openRuyi-tutorials/buildroot
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

package/glibc: security bump to version 2.41-70

Browse Source 
Fixes the following security issues:

- CVE-2025-5702: power10: strcmp fails to save and restore nonvolatile
  vector registers
  https://sourceware.org/cgit/glibc/tree/advisories/GLIBC-SA-2025-0003

- CVE-2025-5745: power10: strncmp fails to save and restore nonvolatile
  vector registers
  https://sourceware.org/cgit/glibc/tree/advisories/GLIBC-SA-2025-0004

Note: CVE-2025-5702 and CVE-2025-5745 are specific to the Power 10
hardware architecture, which is not supported in Buildroot at the time
of this commit. The highest target CPU supported in Buildroot is
Power 9. See the file `arch/Config.in.powerpc`.

- CVE-2025-8058: posix: Fix double-free after allocation failure in regcomp
  https://sourceware.org/cgit/glibc/tree/advisories/GLIBC-SA-2025-0005

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Julien: add the note about power10 in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Peter Korsgaard
2025-08-05 13:06:36 +02:00
committed by Julien Olivain
parent 8ef2ba2ec3
commit feaf53585a
3 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
package/glibc/glibc.hash
View File

@@ -1,5 +1,5 @@
# Locally calculated (fetched from Github)
sha256 ed2cd1f058f22f682e700c5be408975db62025a14863a5a6700ee93d5927504e glibc-2.41-5-gcb7f20653724029be89224ed3a35d627cc5b4163.tar.gz
sha256 166b6e7637bb45cb9352e4813005f83dd48f03ef634d3e9e94a30aa5a0300fab glibc-2.41-70-g1502c248d58cb99a203731707987a4342926e830.tar.gz
# Hashes for license files
sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 COPYING

11
package/glibc/glibc.mk
View File

@@ -7,7 +7,7 @@
# Generate version string using:
# git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2-
# When updating the version, please also update localedef
GLIBC_VERSION = 2.41-5-gcb7f20653724029be89224ed3a35d627cc5b4163
GLIBC_VERSION = 2.41-70-g1502c248d58cb99a203731707987a4342926e830
# Upstream doesn't officially provide an https download link.
# There is one (https://sourceware.org/git/glibc.git) but it's not reliable,
@@ -25,6 +25,15 @@ GLIBC_CPE_ID_VENDOR = gnu
# allow proper matching with the CPE database.
GLIBC_CPE_ID_VERSION = $(word 1, $(subst -,$(space),$(GLIBC_VERSION)))
# Fixed by glibc-2.41-57-g84bdbf8a6f2fdafd3661489dbb7f79835a52da82
GLIBC_IGNORE_CVES += CVE-2025-5745
# Fixed by glibc-2.41-60-g0c76c951620f9e12df2a89b2c684878b55bb6795
GLIBC_IGNORE_CVES += CVE-2025-5702
# Fixed by glibc-2.41-64-g1e16d0096d80a6e12d5bfa8e0aafdd13c47efd65
GLIBC_IGNORE_CVES += CVE-2025-8058
# All these CVEs are considered as not being security issues by
# upstream glibc:
# https://security-tracker.debian.org/tracker/CVE-2010-4756

2
package/localedef/localedef.mk
View File

@@ -7,7 +7,7 @@
# Use the same VERSION and SITE as target glibc
# As in glibc.mk, generate version string using:
# git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2-
LOCALEDEF_VERSION = 2.41-5-gcb7f20653724029be89224ed3a35d627cc5b4163
LOCALEDEF_VERSION = 2.41-70-g1502c248d58cb99a203731707987a4342926e830
LOCALEDEF_SOURCE = glibc-$(LOCALEDEF_VERSION).tar.gz
LOCALEDEF_SITE = $(call github,bminor,glibc,$(LOCALEDEF_VERSION))
HOST_LOCALEDEF_DL_SUBDIR = glibc