diff --git a/SPECS/ntp/CVE-2026-63381.patch b/SPECS/ntp/CVE-2026-63381.patch new file mode 100644 index 00000000000..014f27aaa07 --- /dev/null +++ b/SPECS/ntp/CVE-2026-63381.patch @@ -0,0 +1,40 @@ +From 034687b2b79e1bb2d7bc77fd42dce15b6dd8cbd1 Mon Sep 17 00:00:00 2001 +From: Alexis +Date: Tue, 9 Jun 2026 15:09:05 +0200 +Subject: [PATCH] Fix a dangling pointer in evbuffer_add_buffer_reference. + +If `evbuffer_add_buffer_reference` was called to add a reference to +an empty buffer, the resulting code would produce dangling pointers +that could later lead to a use-after-free. + +Fixes GHSA-c2pj-cg4r-88c8. + +Tracking: X8. +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/9db091b04f569be3a700fa9860ef02f90b830af9.patch +--- + sntp/libevent/buffer.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/sntp/libevent/buffer.c b/sntp/libevent/buffer.c +index 3524b35..f68f31c 100644 +--- a/sntp/libevent/buffer.c ++++ b/sntp/libevent/buffer.c +@@ -1038,8 +1038,13 @@ evbuffer_add_buffer_reference(struct evbuffer *outbuf, struct evbuffer *inbuf) + + if (out_total_len == 0) { + /* There might be an empty chain at the start of outbuf; free +- * it. */ ++ * it. Reset the chain pointers afterwards so the subsequent ++ * APPEND_CHAIN_MULTICAST does not dereference the freed chain ++ * through outbuf->first / last_with_datap. */ + evbuffer_free_all_chains(outbuf->first); ++ outbuf->first = NULL; ++ outbuf->last = NULL; ++ outbuf->last_with_datap = &outbuf->first; + } + APPEND_CHAIN_MULTICAST(outbuf, inbuf); + +-- +2.45.4 + diff --git a/SPECS/ntp/CVE-2026-63382.patch b/SPECS/ntp/CVE-2026-63382.patch new file mode 100644 index 00000000000..e509d5d66e0 --- /dev/null +++ b/SPECS/ntp/CVE-2026-63382.patch @@ -0,0 +1,35 @@ +From 6e74a489c83d65b9a2526970717006e97acc1b96 Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Fri, 26 Jun 2026 08:32:25 -0400 +Subject: [PATCH] http: Treat CRLF strictly in HTTP chunks. + +According to RFC 9112, we can't treat LF alone as a terminator in +the chunked encoding. + +Reported by @xclow3n + +Part of GHSA-q39v-w2g7-gr8j + +Tracking: X11 +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e.patch +--- + sntp/libevent/http.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sntp/libevent/http.c b/sntp/libevent/http.c +index 04f089b..a993bfd 100644 +--- a/sntp/libevent/http.c ++++ b/sntp/libevent/http.c +@@ -925,7 +925,7 @@ evhttp_handle_chunked_read(struct evhttp_request *req, struct evbuffer *buf) + if (req->ntoread < 0) { + /* Read chunk size */ + ev_int64_t ntoread; +- char *p = evbuffer_readln(buf, NULL, EVBUFFER_EOL_CRLF); ++ char *p = evbuffer_readln(buf, NULL, EVBUFFER_EOL_CRLF_STRICT); + char *endp; + int error; + if (p == NULL) +-- +2.45.4 + diff --git a/SPECS/ntp/CVE-2026-63383.patch b/SPECS/ntp/CVE-2026-63383.patch new file mode 100644 index 00000000000..a7c34591592 --- /dev/null +++ b/SPECS/ntp/CVE-2026-63383.patch @@ -0,0 +1,42 @@ +From 8ca99a0d3ddd7ba214c16f28be697901d560c9c5 Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Wed, 24 Jun 2026 09:53:23 -0400 +Subject: [PATCH] evrpc: Fix out-of-bounds read in decode_tag_internal + +This bug could allow an attacker to cause an evrpc client or server +to read out of bounds when decoding a tag. + +Fixes GHSA-fj29-64w6-73h6. + +Reported by @Brubbish. + +Tracking: X5. +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb.patch +--- + sntp/libevent/event_tagging.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/sntp/libevent/event_tagging.c b/sntp/libevent/event_tagging.c +index b021e8c..c8f7b74 100644 +--- a/sntp/libevent/event_tagging.c ++++ b/sntp/libevent/event_tagging.c +@@ -210,12 +210,13 @@ decode_tag_internal(ev_uint32_t *ptag, struct evbuffer *evbuf, int dodrain) + * the encoding of a number is at most one byte more than its + * storage size. however, it may also be much smaller. + */ ++ size_t pullup_len = len < sizeof(number) + 1 ? len : sizeof(number) + 1; + data = evbuffer_pullup( +- evbuf, len < sizeof(number) + 1 ? len : sizeof(number) + 1); ++ evbuf, pullup_len); + if (!data) + return (-1); + +- while (count++ < len) { ++ while (count++ < pullup_len) { + ev_uint8_t lower = *data++; + if (shift >= 28) { + /* Make sure it fits into 32 bits */ +-- +2.45.4 + diff --git a/SPECS/ntp/CVE-2026-63384.patch b/SPECS/ntp/CVE-2026-63384.patch new file mode 100644 index 00000000000..502a72086d0 --- /dev/null +++ b/SPECS/ntp/CVE-2026-63384.patch @@ -0,0 +1,54 @@ +From 80fb12b908a2b3340ee2daf1dae8254ab5d51502 Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Wed, 24 Jun 2026 10:08:22 -0400 +Subject: [PATCH] evrpc: Fix integer overflow in evtag_unmarshal_header. + +On platforms where int is 32 bits, if this function tried to decode +a header declaring a payload longer than INT_MAX bytes long, this +function would return a negative value, which could cause incorrect +behaviors, incorrect allocations, or denial-of-service. + +We solve this (for now) by rejecting any payload length larger +than INT_MAX. + +Fixes GHSA-45c6-qx49-89m8 + +Reported by @Brubbish + +Tracking: X5 +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416.patch +--- + sntp/libevent/event_tagging.c | 2 +- + sntp/libevent/include/event2/tag.h | 2 ++ + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sntp/libevent/event_tagging.c b/sntp/libevent/event_tagging.c +index c8f7b74..9ee642b 100644 +--- a/sntp/libevent/event_tagging.c ++++ b/sntp/libevent/event_tagging.c +@@ -446,7 +446,7 @@ evtag_unmarshal_header(struct evbuffer *evbuf, ev_uint32_t *ptag) + + if (decode_tag_internal(ptag, evbuf, 1 /* dodrain */) == -1) + return (-1); +- if (evtag_decode_int(&len, evbuf) == -1) ++ if (evtag_decode_int(&len, evbuf) == -1 || len > INT_MAX) + return (-1); + + if (evbuffer_get_length(evbuf) < len) +diff --git a/sntp/libevent/include/event2/tag.h b/sntp/libevent/include/event2/tag.h +index 2f73bfc..ac13049 100644 +--- a/sntp/libevent/include/event2/tag.h ++++ b/sntp/libevent/include/event2/tag.h +@@ -64,6 +64,8 @@ void evtag_init(void); + /** + Unmarshals the header and returns the length of the payload + ++ Returns an error if the payload length is above INT_MAX. ++ + @param evbuf the buffer from which to unmarshal data + @param ptag a pointer in which the tag id is being stored + @returns -1 on failure or the number of bytes in the remaining payload. +-- +2.45.4 + diff --git a/SPECS/ntp/CVE-2026-63385.patch b/SPECS/ntp/CVE-2026-63385.patch new file mode 100644 index 00000000000..9bdc9acaadc --- /dev/null +++ b/SPECS/ntp/CVE-2026-63385.patch @@ -0,0 +1,46 @@ +From 4dbb5c63c0eaf28fda8c042f114b6604f5ed1362 Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Fri, 26 Jun 2026 09:08:47 -0400 +Subject: [PATCH] http: Reject headers containing CRLF. + +This causes us to reject obfs-fold, which is deprecated in RFC 9112. + +Otherwise, we would have a header injection opportunity for +certain proxy chains. + +Reported by @AsafMeizner + +Part of GHSA-jcwh-pvf2-73p2 + +Tracking: X10. +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0.patch +--- + sntp/libevent/http.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/sntp/libevent/http.c b/sntp/libevent/http.c +index a993bfd..8b1fa75 100644 +--- a/sntp/libevent/http.c ++++ b/sntp/libevent/http.c +@@ -1955,13 +1955,11 @@ evhttp_header_is_valid_value(const char *value) + { + const char *p = value; + +- while ((p = strpbrk(p, "\r\n")) != NULL) { +- /* we really expect only one new line */ +- p += strspn(p, "\r\n"); +- /* we expect a space or tab for continuation */ +- if (*p != ' ' && *p != '\t') +- return (0); ++ if (strpbrk(p, "\r\n") != NULL) { ++ /* Reject any header containing CR or LF. */ ++ return (0); + } ++ + return (1); + } + +-- +2.45.4 + diff --git a/SPECS/ntp/CVE-2026-63387.patch b/SPECS/ntp/CVE-2026-63387.patch new file mode 100644 index 00000000000..02800711a1d --- /dev/null +++ b/SPECS/ntp/CVE-2026-63387.patch @@ -0,0 +1,43 @@ +From 2440f2465da3e44f66b5249e326dbf9088507955 Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Wed, 24 Jun 2026 09:08:43 -0400 +Subject: [PATCH] evdns: Fix out-of-bounds write in dnsname_to_labels +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This bug would cause the program to write a single 0 byte off the +end of a stack buffer, if the code ever tried to make a DNS response +exactly 2^16 + 1 bytes long, ending with a DNS name. + +Resolves issue GHSA-58rx-7448-jw47. + +This issue was identified by Michał Majchrowicz and +Marcin Wyczechowski, members of the AFINE Team. + +Tracking: X1 +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/377b9022c3ac61aa4540b5dc4b70c60bf74c663d.patch +--- + sntp/libevent/evdns.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sntp/libevent/evdns.c b/sntp/libevent/evdns.c +index a5b31a3..8ddff8b 100644 +--- a/sntp/libevent/evdns.c ++++ b/sntp/libevent/evdns.c +@@ -1671,7 +1671,10 @@ dnsname_to_labels(u8 *const buf, size_t buf_len, off_t j, + /* the labels must be terminated by a 0. */ + /* It's possible that the name ended in a . */ + /* in which case the zero is already there */ +- if (!j || buf[j-1]) buf[j++] = 0; ++ if ((size_t)j >= buf_len) ++ return -2; ++ if (!j || buf[j-1]) ++ buf[j++] = 0; + return j; + overflow: + return (-2); +-- +2.45.4 + diff --git a/SPECS/ntp/CVE-2026-63388.patch b/SPECS/ntp/CVE-2026-63388.patch new file mode 100644 index 00000000000..c637b195174 --- /dev/null +++ b/SPECS/ntp/CVE-2026-63388.patch @@ -0,0 +1,138 @@ +From 73cdd4b71d3153180fb1934993b880afc3ca6048 Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Wed, 24 Jun 2026 09:33:02 -0400 +Subject: [PATCH] bufferevent: Fix heap out-of-bounds write via + AF_UNIX+http+NDEBUG + +When running an evhttp server over an AF_UNIX socket, +on a copy of libevent compiled with NDEBUG, +it was possible for an attacker to use a crafted AF_UNIX address to +cause a heap overflow when recording the address. + +This issue could also be triggered by direct calls +to the internal function bufferevent_socket_set_conn_address_ +on a copy of libevent compiled with NDEBUG. + +This bug still affected copies of libevent compiled without NDEBUG: +except that under those conditions, it would cause an assertion +failure with an abort() rather than a heap overflow. + +As a fix: + - We check the length of the provided address unconditionally + (regardless of NDEBUG) + - We handle failures caused by the provided address being too long. + - We allocate enough room to store an AF_UNIX address. + +Resolves GHSA-cvq5-vrvr-j338. + +Reported by @mat-mo. + +Tracking: X3 +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/52057cb33d0c20c0a0453fbabe6c0c96854931b9.patch +--- + sntp/libevent/bufferevent-internal.h | 11 ++++++----- + sntp/libevent/bufferevent_sock.c | 17 ++++++++++++----- + sntp/libevent/http.c | 4 +++- + 3 files changed, 21 insertions(+), 11 deletions(-) + +diff --git a/sntp/libevent/bufferevent-internal.h b/sntp/libevent/bufferevent-internal.h +index 87ab9ad..dfb6384 100644 +--- a/sntp/libevent/bufferevent-internal.h ++++ b/sntp/libevent/bufferevent-internal.h +@@ -34,6 +34,7 @@ extern "C" { + #include "event2/event_struct.h" + #include "evconfig-private.h" + #include "event2/util.h" ++#include "util-internal.h" + #include "defer-internal.h" + #include "evthread-internal.h" + #include "event2/thread.h" +@@ -224,10 +225,10 @@ struct bufferevent_private { + * So we need to save it, just after we connected to remote server, or + * after resolving (to avoid extra dns requests during retrying, since UDP + * is slow) */ +- union { +- struct sockaddr_in6 in6; +- struct sockaddr_in in; +- } conn_address; ++ /* NOTE: it might be nice to use fewer bytes here, but we need to store ++ * sockaddr_un sometimes in order to make AF_UNIX sockets work as expected ++ * with sntp/libevent/http.c. */ ++ struct sockaddr_storage conn_address; + + struct evdns_getaddrinfo_request *dns_request; + }; +@@ -449,7 +450,7 @@ void + bufferevent_socket_set_conn_address_fd_(struct bufferevent *bev, evutil_socket_t fd); + + EVENT2_EXPORT_SYMBOL +-void ++int + bufferevent_socket_set_conn_address_(struct bufferevent *bev, struct sockaddr *addr, size_t addrlen); + + +diff --git a/sntp/libevent/bufferevent_sock.c b/sntp/libevent/bufferevent_sock.c +index f40a8d9..543fce4 100644 +--- a/sntp/libevent/bufferevent_sock.c ++++ b/sntp/libevent/bufferevent_sock.c +@@ -116,13 +116,17 @@ bufferevent_socket_set_conn_address_fd_(struct bufferevent *bev, + getpeername(fd, addr, &len); + } + +-void ++int + bufferevent_socket_set_conn_address_(struct bufferevent *bev, + struct sockaddr *addr, size_t addrlen) + { + struct bufferevent_private *bev_p = BEV_UPCAST(bev); +- EVUTIL_ASSERT(addrlen <= sizeof(bev_p->conn_address)); +- memcpy(&bev_p->conn_address, addr, addrlen); ++ if (addrlen <= sizeof(bev_p->conn_address)) { ++ memcpy(&bev_p->conn_address, addr, addrlen); ++ return 0; ++ } else { ++ return EVUTIL_EAI_FAIL; ++ } + } + + static void +@@ -472,6 +476,11 @@ bufferevent_connect_getaddrinfo_cb(int result, struct evutil_addrinfo *ai, + bufferevent_decref_and_unlock_(bev); + return; + } ++ if (result == 0) { ++ /* XXX use the other addrinfos? */ ++ result = bufferevent_socket_set_conn_address_( ++ bev, ai->ai_addr, (int)ai->ai_addrlen); ++ } + if (result != 0) { + bev_p->dns_error = result; + bufferevent_run_eventcb_(bev, BEV_EVENT_ERROR, 0); +@@ -481,8 +490,6 @@ bufferevent_connect_getaddrinfo_cb(int result, struct evutil_addrinfo *ai, + return; + } + +- /* XXX use the other addrinfos? */ +- bufferevent_socket_set_conn_address_(bev, ai->ai_addr, (int)ai->ai_addrlen); + r = bufferevent_socket_connect(bev, ai->ai_addr, (int)ai->ai_addrlen); + if (r < 0) + bufferevent_run_eventcb_(bev, BEV_EVENT_ERROR, 0); +diff --git a/sntp/libevent/http.c b/sntp/libevent/http.c +index 8b1fa75..474d8c2 100644 +--- a/sntp/libevent/http.c ++++ b/sntp/libevent/http.c +@@ -4271,7 +4271,9 @@ evhttp_get_request_connection( + goto err; + if (bufferevent_disable(evcon->bufev, EV_WRITE)) + goto err; +- bufferevent_socket_set_conn_address_(evcon->bufev, sa, salen); ++ if (bufferevent_socket_set_conn_address_(evcon->bufev, sa, salen)) { ++ goto err; ++ } + + return (evcon); + +-- +2.45.4 + diff --git a/SPECS/ntp/ntp.spec b/SPECS/ntp/ntp.spec index 9c99d30c37c..1d3d24ff9a4 100644 --- a/SPECS/ntp/ntp.spec +++ b/SPECS/ntp/ntp.spec @@ -1,7 +1,7 @@ Summary: Network Time Protocol reference implementation Name: ntp Version: 4.2.8p17 -Release: 2%{?dist} +Release: 3%{?dist} License: BSD AND GPLv2+ AND LGPLv2+ AND MIT AND OpenLDAP AND Public Domain Vendor: Microsoft Corporation Distribution: Azure Linux @@ -17,6 +17,13 @@ Source5: ntpdate.sysconfig Source6: ntpdate.service Source7: ntpd.service Source8: LICENSE.PTR +Patch0: CVE-2026-63381.patch +Patch1: CVE-2026-63382.patch +Patch2: CVE-2026-63383.patch +Patch3: CVE-2026-63384.patch +Patch4: CVE-2026-63385.patch +Patch5: CVE-2026-63387.patch +Patch6: CVE-2026-63388.patch BuildRequires: gcc >= 11.2.0 BuildRequires: glibc >= 2.34 @@ -62,6 +69,13 @@ state of the NTP daemon running on the local machine. %prep %setup -q -a 1 +%patch 0 -p1 +%patch 1 -p1 +%patch 2 -p1 +%patch 3 -p1 +%patch 4 -p1 +%patch 5 -p1 +%patch 6 -p1 %build @@ -197,6 +211,9 @@ fi %{_mandir}/man8/ntpstat.8* %changelog +* Tue Aug 25 2026 Azure Linux Security Servicing Account - 4.2.8p17-3 +- Patch for CVE-2026-63388, CVE-2026-63387, CVE-2026-63385, CVE-2026-63384, CVE-2026-63383, CVE-2026-63382, CVE-2026-63381 + * Tue Mar 17 2026 Sudipta Pandit - 4.2.8p17-2 - Fix ntpdate-wrapper to use /usr/bin/ntpdate