Skip to content

Fix musl's CVE-2025-26519 #137127

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Feb 16, 2025
Merged

Fix musl's CVE-2025-26519 #137127

merged 1 commit into from
Feb 16, 2025

Conversation

pietroalbini
Copy link
Member

The musl project announced CVE-2025-26519, which could result in out-of-bounds writes when calling the iconv function. There is no musl release available with the fixes at this point in time (and we're using an older version of musl anyway), so this PR applies the provided patches on top of the musl source tarball we download.

@rustbot
Copy link
Collaborator

rustbot commented Feb 16, 2025

r? @Mark-Simulacrum

rustbot has assigned @Mark-Simulacrum.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

@rustbot rustbot added A-testsuite Area: The testsuite used to check the correctness of rustc S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-infra Relevant to the infrastructure team, which will review and decide on the PR/issue. labels Feb 16, 2025
@pietroalbini
Copy link
Member Author

@bors p=100

Security fix, I want to land this on master as soon as possible, so that we can consider applying it to the upcoming 1.85.0 release.

@pietroalbini pietroalbini added beta-nominated Nominated for backporting to the compiler in the beta channel. stable-nominated Nominated for backporting to the compiler in the stable channel. labels Feb 16, 2025
jieyouxu
jieyouxu approved these changes Feb 16, 2025
View reviewed changes
Copy link
Member

@jieyouxu jieyouxu left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I double-checked:

  • The linked advisory itself
  • The two patches; I manually double-checked that they match with the PR changes

Thanks. You can r=me unless this specifically needs T-infra review or you want to run some try-job.

@pietroalbini
Copy link
Member Author

@bors r=jieyouxu p=100

@bors
Copy link
Collaborator

bors commented Feb 16, 2025

📌 Commit ba4bcc1 has been approved by jieyouxu

It is now in the queue for this repository.

@bors bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Feb 16, 2025
@rust-log-analyzer

This comment has been minimized.

Sign in to view
@pietroalbini
Copy link
Member Author

@bors r-

Groan tidy is being annoying.

@bors bors added S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. and removed S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. labels Feb 16, 2025
@jieyouxu
Copy link
Member

jieyouxu commented Feb 16, 2025 •
edited
Loading

I would slap a # ignore-tidy-tab + # ignore-tidy-linelength or whatever that's called1, to avoid changing the patch itself.

Footnotes

  1. https://github.com/rust-lang/rust/blob/4229b80f506d5c1e6267f27e69f10fa3bd3c8f9e/src/tools/tidy/src/style.rs#L76-L81 ↩

@pietroalbini pietroalbini force-pushed the pa-musl-cve-2025-26519 branch from ba4bcc1 to 6ee3949 Compare February 16, 2025 11:40
@pietroalbini
Copy link
Member Author

Added tidy ignores.

@bors r=jieyouxu p=100

@bors
Copy link
Collaborator

bors commented Feb 16, 2025

📌 Commit 6ee3949 has been approved by jieyouxu

It is now in the queue for this repository.

@bors bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. labels Feb 16, 2025
bors added a commit to rust-lang-ci/rust that referenced this pull request Feb 16, 2025
@bors
Auto merge of rust-lang#137127 - pietroalbini:pa-musl-cve-2025-26519,…
befcc38 
… r=jieyouxu

Fix musl's CVE-2025-26519

The musl project [announced CVE-2025-26519](https://www.openwall.com/lists/musl/2025/02/13/1), which could result in out-of-bounds writes when calling the `iconv` function. There is no musl release available with the fixes at this point in time (and we're using an older version of musl anyway), so this PR applies the provided patches on top of the musl source tarball we download.
@bors
Copy link
Collaborator

bors commented Feb 16, 2025

⌛ Testing commit 6ee3949 with merge befcc38...

@rust-log-analyzer

This comment has been minimized.

Sign in to view
@bors
Copy link
Collaborator

bors commented Feb 16, 2025

💔 Test failed - checks-actions

@bors bors added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. and removed S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. labels Feb 16, 2025
@jieyouxu
Copy link
Member

Hm...

2025-02-16T14:08:29.7855620Z 15.62 Reversed (or previously applied) patch detected!  Assume -R? [n] 
2025-02-16T14:08:29.7856276Z 15.62 Apply anyway? [n] 
2025-02-16T14:08:29.7856710Z 15.62 Skipping patch.
2025-02-16T14:08:29.7857296Z 15.62 1 out of 1 hunk ignored -- saving rejects to file src/locale/iconv.c.rej

@pietroalbini pietroalbini force-pushed the pa-musl-cve-2025-26519 branch from 6ee3949 to a6ee2f4 Compare February 16, 2025 15:37
@pietroalbini
Copy link
Member Author

Ok tested locally again (and this time tested running the script multiple times too).

@jieyouxu
Copy link
Member

Let's try this again 🙏
@bors r+

@bors
Copy link
Collaborator

bors commented Feb 16, 2025

📌 Commit a6ee2f4 has been approved by jieyouxu

It is now in the queue for this repository.

@bors bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Feb 16, 2025
@bors
Copy link
Collaborator

bors commented Feb 16, 2025

⌛ Testing commit a6ee2f4 with merge 5bc6231...

@bors
Copy link
Collaborator

bors commented Feb 16, 2025

☀️ Test successful - checks-actions
Approved by: jieyouxu
Pushing 5bc6231 to master...

@bors bors added the merged-by-bors This PR was explicitly merged by bors. label Feb 16, 2025
@bors bors merged commit 5bc6231 into rust-lang:master Feb 16, 2025
7 checks passed
@rustbot rustbot added this to the 1.87.0 milestone Feb 16, 2025
@rust-timer
Copy link
Collaborator

Finished benchmarking commit (5bc6231): comparison URL.

Overall result: no relevant changes - no action needed

@rustbot label: -perf-regression

Instruction count

This benchmark run did not return any relevant results for this metric.

Max RSS (memory usage)

Results (primary 2.5%)

This is a less reliable metric that may be of interest but was not used to determine the overall result at the top of this comment.

mean range count
Regressions ❌
(primary)		 2.5% [2.5%, 2.5%] 1
Regressions ❌
(secondary)		 - - 0
Improvements ✅
(primary)		 - - 0
Improvements ✅
(secondary)		 - - 0
All ❌✅ (primary) 2.5% [2.5%, 2.5%] 1

Cycles

This benchmark run did not return any relevant results for this metric.

Binary size

This benchmark run did not return any relevant results for this metric.

Bootstrap: 790.819s -> 790.255s (-0.07%)
Artifact size: 350.06 MiB -> 350.01 MiB (-0.01%)

@pietroalbini pietroalbini deleted the pa-musl-cve-2025-26519 branch February 16, 2025 23:14
@cuviper
Copy link
Member

cuviper commented Feb 17, 2025

(Wearing my security response hat...)

@rustup label stable-accepted beta-accepted

@cuviper
Copy link
Member

cuviper commented Feb 17, 2025

Oops...

@rustbot label stable-accepted beta-accepted

@rustbot rustbot added beta-accepted Accepted for backporting to the compiler in the beta channel. stable-accepted Accepted for backporting to the compiler in the stable channel. labels Feb 17, 2025
This was referenced Feb 17, 2025
Merged
Merged
bors added a commit to rust-lang-ci/rust that referenced this pull request Feb 17, 2025
@bors
Auto merge of rust-lang#137181 - cuviper:stable-next, r=cuviper
4d91de4 
Prepare Rust 1.85.0 stable release

This includes a relnotes sync and a few last-minute backports:

- change `literal_string_with_formatting_args` lint category to nursery rust-lang#136982
- Update the reference for reverted `extended_varargs_abi_support` rust-lang#136934
- fix musl's CVE-2025-26519 rust-lang#137127

r? cuviper
@cuviper cuviper removed beta-nominated Nominated for backporting to the compiler in the beta channel. stable-nominated Nominated for backporting to the compiler in the stable channel. labels Feb 17, 2025
@cuviper cuviper modified the milestones: 1.87.0, 1.85.0 Feb 17, 2025
bors added a commit to rust-lang-ci/rust that referenced this pull request Feb 17, 2025
@bors
Auto merge of rust-lang#137182 - cuviper:beta-next, r=cuviper
f0cb410 
[beta] Prepare Rust 1.86.0

This includes one backport:

- fix musl's CVE-2025-26519 rust-lang#137127

r? cuviper
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jieyouxu jieyouxu jieyouxu approved these changes

Assignees

@Mark-Simulacrum Mark-Simulacrum

Labels
A-testsuite Area: The testsuite used to check the correctness of rustc beta-accepted Accepted for backporting to the compiler in the beta channel. merged-by-bors This PR was explicitly merged by bors. S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. stable-accepted Accepted for backporting to the compiler in the stable channel. T-infra Relevant to the infrastructure team, which will review and decide on the PR/issue.
Projects
None yet
Milestone
1.85.0
Development

Successfully merging this pull request may close these issues.
8 participants
@pietroalbini @rustbot @bors @rust-log-analyzer @jieyouxu @rust-timer @cuviper @Mark-Simulacrum