File munge-0002-buffer-overflow-fix.patch of Package munge.41469

From bf40cc27c4ce8451d4b062c9de0b67ec40894812 Mon Sep 17 00:00:00 2001
From: Chris Dunlap <cdunlap@llnl.gov>
Date: Mon, 26 Jan 2026 20:42:40 -0800
Subject: [PATCH 2/2] Fix buffer overflow when unpacking message address length

Add validation that addr_len does not exceed the size of the addr
field before copying IP address data in _msg_unpack().

The m_msg structure contains a 4-byte struct in_addr for the IP
address.  When unpacking a MUNGE_MSG_DEC_RSP message, the addr_len
field (uint8_t) was read from untrusted message data and used directly
in _copy() without validation.  An attacker setting addr_len to 255
causes _copy() to write 251 bytes past the end of the addr field,
corrupting subsequent structure members.

This buffer overflow corrupts munged's internal state and can
be exploited by a local attacker to leak conf->mac_key and other
cryptographic secrets from process memory.  With the leaked key,
an attacker can forge arbitrary MUNGE credentials to impersonate any
user to services that rely on MUNGE for authentication.

Any local user can trigger this by connecting to munged's Unix socket
and sending a crafted MUNGE_MSG_DEC_RSP message.  While message type
validation in job_exec() will reject response-type messages, this
validation occurs after m_msg_recv() has already called _msg_unpack()
to process the message body.  The buffer overflow occurs during the
unpacking phase, before the message type is validated and rejected.

A working proof-of-concept exploit exists that demonstrates key
leakage and credential forgery.

Reported-by: Titouan Lazard <t.lazard@lexfo.fr>
Security: CVE-2026-25506
---
 src/libcommon/m_msg.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/libcommon/m_msg.c b/src/libcommon/m_msg.c
index 38e01ae3..eaeaf0b8 100644
--- a/src/libcommon/m_msg.c
+++ b/src/libcommon/m_msg.c
@@ -686,6 +686,7 @@ _msg_unpack (m_msg_t m, m_msg_type_t type, const void *src, int srclen)
             else if ( _copy (m->realm_str, p, m->realm_len, p, q, &p) < 0) ;
             else if (!_unpack (&(m->ttl), &p, sizeof (m->ttl), q)) ;
             else if (!_unpack (&(m->addr_len), &p, sizeof (m->addr_len), q)) ;
+            else if (m->addr_len > sizeof (m->addr)) goto err;
             else if ( _copy (&(m->addr), p, m->addr_len, p, q, &p) < 0) ;
             else if (!_unpack (&(m->time0), &p, sizeof (m->time0), q)) ;
             else if (!_unpack (&(m->time1), &p, sizeof (m->time1), q)) ;
-- 
2.51.0