diff --git a/_gdb.spec.Patch.include b/_gdb.spec.Patch.include index 8b2de20557a6f11c5e0d77f72a8188315dde4583..de8874543f11e6517797e37901e7c0d8c0b42a8d 100644 --- a/_gdb.spec.Patch.include +++ b/_gdb.spec.Patch.include @@ -21,6 +21,10 @@ Patch0005: CVE-2025-11494-x86-Keep-_GLOBAL_OFFSET_TABLE_-for-.eh_frame.patch # https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f6b0f53a36820da91eadfa9f466c22f92e4256e0 Patch0006: CVE-2025-11840-SEGV-in-vfinfo-at-ldmisc.c-527.patch +# CVE-2026-13732 +# https://gitlab.com/gnutools/binutils-gdb/-/commit/496e05a32afe498db1f1cc76cde5defce9cbd185 +Patch0007: gdb-13.2-CVE-2026-13732.patch + # Check distro name is included in the version output. Patch3001: gdb-6.3-rh-testversion-20041202.patch diff --git a/_gdb.spec.patch.include b/_gdb.spec.patch.include index 825717305ac0a17b3337682e2834ee0665137627..5a387158c9380cd9a25ba1b0f51f24325f683fd8 100644 --- a/_gdb.spec.patch.include +++ b/_gdb.spec.patch.include @@ -4,6 +4,7 @@ %patch 0004 -p1 %patch 0005 -p1 %patch 0006 -p1 +%patch 0007 -p1 %patch 3001 -p1 %patch 3002 -p1 diff --git a/gdb-13.2-CVE-2026-13732.patch b/gdb-13.2-CVE-2026-13732.patch new file mode 100644 index 0000000000000000000000000000000000000000..a712d93707dadbea7d6d903e7b816c9bbfc706e6 --- /dev/null +++ b/gdb-13.2-CVE-2026-13732.patch @@ -0,0 +1,242 @@ +From eaea19f98d87e95d6b9a05a902e6a0c5d736774d Mon Sep 17 00:00:00 2001 +From: Guinevere Larsen +Date: Wed, 12 Feb 2025 10:40:06 -0300 +Subject: [PATCH] [gdb/stabs] Fix out-of-bounds write in read_member_functions + +CVE-2026-13732 reports: +... +gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf + +A flaw was found in GDB's STABS debug format parser. The read_member_functions() +function in gdb/stabsread.c contains a linked list removal bug in the code that +separates destructor and non-destructor member functions of C++ classes. The bug +causes the destructor entries to remain in the main function list while the list +length counter is decremented, resulting in an out-of-bounds write when the +function list is copied to its final allocated array. An attacker can craft an +ELF binary with malicious .stab and .stabstr sections that triggers this +out-of-bounds write when a user opens the file in GDB and performs any +symbol-inspection operation such as setting a breakpoint. The inferior process +does not need to be executed. Under controlled conditions, this was demonstrated +to achieve execution of arbitrary commands within the GDB process. +... + +AFAIU from gdb/SECURITY.txt: +... + There are known bugs in GDB related to loading malformed executables + and parsing the debug information, a consequence of these bugs is + that a malicious program could trigger undefined behavior in GDB, + which could be used to trigger arbitrary code execution. + + Given these risks, the advice of the GDB project is that, when using + GDB with an untrusted binary, always do so in a secure, sandboxed + environment. + + As there are already known bugs in GDB relating to undefined + behavior triggered from malformed programs, further bugs in this + area should still be reported, but are unlikely to be given high + priority. Bugs in GDB that are triggered by well-formed programs + should also be reported, and are likely to be treated as higher + priority as these are more likely to impact normal use of GDB. +... +this is not a high priority. Still, it's worthwhile fixing this. + +The problem is single-linked list update logic. + +I wrote a stand alone reproducer containing fix and unit test: +... + #include + #include + + #ifndef FIX + #define FIX 0 + #endif + + #ifndef VERBOSE + #define VERBOSE 0 + #endif + +struct s +{ + int i; + struct s *next; +}; + +static int test_mode = 0; +static int max_test_mode = 11; + +static int +test (int i) +{ + switch (test_mode) + { + case 0: + return 0; + case 1: + return 1; + case 2: + return i % 2 == 0; + case 3: + return i % 2 == 1; + case 4: + return i == 1; + case 5: + return i != 1; + case 6: + return i == 6; + case 7: + return i != 6; + case 8: + return i >= 5; + case 9: + return !(i >= 5); + case 10: + return (i == 3 || i == 4); + case 11: + return !(i == 3 || i == 4); + default: + assert (0); + } +} + +static struct s * +filter (struct s *sublist) +{ + struct s *tmp_sublist; + struct s *last_sublist; + + tmp_sublist = sublist; + last_sublist = NULL; + while (tmp_sublist != NULL) + { + if (test (tmp_sublist->i)) + { + if (FIX) + last_sublist = tmp_sublist; + tmp_sublist = tmp_sublist->next; + continue; + } + + if (last_sublist) + last_sublist->next = tmp_sublist->next; + else + sublist = tmp_sublist->next; + if (!FIX) + last_sublist = tmp_sublist; + tmp_sublist = tmp_sublist->next; + } + + return sublist; +} + +struct s s1, s2, s3, s4, s5, s6; + +static int +init (int i) +{ + s1.i = 1; + s2.i = 2; + s3.i = 3; + s4.i = 4; + s5.i = 5; + s6.i = 6; + + s1.next = NULL; + s2.next = &s1; + s3.next = &s2; + s4.next = &s3; + s5.next = &s4; + s6.next = &s5; + + switch (i) + { + case 0: + return 6; + case 1: + s5.next = NULL; + return 2; + case 2: + s6.next = NULL; + return 1; + default: + assert (false); + } +} + +int +main () +{ + assert (filter (NULL) == NULL); + + for (int i = 0; i < 3; ++i) + for (test_mode = 0; test_mode <= max_test_mode; ++test_mode) + { + int len = init (i); + + struct s *res = filter (&s6); + + if (VERBOSE) + { + printf ("EXPECTED: "); + for (int i = 6; i > 6 - len; --i) + if (test (i)) + printf (" %d", i); + printf ("\n"); + + printf ("ACTUAL : "); + for (struct s *elem = res; elem != NULL; elem = elem->next) + printf (" %d", elem->i); + printf ("\n"); + } + + for (struct s *elem = res; elem != NULL; elem = elem->next) + assert (test (elem->i)); + + struct s *elem = res; + for (int i = 6; i > 6 - len; --i) + if (test (i)) + { + assert (i == elem->i); + elem = elem->next; + } + assert (elem == NULL); + } + + return 0; +} +... + +This patch applies the same fix in read_member_functions. + +Relevant links: +- http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-13732 +- https://www.cve.org/CVERecord?id=CVE-2026-13732 +- https://access.redhat.com/security/cve/CVE-2026-13732 +- https://bugzilla.redhat.com/show_bug.cgi?id=2494416 + +Approved-By: default avatarSimon Marchi +Adapted-by: PkgAgent/deepseek-v4 (modified to adapt to opencloudos-stream) + +--- + gdb/stabsread.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/gdb/stabsread.c b/gdb/stabsread.c +index 8d1b998..ac58337 100644 +--- a/gdb/stabsread.c ++++ b/gdb/stabsread.c +@@ -2607,6 +2607,7 @@ read_member_functions (struct stab_field_info *fip, const char **pp, + { + if (!is_destructor_name (tmp_sublist->fn_field.physname)) + { ++ last_sublist = tmp_sublist; + tmp_sublist = tmp_sublist->next; + continue; + } +@@ -2617,7 +2618,6 @@ read_member_functions (struct stab_field_info *fip, const char **pp, + last_sublist->next = tmp_sublist->next; + else + sublist = tmp_sublist->next; +- last_sublist = tmp_sublist; + tmp_sublist = tmp_sublist->next; + } + diff --git a/gdb.spec b/gdb.spec index 7d01dda337b7e76ea0c45c62e5e34c526243ce40..c0cb49f03e90b071ee90459b98d9234a7e19ec14 100644 --- a/gdb.spec +++ b/gdb.spec @@ -18,7 +18,7 @@ Summary: A GNU source-level debugger for C, C++, Fortran, Go and other languages Name: gdb Version: 13.2 -Release: 10%{?dist} +Release: 11%{?dist} License: GPLv3+ and GPLv3+ with exceptions and GPLv2+ and GPLv2+ with exceptions and GPL+ and LGPLv2+ and LGPLv3+ and BSD and Public Domain and GFDL URL: https://gnu.org/software/gdb/ Source0: https://ftp.gnu.org/gnu/gdb/gdb-%{version}.tar.xz @@ -414,6 +414,10 @@ done %changelog +* Wed Sep 23 2026 PkgAgent Robot - 13.2-11 +- [Type] security +- [DESC] Fix CVE-2026-13732: out-of-bounds write in STABS read_member_functions() + * Mon Dec 1 2025 Chunsheng Luo - 13.2-10 - Don't allow a howto witha NULL name [CVE-2025-11840]