Bug 34286 - glibc new security issue CVE-2025-4802
Summary: glibc new security issue CVE-2025-4802
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-32-OK MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2025-05-19 09:44 CEST by Nicolas Salguero
Modified: 2025-05-25 01:26 CEST (History)
4 users (show)

See Also:
Source RPM: glibc-2.36-55.mga9.src.rpm
CVE: CVE-2025-4802
Status comment:


Attachments

Description Nicolas Salguero 2025-05-19 09:44:55 CEST
CVE-2025-4802 was announced here:
https://www.openwall.com/lists/oss-security/2025/05/16/7

Test case:
https://www.openwall.com/lists/oss-security/2025/05/17/2
Nicolas Salguero 2025-05-19 09:45:09 CEST

CVE: (none) => CVE-2025-4802
Source RPM: (none) => glibc-2.36-55.mga9.src.rpm

Comment 1 Lewis Smith 2025-05-19 21:29:19 CEST
"The only viable vector for exploitation of this bug is local, if a static
setuid program exists, and that program calls dlopen, then it may search
LD_LIBRARY_PATH to locate the SONAME to load. No such program has been
discovered at the time of publishing this advisory, but the presence of
custom setuid programs, although strongly discouraged as a security
practice, cannot be discounted."
 which is highly improbable; so not urgent.

Despite lack of a fix, assigning now to basesystem.

Assignee: bugsquad => basesystem
Status comment: (none) => Await fix

Comment 2 Nicolas Salguero 2025-05-23 10:18:43 CEST
Suggested advisory:
========================

The updated packages fix a security vulnerability:

Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo). (CVE-2025-4802)

References:
https://www.openwall.com/lists/oss-security/2025/05/16/7
https://www.openwall.com/lists/oss-security/2025/05/17/2
========================

Updated packages in core/updates_testing:
========================
glibc-2.36-56.mga9
glibc-devel-2.36-56.mga9
glibc-doc-2.36-56.mga9
glibc-i18ndata-2.36-56.mga9
glibc-profile-2.36-56.mga9
glibc-static-devel-2.36-56.mga9
glibc-utils-2.36-56.mga9
nscd-2.36-56.mga9

from SRPM:
glibc-2.36-56.mga9.src.rpm

Assignee: basesystem => qa-bugs
Status: NEW => ASSIGNED
Status comment: Await fix => (none)

PC LX 2025-05-23 10:37:37 CEST

CC: (none) => mageia

Comment 3 PC LX 2025-05-23 10:59:46 CEST
I saw this error when updating glibc, in one of the Mageia 9 VMs and containers I use for testing:
"""
Error: Missing /usr/lib64/gconv/gconv-modules.cache file.
"""

The file is indeed missing.

After looking at the glibc rpm script, to create the missing file, I run this command as root:
"""
/usr/sbin/iconvconfig -o /usr/lib64/gconv/gconv-modules.cache --nostdlib /usr/lib64/gconv
"""

This only happened in one of the updated VMs and containers with Mageia 9. No idea why this VM had an issue.

Will continue testing.
katnatek 2025-05-23 20:08:14 CEST

Keywords: (none) => advisory

Comment 4 Brian Rockwell 2025-05-24 02:36:06 CEST
MGA9-32, AMD A6-3420M APU with Radeon(tm) HD Graphics, old Laptop

The following 10 packages are going to be installed:

- firefox-128.10.1-2.mga9.i586
- firefox-en_CA-128.10.1-1.mga9.noarch
- firefox-en_GB-128.10.1-1.mga9.noarch
- firefox-en_US-128.10.1-1.mga9.noarch
- glibc-2.36-56.mga9.i586
- libnss3-3.111.0-1.mga9.i586
- nss-3.111.0-1.mga9.i586
- nss-myhostname-253.31-1.mga9.i586
- rootcerts-20250424.00-1.mga9.noarch
- rootcerts-java-20250424.00-1.mga9.noarch

3.4KB of additional disk space will be used.

---rebooted

spending time using firefox, etc.  - working


it was added with firefox.   I also added the nscd after the fact.

CC: (none) => brtians1

Comment 5 katnatek 2025-05-24 02:54:37 CEST
(In reply to PC LX from comment #3)
> I saw this error when updating glibc, in one of the Mageia 9 VMs and
> containers I use for testing:
> """
> Error: Missing /usr/lib64/gconv/gconv-modules.cache file.
> """
This was reported time ago but with the current status of the services is hard to find :(
Comment 6 katnatek 2025-05-24 02:59:49 CEST
(In reply to katnatek from comment #5)
> (In reply to PC LX from comment #3)
> > I saw this error when updating glibc, in one of the Mageia 9 VMs and
> > containers I use for testing:
> > """
> > Error: Missing /usr/lib64/gconv/gconv-modules.cache file.
> > """
> This was reported time ago but with the current status of the services is
> hard to find :(

https://bugs.mageia.org/show_bug.cgi?id=31909 (was less difficult from external search)
Comment 7 katnatek 2025-05-24 03:26:46 CEST
RH x86_64

installing glibc-2.36-56.mga9.x86_64.rpm glibc-devel-2.36-56.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/2: glibc                 ##################################################################################################
      2/2: glibc-devel           ##################################################################################################
      1/2: removing glibc-devel-6:2.36-55.mga9.x86_64
                                 ##################################################################################################
      2/2: removing glibc-6:2.36-55.mga9.x86_64
                                 ##################################################################################################
You should restart your computer for glibc
Error: Missing /usr/lib64/gconv/gconv-modules.cache file.n

Reboot

Not issues detected, play videos, audios, browse internet, open text files and terminal
Comment 8 Brian Rockwell 2025-05-24 05:42:32 CEST
MGA9-64, GNOME, AMD Ryzen 5600, Nvidia 1050 (550 driver)

Installed including nscd.

No issues to report.
Comment 9 Thomas Andrews 2025-05-24 21:23:46 CEST
MGA9-64 Plasma, i5-7500, nvidia Quadro K620 graphics. 

Updated using drakrpm-update with no errors reported. After the reboot, tried this and that, no issues to report.

CC: (none) => andrewsfarm

Comment 10 Thomas Andrews 2025-05-25 00:36:47 CEST
MGA9-32 Xfce on Foolishness, my Dell Inspiron 5100, P4, old laptop.

No installation issues, and no issues to report after the reboot.
Comment 11 Thomas Andrews 2025-05-25 00:37:49 CEST
This looks good to me, tested on both arches. Validating.

CC: (none) => sysadmin-bugs
Whiteboard: (none) => MGA9-32-OK MGA9-64-OK
Keywords: (none) => validated_update

Comment 12 Mageia Robot 2025-05-25 01:26:53 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0164.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.