Re: [OE-core][wrynose][PATCH] glibc: fix CVE-2026-84243

["Yoann Congal" <yoann.congal@smile.fr>]

On Thu Nov 12, 2026 at 7:24 AM CET, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) via openembedded-core wrote:
> From: Hetvi Thakar <hthakar@cisco.com>
>
> Backport the upstream fix [1] for the LANGUAGE directory traversal
> reported in [2]. Reject locale entries containing path separators or
> equal to ".." for all programs, while retaining valid entries in
> colon-separated LANGUAGE lists.
>
> Keep the upstream regression test and adapt its Makefile integration
> to the 2.43 layout. Omit only the NEWS entry for the later release.
>
> [1] https://sourceware.org/git/?p=glibc.git;a=commit;h=03067f3c5e39aec5ec250a44bc1b395a1afd45e8
> [2] https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025
>
> Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
> ---
>  .../glibc/glibc/CVE-2026-84243.patch          | 194 ++++++++++++++++++
>  meta/recipes-core/glibc/glibc_2.43.bb         |   1 +
>  2 files changed, 195 insertions(+)
>  create mode 100644 meta/recipes-core/glibc/glibc/CVE-2026-84243.patch
>
> diff --git a/meta/recipes-core/glibc/glibc/CVE-2026-84243.patch b/meta/recipes-core/glibc/glibc/CVE-2026-84243.patch
> new file mode 100644
> index 00000000000..d64c7fea1d7
> --- /dev/null
> +++ b/meta/recipes-core/glibc/glibc/CVE-2026-84243.patch
> @@ -0,0 +1,194 @@
> +From 03067f3c5e39aec5ec250a44bc1b395a1afd45e8 Mon Sep 17 00:00:00 2001
> +From: Avinal Kumar <avinal.xlvii@gmail.com>
> +Date: Mon, 2 Nov 2026 17:18:03 -0300
> +Subject: [PATCH] intl: Restrict path traversal when using LANGUAGE env var [BZ
> + #17142, CVE-2026-84243]
> +
> +The fix for CVE-2014-0475 (Bug 17137) added valid_locale_name() in
> +locale/findlocale.c to reject locale names containing ".." path
> +components.  However, the LANGUAGE environment variable processing in
> +intl/dcigettext.c was not covered by that fix.  An attacker who can
> +set LANGUAGE (e.g. via SSH AcceptEnv) can force any gettext-using
> +program to load a crafted .mo file from an arbitrary filesystem
> +location via directory traversal.  A crafted .mo file can crash the
> +program through out-of-range offsets or through format-string
> +translations that consume more arguments than the caller passes,
> +causing undefined behaviour in *printf.  glibc cannot fully protect
> +against the latter at the gettext level.  The safety of .mo files
> +normally relies on them being produced by msgmerge and msgfmt -c and
> +installed in read-only locations; path traversal bypasses this trust
> +model.
> +
> +Remove the ENABLE_SECURE gate from the IS_PATH_WITH_DIR check so it
> +applies to all binaries, not just SUID/SGID ones, and extend it to
> +also reject the bare ".." entry which contains no directory separator
> +but still names the parent directory.
> +
> +Add tst-gettext-path-traversal to verify that locale names containing
> +path separators or equal to ".." are rejected by the LANGUAGE processing loop.
> +
> +This fixes bug 17142 and CVE-2026-84243.
> +
> +CVE: CVE-2026-84243
> +Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=03067f3c5e39aec5ec250a44bc1b395a1afd45e8]
> +
> +Backport Changes:
> +- Omit the NEWS hunk for the later 2.45 release section, which is absent
> +  from the 2.43 branch.
> +- Adjust intl/Makefile context for the 2.43 layout, retaining the upstream
> +  test registration, catalog and locale prerequisites, and OBJPFX flag.
> +
> +Suggested-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
> +Signed-off-by: Avinal Kumar <avinal.xlvii@gmail.com>
> +Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
> +Signed-off-by: Hetvi Thakar <hthakar@cisco.com>

Hello,

If I'm not mistaken upstream backported this patch to the 2.43 branch in
commit 45e49b1ea2e5 ("intl: Restrict path traversal when using LANGUAGE
env var [BZ #17142, CVE-2026-84243]").

I think we should update to the tip of the 2.43 branch instead.

Regards,
-- 
Yoann Congal
Smile ECS