 49 | ++ get NB. Consequently, total below also does not overflow. */ |
| 50 | + m = (char *) (_int_malloc (av, nb + alignment + MINSIZE)); |
| 51 | + |
| 52 | + if (m == 0) |
| 53 | +diff --git a/malloc/tst-malloc-too-large.c b/malloc/tst-malloc-too-large.c |
| 54 | +index 5be6800b..206184ac 100644 |
| 55 | +--- a/malloc/tst-malloc-too-large.c |
| 56 | ++++ b/malloc/tst-malloc-too-large.c |
| 57 | +@@ -151,7 +151,6 @@ test_large_allocations (size_t size) |
| 58 | + } |
| 59 | + |
| 60 | + |
| 61 | +-static long pagesize; |
| 62 | + |
| 63 | + /* This function tests the following aligned memory allocation functions |
| 64 | + using several valid alignments and precedes each allocation test with a |
| 65 | +@@ -170,8 +169,8 @@ test_large_aligned_allocations (size_t size) |
| 66 | + |
| 67 | + /* All aligned memory allocation functions expect an alignment that is a |
| 68 | + power of 2. Given this, we test each of them with every valid |
| 69 | +- alignment from 1 thru PAGESIZE. */ |
| 70 | +- for (align = 1; align <= pagesize; align *= 2) |
| 71 | ++ alignment for the type of ALIGN, i.e. until it wraps to 0. */ |
| 72 | ++ for (align = 1; align > 0; align <<= 1) |
| 73 | + { |
| 74 | + test_setup (); |
| 75 | + #if __GNUC_PREREQ (7, 0) |
| 76 | +@@ -264,11 +263,6 @@ do_test (void) |
| 77 | + DIAG_IGNORE_NEEDS_COMMENT (7, "-Walloc-size-larger-than="); |
| 78 | + #endif |
| 79 | + |
| 80 | +- /* Aligned memory allocation functions need to be tested up to alignment |
| 81 | +- size equivalent to page size, which should be a power of 2. */ |
| 82 | +- pagesize = sysconf (_SC_PAGESIZE); |
| 83 | +- TEST_VERIFY_EXIT (powerof2 (pagesize)); |
| 84 | +- |
| 85 | + /* Loop 1: Ensure that all allocations with SIZE close to SIZE_MAX, i.e. |
| 86 | + in the range (SIZE_MAX - 2^14, SIZE_MAX], fail. |
| 87 | + |
| 88 | +-- |
| 89 | +2.45.4 |
| 90 | + |
0 commit comments