Re: [Buildroot] [PATCH] package/rsyslog: upstream patch CVE-2026-19654

[Thomas Perale via buildroot <buildroot@buildroot.org>]

In reply of:
> - CVE-2026-19654:
>     A unauthenticated remote peer may lead rsyslogd to crash due to a flaw
>     in the optional imptcp module. A crafted input sequence during
>     oversize-frame recovery can cause an invalid internal message length
>     and terminate rsyslogd. No confidentiality or integrity impact,
>     privilege escalation, or code execution has been identified. imtcp and
>     the default imptcp framing modes are not affected.
> 
> For more information, see:
>   - https://www.cve.org/CVERecord?id=CVE-2026-19654
>   - https://github.com/rsyslog/rsyslog/commit/07b3c40a5a78c79ed9109251f842ca7e955dd586
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>

Applied to 2025.02.x & 2026.05.x. Thanks

> ---
>  ...rd-regex-framing-match-at-line-start.patch | 47 +++++++++++++++++++
>  package/rsyslog/rsyslog.mk                    |  3 ++
>  2 files changed, 50 insertions(+)
>  create mode 100644 package/rsyslog/0001-imptcp-guard-regex-framing-match-at-line-start.patch
> 
> diff --git a/package/rsyslog/0001-imptcp-guard-regex-framing-match-at-line-start.patch b/package/rsyslog/0001-imptcp-guard-regex-framing-match-at-line-start.patch
> new file mode 100644
> index 0000000000..5eff609fdf
> --- /dev/null
> +++ b/package/rsyslog/0001-imptcp-guard-regex-framing-match-at-line-start.patch
> @@ -0,0 +1,47 @@
> +From 07b3c40a5a78c79ed9109251f842ca7e955dd586 Mon Sep 17 00:00:00 2001
> +From: Rainer Gerhards <rgerhards@adiscon.com>
> +Date: Mon, 20 Jul 2026 17:19:28 +0200
> +Subject: [PATCH] imptcp: guard regex framing match at line start
> +
> +Why
> +A regex match at the beginning of the receive buffer can form a
> +negative message length after oversize-frame recovery.
> +
> +Impact
> +Regex-framed imptcp listeners reject that invalid transition instead
> +of submitting a negative message length.
> +
> +Before/After
> +Before: a match with a zero line offset submitted an invalid length.
> +After: only a match following an existing line can submit a frame.
> +
> +Technical Overview
> +Mirror the line-offset guard used by the shared imtcp parser.
> +Leave existing regex framing and oversize recovery behavior unchanged.
> +
> +Security advisory:
> +https://github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29
> +
> +Reported-by: Raphael Eikenberg (@eikendev)
> +With the help of AI-Agents: Codex
> +---
> +CVE: CVE-2026-19654
> +Upstream: https://github.com/rsyslog/rsyslog/commit/07b3c40a5a78c79ed9109251f842ca7e955dd586
> +Signed-off-by: Thomas Perale <thomas.perale@mind.be
> +---
> + plugins/imptcp/imptcp.c | 2 +-
> + 1 file changed, 1 insertion(+), 1 deletion(-)
> +
> +diff --git a/plugins/imptcp/imptcp.c b/plugins/imptcp/imptcp.c
> +index 838e1648fc..90a7d6f7ed 100644
> +--- a/plugins/imptcp/imptcp.c
> ++++ b/plugins/imptcp/imptcp.c
> +@@ -1009,7 +1009,7 @@ static rsRetVal ATTR_NONNULL() processDataRcvd_regexFraming(ptcpsess_t *const __
> +         pThis->iCurrLine = pThis->iMsg;
> +     } else {
> +         const int isMatch = !regexec(&inst->start_preg, (char *)pThis->pMsg + pThis->iCurrLine, 0, NULL, 0);
> +-        if (isMatch) {
> ++        if (pThis->iCurrLine > 0 && isMatch) {
> +             DBGPRINTF("regex match (%d), framing line: %s\n", pThis->iCurrLine, pThis->pMsg);
> +             strcpy((char *)pThis->pMsg_save, (char *)pThis->pMsg + pThis->iCurrLine);
> +             pThis->iMsg = pThis->iCurrLine - 1;
> diff --git a/package/rsyslog/rsyslog.mk b/package/rsyslog/rsyslog.mk
> index dedecdc572..bcc66167af 100644
> --- a/package/rsyslog/rsyslog.mk
> +++ b/package/rsyslog/rsyslog.mk
> @@ -12,6 +12,9 @@ RSYSLOG_CPE_ID_VENDOR = rsyslog
>  RSYSLOG_DEPENDENCIES = zlib libestr liblogging libfastjson host-pkgconf
>  RSYSLOG_CONF_ENV = ac_cv_prog_cc_c99='-std=c99'
>  
> +# 0001-imptcp-guard-regex-framing-match-at-line-start.patch
> +RSYSLOG_IGNORE_CVES += CVE-2026-19654
> +
>  ifeq ($(BR2_PACKAGE_RSYSLOG_EXTRA_PLUGINS),y)
>  RSYSLOG_PLUGINS = imdiag imfile impstats imptcp \
>  	mmanon mmaudit mmfields mmjsonparse mmpstrucdata mmsequence mmutf8fix \
> -- 
> 2.55.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot