From: Kris Van Hees <noreply@github.com>
To: dtrace@lists.linux.dev
Subject: [oracle/dtrace] 2335de: dtprobed: reject probe descriptions with / in any ...
Date: Mon, 18 May 2026 11:52:51 -0700 [thread overview]
Message-ID: <oracle/dtrace/push/refs/heads/stable/338095-55ebd5@github.com> (raw)
Branch: refs/heads/stable
Home: https://github.com/oracle/dtrace
Commit: 2335de2660c453922ec100a08a56becce94a471b
https://github.com/oracle/dtrace/commit/2335de2660c453922ec100a08a56becce94a471b
Author: Kris Van Hees <kris.van.hees@oracle.com>
Date: 2026-03-10 (Tue, 10 Mar 2026)
Changed paths:
M dtprobed/dof_stash.c
A test/unittest/usdt/err.unsafe-prov.r
A test/unittest/usdt/err.unsafe-prov.sh
Log Message:
-----------
dtprobed: reject probe descriptions with / in any component
Commit b55e34351 ("USDT module names may contain dots; but forbid "."
and ".." names") was not sufficient to prevent malicious probe
description components causing pathnames to be created that could
make file access possible outside the dtrace directory hierarchy. By
ensuring USDT probe description data cannot contain '/' either in any
of the probe description components, this is no longer possible.
Test included.
Orabug: 39054018
CVE: CVE-2026-21991
Signed-off-by: Kris Van Hees <kris.van.hees@oracle.com>
Reviewed-by: John Haxby <john.haxby@oracle.com>
Reviewed-by: Eugene Loh <eugene.loh@oracle.com>
Reviewed-by: Nick Alcock <nick.alcock@oracle.com>
Commit: 1f71b2263ffb65829a10eb7a970739025b0d476a
https://github.com/oracle/dtrace/commit/1f71b2263ffb65829a10eb7a970739025b0d476a
Author: Kris Van Hees <kris.van.hees@oracle.com>
Date: 2026-03-10 (Tue, 10 Mar 2026)
Changed paths:
M NEWS
M dtrace.spec
M libdtrace/versions.list
Log Message:
-----------
Update NEWS, dtrace.spec, versions.list for release 2.0.6
Signed-off-by: Kris Van Hees <kris.van.hees@oracle.com>
Commit: deb67e96d342347cdf6ff15d08fcc238b5fb9e78
https://github.com/oracle/dtrace/commit/deb67e96d342347cdf6ff15d08fcc238b5fb9e78
Author: Kris Van Hees <kris.van.hees@oracle.com>
Date: 2026-04-06 (Mon, 06 Apr 2026)
Changed paths:
M dtrace.spec
M libproc/Psymtab.c
A test/internals/libproc/err.bad_sh_link.r
A test/internals/libproc/err.bad_sh_link.r.p
A test/internals/libproc/err.bad_sh_link.sh
Log Message:
-----------
libproc: fix out-of-bounds memory access when processing ELF data
The caching of section header data was not safeguarded against a possible
overflow in the allocation of cache elements, which could result in
accesses beyond the allocated space.
The lack of validation of sh_link against [1, number-of-section-headers]
could result in accesses beyond the allocated space.
New runtime dependency for dtrace-tests: xxd
Orabug: 39121881
CVE: CVE-2026-21992
Signed-off-by: Kris Van Hees <kris.van.hees@oracle.com>
Reviewed-by: Nick Alcock <nick.alcock@oracle.com>
Commit: 67f75b8b0e1274db0877fc1f128ae6a26e2d9b05
https://github.com/oracle/dtrace/commit/67f75b8b0e1274db0877fc1f128ae6a26e2d9b05
Author: Kris Van Hees <kris.van.hees@oracle.com>
Date: 2026-04-29 (Wed, 29 Apr 2026)
Changed paths:
M libproc/Psymtab.c
A test/internals/libproc/err.bad_sh_entsize.r
A test/internals/libproc/err.bad_sh_entsize.r.p
A test/internals/libproc/err.bad_sh_entsize.sh
Log Message:
-----------
libproc: avoid FPE when sh_entsize is 0
Orabug: 39121874
CVE: CVE-2026-21996
Signed-off-by: Kris Van Hees <kris.van.hees@oracle.com>
Reviewed-by: Nick Alcock <nick.alcock@oracle.com>
Commit: e7c8bcc851b9f2376f043781bb5ccf911b418487
https://github.com/oracle/dtrace/commit/e7c8bcc851b9f2376f043781bb5ccf911b418487
Author: Kris Van Hees <kris.van.hees@oracle.com>
Date: 2026-04-29 (Wed, 29 Apr 2026)
Changed paths:
M libproc/Psymtab.c
Log Message:
-----------
libproc: add safety checks for program headers
While it does not seem possible to ever end up tracing a program wit
bad program headers, it is best to guard against it anyway. Most
specifically, the loop over all program headers assumes that there will
be a PT_LOAD one. If not, processing should be aborted.
Also, if a PT_LOAD program header would have 0 p_align, the calculation
of the file_dyn_base would be wrong, because it uses "& (p_align - 1)".
No tests can be created at this time because ET_EXEC and ET_DYN objects
do not encounter this code path.
Signed-off-by: Kris Van Hees <kris.van.hees@oracle.com>
Reviewed-by: Nick Alcock <nick.alcock@oracle.com>
Commit: d3d41183f16fb82f8957b450f87abd241379bdaa
https://github.com/oracle/dtrace/commit/d3d41183f16fb82f8957b450f87abd241379bdaa
Author: Kris Van Hees <kris.van.hees@oracle.com>
Date: 2026-04-29 (Wed, 29 Apr 2026)
Changed paths:
M libproc/Psymtab.c
A test/internals/libproc/err.shstrtab_without_NUL.r
A test/internals/libproc/err.shstrtab_without_NUL.r.p
A test/internals/libproc/err.shstrtab_without_NUL.sh
A test/internals/libproc/err.strtab_without_NUL.r
A test/internals/libproc/err.strtab_without_NUL.r.p
A test/internals/libproc/err.strtab_without_NUL.sh
Log Message:
-----------
libproc: do not allow unterminated STRTAB sections
If the .shstrtab section or the strtab section associated with the
.symtab are not NUL-terminated, a core dump or corrupted data can
result.
Signed-off-by: Kris Van Hees <kris.van.hees@oracle.com>
Reviewed-by: Nick Alcock <nick.alcock@oracle.com>
Commit: 18cd8f1228341909a75cf2b9540bcfcfde1b13eb
https://github.com/oracle/dtrace/commit/18cd8f1228341909a75cf2b9540bcfcfde1b13eb
Author: Kris Van Hees <kris.van.hees@oracle.com>
Date: 2026-04-29 (Wed, 29 Apr 2026)
Changed paths:
M libproc/Psymtab.c
A test/internals/libproc/err.bad_sh_link2.r
A test/internals/libproc/err.bad_sh_link2.r.p
A test/internals/libproc/err.bad_sh_link2.sh
Log Message:
-----------
libproc: ensure that symtab sh_link references a strtab
If the sh_link of the symtab does not reference a strtab, unpredictable
behaviour could occur because the linked section will be interpreted as
if it is a strtab. As far as code safety, this failure case is not
likely to cause issues because all symbol name handling code verifies
that the st_name value is within the [0, size] range for the sh_link
referenced section.
Tests are included for the case of sh_link referencing a non-STRTAB
section or the wrong STRTAB section. These cases were (indirectly)
covered by existing code - the tests are added as a precaution against
future regressions.
Signed-off-by: Kris Van Hees <kris.van.hees@oracle.com>
Reviewed-by: Nick Alcock <nick.alcock@oracle.com>
Commit: 55ebd5f81bf2e10142585a3a43536a99f5f9b0d4
https://github.com/oracle/dtrace/commit/55ebd5f81bf2e10142585a3a43536a99f5f9b0d4
Author: Kris Van Hees <kris.van.hees@oracle.com>
Date: 2026-04-29 (Wed, 29 Apr 2026)
Changed paths:
M NEWS
M dtrace.spec
M libdtrace/versions.list
Log Message:
-----------
Update NEWS, dtrace.spec, versions.list for release 2.0.7
Signed-off-by: Kris Van Hees <kris.van.hees@oracle.com>
Compare: https://github.com/oracle/dtrace/compare/338095278232...55ebd5f81bf2
To unsubscribe from these emails, change your notification settings at https://github.com/oracle/dtrace/settings/notifications
reply other threads:[~2026-05-18 18:52 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=oracle/dtrace/push/refs/heads/stable/338095-55ebd5@github.com \
--to=noreply@github.com \
--cc=dtrace@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox