From 072a9683bd9ea5bb73b87872be950b1fba909674 Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Wed, 15 Jul 2026 11:38:13 +0000 Subject: [PATCH 1/2] Patch gawk for CVE-2026-40553, CVE-2026-40468, CVE-2026-40467 --- SPECS/gawk/CVE-2026-40467.patch | 47 ++++++++++++++++ SPECS/gawk/CVE-2026-40468.patch | 56 +++++++++++++++++++ SPECS/gawk/CVE-2026-40553.patch | 33 +++++++++++ SPECS/gawk/gawk.spec | 11 +++- .../manifests/package/pkggen_core_aarch64.txt | 2 +- .../manifests/package/pkggen_core_x86_64.txt | 2 +- .../manifests/package/toolchain_aarch64.txt | 4 +- .../manifests/package/toolchain_x86_64.txt | 4 +- 8 files changed, 152 insertions(+), 7 deletions(-) create mode 100644 SPECS/gawk/CVE-2026-40467.patch create mode 100644 SPECS/gawk/CVE-2026-40468.patch create mode 100644 SPECS/gawk/CVE-2026-40553.patch diff --git a/SPECS/gawk/CVE-2026-40467.patch b/SPECS/gawk/CVE-2026-40467.patch new file mode 100644 index 00000000000..5ae6d3f9002 --- /dev/null +++ b/SPECS/gawk/CVE-2026-40467.patch @@ -0,0 +1,47 @@ +From 9200a51da72344ef2a24d367015a5cfcfec15ad4 Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Wed, 15 Jul 2026 11:30:59 +0000 +Subject: [PATCH] Small memory management fix in io.c. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://cgit.git.savannah.gnu.org/cgit/gawk.git/patch/?id=a2d18c74109e41bec29a23098eba2e00057286d8 +--- + io.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/io.c b/io.c +index 5eda8f9..b915d11 100644 +--- a/io.c ++++ b/io.c +@@ -2820,23 +2820,27 @@ do_getline_redir(int into_variable, enum redirval redirtype) + + assert(redirtype != redirect_none); + redir_exp = TOP(); ++ redir_exp = elem_new_to_scalar(redir_exp); + rp = redirect(redir_exp, redirtype, & redir_error, false); +- DEREF(redir_exp); + decr_sp(); + if (rp == NULL) { + if (redir_error) { /* failed redirect */ + if (! do_traditional) + update_ERRNO_int(redir_error); + } ++ DEREF(redir_exp); + return make_number((AWKNUM) -1.0); + } else if ((rp->flag & RED_TWOWAY) != 0 && rp->iop == NULL) { + if (is_non_fatal_redirect(redir_exp->stptr, redir_exp->stlen)) { + update_ERRNO_int(EBADF); ++ DEREF(redir_exp); + return make_number((AWKNUM) -1.0); + } + (void) close_rp(rp, CLOSE_ALL); ++ DEREF(redir_exp); // we're about to die, but what the heck, release it anyway + fatal(_("getline: attempt to read from closed read end of two-way pipe")); + } ++ DEREF(redir_exp); + iop = rp->iop; + if (iop == NULL) /* end of input */ + return make_number((AWKNUM) 0.0); +-- +2.45.4 + diff --git a/SPECS/gawk/CVE-2026-40468.patch b/SPECS/gawk/CVE-2026-40468.patch new file mode 100644 index 00000000000..6ff680e63c8 --- /dev/null +++ b/SPECS/gawk/CVE-2026-40468.patch @@ -0,0 +1,56 @@ +From df552a38ae544bd61d79761919a090289bf9b3de Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Wed, 15 Jul 2026 11:30:45 +0000 +Subject: [PATCH] Minor integer overflow fixes. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://cgit.git.savannah.gnu.org/cgit/gawk.git/patch/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7 +--- + builtin.c | 10 +++++++++- + node.c | 8 ++++++++ + 2 files changed, 17 insertions(+), 1 deletion(-) + +diff --git a/builtin.c b/builtin.c +index 0e60922..bba7346 100644 +--- a/builtin.c ++++ b/builtin.c +@@ -1,3 +1,11 @@ ++2026-04-04 Arnold D. Robbins ++ ++ * builtin.c (do_sub): Make `sofar' be size_t to avoid ++ integer overflows. Thanks to Michał Majchrowicz ++ for the report. ++ * node.c (parse_escape): Change `i' to int64_t to avoid ++ overflows. Thanks to ASan with gcc -m32. ++ + /* + * builtin.c - Builtin functions and various utility procedures. + */ +@@ -2983,7 +2991,7 @@ do_sub(int nargs, unsigned int flags) + char *repl; + char *replend; + size_t repllen; +- int sofar; ++ size_t sofar; + int ampersands; + int matches = 0; + Regexp *rp; +diff --git a/node.c b/node.c +index 6c9a730..cca9701 100644 +--- a/node.c ++++ b/node.c +@@ -1,3 +1,11 @@ ++2026-04-04 Arnold D. Robbins ++ ++ * builtin.c (do_sub): Make `sofar' be size_t to avoid ++ integer overflows. Thanks to Michał Majchrowicz ++ for the report. ++ * node.c (parse_escape): Change `i' to int64_t to avoid ++ overflows. Thanks to ASan with gcc -m32. ++ + /* + * node.c -- routines for node management + */ +-- +2.45.4 + diff --git a/SPECS/gawk/CVE-2026-40553.patch b/SPECS/gawk/CVE-2026-40553.patch new file mode 100644 index 00000000000..d3b0a5e1774 --- /dev/null +++ b/SPECS/gawk/CVE-2026-40553.patch @@ -0,0 +1,33 @@ +From 6fc71baa7f4f2a6bb75327fbc6b8112adecf04c5 Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Wed, 15 Jul 2026 11:31:16 +0000 +Subject: [PATCH] Avoid buffer overflow in extension/readdir.c. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://cgit.git.savannah.gnu.org/cgit/gawk.git/patch/?id=cca0366144336b49aaa7d5d949966ce8e2c70843 +--- + extension/readdir.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/extension/readdir.c b/extension/readdir.c +index e367ff1..2d169e8 100644 +--- a/extension/readdir.c ++++ b/extension/readdir.c +@@ -110,10 +110,11 @@ ftype(struct dirent *entry, const char *dirname) + #endif + char fname[PATH_MAX]; + struct stat sbuf; ++ int count; + +- strcpy(fname, dirname); +- strcat(fname, "/"); +- strcat(fname, entry->d_name); ++ count = snprintf(fname, sizeof(fname), "%s/%s", dirname, entry->d_name); ++ if (count > sizeof(fname)) ++ return "u"; // buffer overflow. skip stat() call. + if (stat(fname, &sbuf) == 0) { + if (S_ISBLK(sbuf.st_mode)) + return "b"; +-- +2.45.4 + diff --git a/SPECS/gawk/gawk.spec b/SPECS/gawk/gawk.spec index 50dd7b09c6c..1bb98f1f203 100644 --- a/SPECS/gawk/gawk.spec +++ b/SPECS/gawk/gawk.spec @@ -1,13 +1,16 @@ Summary: Contains programs for manipulating text files Name: gawk Version: 5.2.2 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv3 Vendor: Microsoft Corporation Distribution: Azure Linux Group: Applications/File URL: https://www.gnu.org/software/gawk Source0: https://ftp.gnu.org/gnu/gawk/%{name}-%{version}.tar.xz +Patch0: CVE-2026-40467.patch +Patch1: CVE-2026-40468.patch +Patch2: CVE-2026-40553.patch Requires: gmp Requires: mpfr Requires: readline >= 7.0 @@ -20,6 +23,9 @@ The Gawk package contains programs for manipulating text files. %prep %setup -q +%patch 0 -p1 +%patch 1 -p1 +%patch 2 -p1 %build %configure \ @@ -63,6 +69,9 @@ make %{?_smp_mflags} check %{_sysconfdir}/profile.d/gawk.sh %changelog +* Wed Jul 15 2026 Azure Linux Security Servicing Account - 5.2.2-2 +- Patch for CVE-2026-40553, CVE-2026-40468, CVE-2026-40467 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 5.2.2-1 - Auto-upgrade to 5.2.2 - Azure Linux 3.0 - package upgrades diff --git a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt index 91f472d3e12..9d42626bd93 100644 --- a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt @@ -61,7 +61,7 @@ m4-1.4.19-2.azl3.aarch64.rpm grep-3.11-2.azl3.aarch64.rpm grep-lang-3.11-2.azl3.aarch64.rpm diffutils-3.10-1.azl3.aarch64.rpm -gawk-5.2.2-1.azl3.aarch64.rpm +gawk-5.2.2-2.azl3.aarch64.rpm findutils-4.9.0-1.azl3.aarch64.rpm findutils-lang-4.9.0-1.azl3.aarch64.rpm gettext-0.22-1.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index b766df23305..4e479cd7f6f 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -61,7 +61,7 @@ m4-1.4.19-2.azl3.x86_64.rpm grep-3.11-2.azl3.x86_64.rpm grep-lang-3.11-2.azl3.x86_64.rpm diffutils-3.10-1.azl3.x86_64.rpm -gawk-5.2.2-1.azl3.x86_64.rpm +gawk-5.2.2-2.azl3.x86_64.rpm findutils-4.9.0-1.azl3.x86_64.rpm findutils-lang-4.9.0-1.azl3.x86_64.rpm gettext-0.22-1.azl3.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index 899ed1aa0e4..63345d3ee70 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -110,8 +110,8 @@ findutils-lang-4.9.0-1.azl3.aarch64.rpm flex-2.6.4-7.azl3.aarch64.rpm flex-debuginfo-2.6.4-7.azl3.aarch64.rpm flex-devel-2.6.4-7.azl3.aarch64.rpm -gawk-5.2.2-1.azl3.aarch64.rpm -gawk-debuginfo-5.2.2-1.azl3.aarch64.rpm +gawk-5.2.2-2.azl3.aarch64.rpm +gawk-debuginfo-5.2.2-2.azl3.aarch64.rpm gcc-13.2.0-7.azl3.aarch64.rpm gcc-c++-13.2.0-7.azl3.aarch64.rpm gcc-debuginfo-13.2.0-7.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index 0748ab677d8..c14264f7fa6 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -115,8 +115,8 @@ findutils-lang-4.9.0-1.azl3.x86_64.rpm flex-2.6.4-7.azl3.x86_64.rpm flex-debuginfo-2.6.4-7.azl3.x86_64.rpm flex-devel-2.6.4-7.azl3.x86_64.rpm -gawk-5.2.2-1.azl3.x86_64.rpm -gawk-debuginfo-5.2.2-1.azl3.x86_64.rpm +gawk-5.2.2-2.azl3.x86_64.rpm +gawk-debuginfo-5.2.2-2.azl3.x86_64.rpm gcc-13.2.0-7.azl3.x86_64.rpm gcc-aarch64-linux-gnu-13.2.0-7.azl3.x86_64.rpm gcc-c++-13.2.0-7.azl3.x86_64.rpm From b5e5c699675bed5d9f60bdee605505b7db147b87 Mon Sep 17 00:00:00 2001 From: Akarsh Chaudhary Date: Thu, 16 Jul 2026 08:54:04 +0000 Subject: [PATCH 2/2] Making changes to patches to make them in sync with upstream patches. --- SPECS/gawk/CVE-2026-40467.patch | 23 ++++++++++++---- SPECS/gawk/CVE-2026-40468.patch | 48 +++++++++++++++++---------------- SPECS/gawk/CVE-2026-40553.patch | 22 ++++++++++++--- SPECS/gawk/gawk.spec | 10 ++++--- 4 files changed, 68 insertions(+), 35 deletions(-) diff --git a/SPECS/gawk/CVE-2026-40467.patch b/SPECS/gawk/CVE-2026-40467.patch index 5ae6d3f9002..7db6c448dd8 100644 --- a/SPECS/gawk/CVE-2026-40467.patch +++ b/SPECS/gawk/CVE-2026-40467.patch @@ -6,18 +6,31 @@ Subject: [PATCH] Small memory management fix in io.c. Signed-off-by: Azure Linux Security Servicing Account Upstream-reference: AI Backport of https://cgit.git.savannah.gnu.org/cgit/gawk.git/patch/?id=a2d18c74109e41bec29a23098eba2e00057286d8 --- - io.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) + ChangeLog | 6 ++++++ + io.c | 5 ++++- + 2 files changed, 10 insertions(+), 1 deletion(-) +diff --git a/ChangeLog b/ChangeLog +index ff8b13c..acacd31 100644 +--- a/ChangeLog ++++ b/ChangeLog +@@ -1,3 +1,9 @@ ++2026-04-03 Arnold D. Robbins ++ ++ * io.c (do_getline_redir): Don't DEREF redir_exp too early. ++ Thanks to Michał Majchrowicz ++ for the report. ++ + 2023-05-07 Arnold D. Robbins + + * 5.2.2: Release tar ball made. diff --git a/io.c b/io.c index 5eda8f9..b915d11 100644 --- a/io.c +++ b/io.c -@@ -2820,23 +2820,27 @@ do_getline_redir(int into_variable, enum redirval redirtype) - +@@ -2821,22 +2821,25 @@ do_getline_redir(int into_variable, enum redirval redirtype) assert(redirtype != redirect_none); redir_exp = TOP(); -+ redir_exp = elem_new_to_scalar(redir_exp); rp = redirect(redir_exp, redirtype, & redir_error, false); - DEREF(redir_exp); decr_sp(); diff --git a/SPECS/gawk/CVE-2026-40468.patch b/SPECS/gawk/CVE-2026-40468.patch index 6ff680e63c8..f2aa4fa0f7c 100644 --- a/SPECS/gawk/CVE-2026-40468.patch +++ b/SPECS/gawk/CVE-2026-40468.patch @@ -6,14 +6,15 @@ Subject: [PATCH] Minor integer overflow fixes. Signed-off-by: Azure Linux Security Servicing Account Upstream-reference: AI Backport of https://cgit.git.savannah.gnu.org/cgit/gawk.git/patch/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7 --- - builtin.c | 10 +++++++++- - node.c | 8 ++++++++ - 2 files changed, 17 insertions(+), 1 deletion(-) + ChangeLog | 8 ++++++++ + builtin.c | 2 +- + node.c | 2 +- + 3 files changed, 10 insertions(+), 2 deletions(-) -diff --git a/builtin.c b/builtin.c -index 0e60922..bba7346 100644 ---- a/builtin.c -+++ b/builtin.c +diff --git a/ChangeLog b/ChangeLog +index acacd31..f814e25 100644 +--- a/ChangeLog ++++ b/ChangeLog @@ -1,3 +1,11 @@ +2026-04-04 Arnold D. Robbins + @@ -23,10 +24,14 @@ index 0e60922..bba7346 100644 + * node.c (parse_escape): Change `i' to int64_t to avoid + overflows. Thanks to ASan with gcc -m32. + - /* - * builtin.c - Builtin functions and various utility procedures. - */ -@@ -2983,7 +2991,7 @@ do_sub(int nargs, unsigned int flags) + 2026-04-03 Arnold D. Robbins + + * io.c (do_getline_redir): Don't DEREF redir_exp too early. +diff --git a/builtin.c b/builtin.c +index 0e60922..bba7346 100644 +--- a/builtin.c ++++ b/builtin.c +@@ -2983,7 +2983,7 @@ do_sub(int nargs, unsigned int flags) char *repl; char *replend; size_t repllen; @@ -39,18 +44,15 @@ diff --git a/node.c b/node.c index 6c9a730..cca9701 100644 --- a/node.c +++ b/node.c -@@ -1,3 +1,11 @@ -+2026-04-04 Arnold D. Robbins -+ -+ * builtin.c (do_sub): Make `sofar' be size_t to avoid -+ integer overflows. Thanks to Michał Majchrowicz -+ for the report. -+ * node.c (parse_escape): Change `i' to int64_t to avoid -+ overflows. Thanks to ASan with gcc -m32. -+ - /* - * node.c -- routines for node management - */ +@@ -547,7 +547,7 @@ parse_escape(const char **string_ptr) + parse_escape(const char **string_ptr) + { + int c = *(*string_ptr)++; +- int i; ++ int64_t i; + int count; + int j; + const char *start; -- 2.45.4 diff --git a/SPECS/gawk/CVE-2026-40553.patch b/SPECS/gawk/CVE-2026-40553.patch index d3b0a5e1774..ce36c51058d 100644 --- a/SPECS/gawk/CVE-2026-40553.patch +++ b/SPECS/gawk/CVE-2026-40553.patch @@ -6,14 +6,29 @@ Subject: [PATCH] Avoid buffer overflow in extension/readdir.c. Signed-off-by: Azure Linux Security Servicing Account Upstream-reference: AI Backport of https://cgit.git.savannah.gnu.org/cgit/gawk.git/patch/?id=cca0366144336b49aaa7d5d949966ce8e2c70843 --- - extension/readdir.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) + extension/ChangeLog | 6 ++++++ + extension/readdir.c | 8 +++++--- + 2 files changed, 11 insertions(+), 3 deletions(-) +diff --git a/extension/ChangeLog b/extension/ChangeLog +index 3f80a79..360ff82 100644 +--- a/extension/ChangeLog ++++ b/extension/ChangeLog +@@ -1,3 +1,9 @@ ++2026-04-15 Arnold D. Robbins ++ ++ * readdir.c (ftype): Use snprintf() to check for buffer ++ overflow in the file name before calling stat(). Thanks to ++ Marcin Wyczechowski for the report. ++ + 2023-05-07 Arnold D. Robbins + + diff --git a/extension/readdir.c b/extension/readdir.c index e367ff1..2d169e8 100644 --- a/extension/readdir.c +++ b/extension/readdir.c -@@ -110,10 +110,11 @@ ftype(struct dirent *entry, const char *dirname) +@@ -110,10 +110,12 @@ ftype(struct dirent *entry, const char *dirname) #endif char fname[PATH_MAX]; struct stat sbuf; @@ -25,6 +40,7 @@ index e367ff1..2d169e8 100644 + count = snprintf(fname, sizeof(fname), "%s/%s", dirname, entry->d_name); + if (count > sizeof(fname)) + return "u"; // buffer overflow. skip stat() call. ++ if (stat(fname, &sbuf) == 0) { if (S_ISBLK(sbuf.st_mode)) return "b"; diff --git a/SPECS/gawk/gawk.spec b/SPECS/gawk/gawk.spec index 1bb98f1f203..f8ebb329fb7 100644 --- a/SPECS/gawk/gawk.spec +++ b/SPECS/gawk/gawk.spec @@ -22,10 +22,7 @@ Provides: awk The Gawk package contains programs for manipulating text files. %prep -%setup -q -%patch 0 -p1 -%patch 1 -p1 -%patch 2 -p1 +%autosetup -p1 %build %configure \ @@ -46,6 +43,9 @@ find %{buildroot} -type f -name "*.la" -delete -print # Skip the timeout test, which is unreliable on our (vm) build machines sed -i 's/ timeout / /' test/Makefile sed -i 's/ pty1 / /' test/Makefile +# Skip pma test - persistent memory allocator requires MAP_FIXED mmap +# which may not work reliably in chroot build environments +sed -i 's/$(MAKE) $(NEED_PMA)/echo "skipping pma test"/' test/Makefile # Generate locale for `en_US.iso88591` which is required for ptest # Ideally it should have been present. Investigate if its a `chroot` only issue @@ -71,6 +71,8 @@ make %{?_smp_mflags} check %changelog * Wed Jul 15 2026 Azure Linux Security Servicing Account - 5.2.2-2 - Patch for CVE-2026-40553, CVE-2026-40468, CVE-2026-40467 +- Skip pma (persistent memory allocator) test in chroot; it requires + MAP_FIXED mmap which is not reliable in build chroot environments. * Mon Oct 16 2023 CBL-Mariner Servicing Account - 5.2.2-1 - Auto-upgrade to 5.2.2 - Azure Linux 3.0 - package upgrades