Source Mage code commit list

[Pavel Vinogradov <scm AT sourcemage.org>]

GIT changes to master grimoire by Pavel Vinogradov <public AT sourcemage.org>:

 libs/glibc/DETAILS                     |    7 
 libs/glibc/HISTORY                     |    8 
 libs/glibc/patches/CVE-2023-4806.patch |  337 
---------------------------------
 libs/glibc/patches/CVE-2023-4911.patch |  172 ----------------
 libs/glibc/patches/CVE-2023-5156.patch |   92 ---------
 5 files changed, 11 insertions(+), 605 deletions(-)

New commits:
commit 728b34e081445d7b7b0d6ec5b13c55a90dcb816b
Author: Pavel Vinogradov <public AT sourcemage.org>
Commit: Pavel Vinogradov <public AT sourcemage.org>

    libs/glibc: version 2.39, SECURITY_PATCH++

diff --git a/libs/glibc/DETAILS b/libs/glibc/DETAILS
index 3f1ebbb..f033710 100755
--- a/libs/glibc/DETAILS
+++ b/libs/glibc/DETAILS
@@ -2,7 +2,6 @@
 # Watch: https://ftp.gnu.org/gnu/glibc/
            SPELL=glibc
            TMPFS=off
-      PATCHLEVEL=1
   if [[ "${GLIBC_BRANCH}" == "scm" ]]; then
          VERSION=$(get_scm_version)
   FORCE_DOWNLOAD=on
@@ -11,8 +10,8 @@ SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-git
       SOURCE_URL="git://sourceware.org/git/glibc.git:$SPELL-git"
    SOURCE_IGNORE=volatile
   else
-         VERSION=2.38
-  SECURITY_PATCH=21
+         VERSION=2.39
+  SECURITY_PATCH=22
           SOURCE=$SPELL-$VERSION.tar.xz
 SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
          SOURCE2=$SOURCE.sig
@@ -22,7 +21,7 @@ SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
   SOURCE2_IGNORE=signature
   fi
   if [[ $GLIBC_SANITIZE_HEADERS == n ]]; then
- HEADERS_VERSION=6.6.6
+ HEADERS_VERSION=6.7.3
  HEADERS_MAJOR_VERSION=$(echo $HEADERS_VERSION|cut -f1 -d.)
          SOURCE3=linux-${HEADERS_VERSION}.tar.xz
          SOURCE6=linux-${HEADERS_VERSION}.tar.sign
diff --git a/libs/glibc/HISTORY b/libs/glibc/HISTORY
index 62739cf..b0dddc8 100644
--- a/libs/glibc/HISTORY
+++ b/libs/glibc/HISTORY
@@ -1,3 +1,11 @@
+2024-02-01 Pavel Vinogradov <public AT sourcemage.org>
+       * DETAILS: version 2.39, SECURITY_PATCH++,
+         (CVE-2023-6246, CVE-2023-6779, CVE-2023-6780, CVE-2023-4911, 
CVE-2023-4806,
+         CVE-2023-4527), HEADERS_VERSION=6.7.3
+       * patches/CVE-2023-4911.patch,
+         patches/CVE-2023-4806.patch,
+         patches/CVE-2023-5156.patch: removed patches, applied in upstream
+
 2024-01-16 Remko van der Vossen <wich AT sourcemage.org>
        * DEPENDS: add missing sourcing of FUNCTIONS
 
diff --git a/libs/glibc/patches/CVE-2023-4806.patch 
b/libs/glibc/patches/CVE-2023-4806.patch
deleted file mode 100644
index 7467828..0000000
--- a/libs/glibc/patches/CVE-2023-4806.patch
+++ /dev/null
@@ -1,337 +0,0 @@
-From 973fe93a5675c42798b2161c6f29c01b0e243994 Mon Sep 17 00:00:00 2001
-From: Siddhesh Poyarekar <siddhesh AT sourceware.org>
-Date: Fri, 15 Sep 2023 13:51:12 -0400
-Subject: [PATCH] getaddrinfo: Fix use after free in getcanonname
- (CVE-2023-4806)
-
-When an NSS plugin only implements the _gethostbyname2_r and
-_getcanonname_r callbacks, getaddrinfo could use memory that was freed
-during tmpbuf resizing, through h_name in a previous query response.
-
-The backing store for res->at->name when doing a query with
-gethostbyname3_r or gethostbyname2_r is tmpbuf, which is reallocated in
-gethosts during the query.  For AF_INET6 lookup with AI_ALL |
-AI_V4MAPPED, gethosts gets called twice, once for a v6 lookup and second
-for a v4 lookup.  In this case, if the first call reallocates tmpbuf
-enough number of times, resulting in a malloc, th->h_name (that
-res->at->name refers to) ends up on a heap allocated storage in tmpbuf.
-Now if the second call to gethosts also causes the plugin callback to
-return NSS_STATUS_TRYAGAIN, tmpbuf will get freed, resulting in a UAF
-reference in res->at->name.  This then gets dereferenced in the
-getcanonname_r plugin call, resulting in the use after free.
-
-Fix this by copying h_name over and freeing it at the end.  This
-resolves BZ #30843, which is assigned CVE-2023-4806.
-
-Signed-off-by: Siddhesh Poyarekar <siddhesh AT sourceware.org>
----
- nss/Makefile                                  | 15 ++++-
- nss/nss_test_gai_hv2_canonname.c              | 56 +++++++++++++++++
- nss/tst-nss-gai-hv2-canonname.c               | 63 +++++++++++++++++++
- nss/tst-nss-gai-hv2-canonname.h               |  1 +
- .../postclean.req                             |  0
- .../tst-nss-gai-hv2-canonname.script          |  2 +
- sysdeps/posix/getaddrinfo.c                   | 25 +++++---
- 7 files changed, 152 insertions(+), 10 deletions(-)
- create mode 100644 nss/nss_test_gai_hv2_canonname.c
- create mode 100644 nss/tst-nss-gai-hv2-canonname.c
- create mode 100644 nss/tst-nss-gai-hv2-canonname.h
- create mode 100644 nss/tst-nss-gai-hv2-canonname.root/postclean.req
- create mode 100644 
nss/tst-nss-gai-hv2-canonname.root/tst-nss-gai-hv2-canonname.script
-
-diff --git a/nss/Makefile b/nss/Makefile
-index 06fcdc450f..8a5126ecf3 100644
---- a/nss/Makefile
-+++ b/nss/Makefile
-@@ -82,6 +82,7 @@ tests-container := \
-   tst-nss-test3 \
-   tst-reload1 \
-   tst-reload2 \
-+  tst-nss-gai-hv2-canonname \
- # tests-container
- 
- # Tests which need libdl
-@@ -145,7 +146,8 @@ libnss_compat-inhibit-o    = $(filter-out 
.os,$(object-suffixes))
- ifeq ($(build-static-nss),yes)
- tests-static          += tst-nss-static
- endif
--extra-test-objs               += nss_test1.os nss_test2.os nss_test_errno.os
-+extra-test-objs               += nss_test1.os nss_test2.os 
nss_test_errno.os \
-+                         nss_test_gai_hv2_canonname.os
- 
- include ../Rules
- 
-@@ -180,12 +182,16 @@ rtld-tests-LDFLAGS += -Wl,--dynamic-list=nss_test.ver
- libof-nss_test1 = extramodules
- libof-nss_test2 = extramodules
- libof-nss_test_errno = extramodules
-+libof-nss_test_gai_hv2_canonname = extramodules
- $(objpfx)/libnss_test1.so: $(objpfx)nss_test1.os $(link-libc-deps)
-       $(build-module)
- $(objpfx)/libnss_test2.so: $(objpfx)nss_test2.os $(link-libc-deps)
-       $(build-module)
- $(objpfx)/libnss_test_errno.so: $(objpfx)nss_test_errno.os $(link-libc-deps)
-       $(build-module)
-+$(objpfx)/libnss_test_gai_hv2_canonname.so: \
-+  $(objpfx)nss_test_gai_hv2_canonname.os $(link-libc-deps)
-+      $(build-module)
- $(objpfx)nss_test2.os : nss_test1.c
- # Use the nss_files suffix for these objects as well.
- $(objpfx)/libnss_test1.so$(libnss_files.so-version): 
$(objpfx)/libnss_test1.so
-@@ -195,10 +201,14 @@ $(objpfx)/libnss_test2.so$(libnss_files.so-version): 
$(objpfx)/libnss_test2.so
- $(objpfx)/libnss_test_errno.so$(libnss_files.so-version): \
-   $(objpfx)/libnss_test_errno.so
-       $(make-link)
-+$(objpfx)/libnss_test_gai_hv2_canonname.so$(libnss_files.so-version): \
-+  $(objpfx)/libnss_test_gai_hv2_canonname.so
-+      $(make-link)
- $(patsubst %,$(objpfx)%.out,$(tests) $(tests-container)) : \
-       $(objpfx)/libnss_test1.so$(libnss_files.so-version) \
-       $(objpfx)/libnss_test2.so$(libnss_files.so-version) \
--      $(objpfx)/libnss_test_errno.so$(libnss_files.so-version)
-+      $(objpfx)/libnss_test_errno.so$(libnss_files.so-version) \
-+      $(objpfx)/libnss_test_gai_hv2_canonname.so$(libnss_files.so-version)
- 
- ifeq (yes,$(have-thread-library))
- $(objpfx)tst-cancel-getpwuid_r: $(shared-thread-library)
-@@ -215,3 +225,4 @@ LDFLAGS-tst-nss-test3 = -Wl,--disable-new-dtags
- LDFLAGS-tst-nss-test4 = -Wl,--disable-new-dtags
- LDFLAGS-tst-nss-test5 = -Wl,--disable-new-dtags
- LDFLAGS-tst-nss-test_errno = -Wl,--disable-new-dtags
-+LDFLAGS-tst-nss-test_gai_hv2_canonname = -Wl,--disable-new-dtags
-diff --git a/nss/nss_test_gai_hv2_canonname.c 
b/nss/nss_test_gai_hv2_canonname.c
-new file mode 100644
-index 0000000000..4439c83c9f
---- /dev/null
-+++ b/nss/nss_test_gai_hv2_canonname.c
-@@ -0,0 +1,56 @@
-+/* NSS service provider that only provides gethostbyname2_r.
-+   Copyright The GNU Toolchain Authors.
-+   This file is part of the GNU C Library.
-+
-+   The GNU C Library is free software; you can redistribute it and/or
-+   modify it under the terms of the GNU Lesser General Public
-+   License as published by the Free Software Foundation; either
-+   version 2.1 of the License, or (at your option) any later version.
-+
-+   The GNU C Library is distributed in the hope that it will be useful,
-+   but WITHOUT ANY WARRANTY; without even the implied warranty of
-+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+   Lesser General Public License for more details.
-+
-+   You should have received a copy of the GNU Lesser General Public
-+   License along with the GNU C Library; if not, see
-+   <https://www.gnu.org/licenses/>.  */
-+
-+#include <nss.h>
-+#include <stdlib.h>
-+#include <string.h>
-+#include "nss/tst-nss-gai-hv2-canonname.h"
-+
-+/* Catch misnamed and functions.  */
-+#pragma GCC diagnostic error "-Wmissing-prototypes"
-+NSS_DECLARE_MODULE_FUNCTIONS (test_gai_hv2_canonname)
-+
-+extern enum nss_status _nss_files_gethostbyname2_r (const char *, int,
-+                                                  struct hostent *, char *,
-+                                                  size_t, int *, int *);
-+
-+enum nss_status
-+_nss_test_gai_hv2_canonname_gethostbyname2_r (const char *name, int af,
-+                                            struct hostent *result,
-+                                            char *buffer, size_t buflen,
-+                                            int *errnop, int *herrnop)
-+{
-+  return _nss_files_gethostbyname2_r (name, af, result, buffer, buflen, 
errnop,
-+                                    herrnop);
-+}
-+
-+enum nss_status
-+_nss_test_gai_hv2_canonname_getcanonname_r (const char *name, char *buffer,
-+                                          size_t buflen, char **result,
-+                                          int *errnop, int *h_errnop)
-+{
-+  /* We expect QUERYNAME, which is a small enough string that it shouldn't 
fail
-+     the test.  */
-+  if (memcmp (QUERYNAME, name, sizeof (QUERYNAME))
-+      || buflen < sizeof (QUERYNAME))
-+    abort ();
-+
-+  strncpy (buffer, name, buflen);
-+  *result = buffer;
-+  return NSS_STATUS_SUCCESS;
-+}
-diff --git a/nss/tst-nss-gai-hv2-canonname.c 
b/nss/tst-nss-gai-hv2-canonname.c
-new file mode 100644
-index 0000000000..d5f10c07d6
---- /dev/null
-+++ b/nss/tst-nss-gai-hv2-canonname.c
-@@ -0,0 +1,63 @@
-+/* Test NSS query path for plugins that only implement gethostbyname2
-+   (#30843).
-+   Copyright The GNU Toolchain Authors.
-+   This file is part of the GNU C Library.
-+
-+   The GNU C Library is free software; you can redistribute it and/or
-+   modify it under the terms of the GNU Lesser General Public
-+   License as published by the Free Software Foundation; either
-+   version 2.1 of the License, or (at your option) any later version.
-+
-+   The GNU C Library is distributed in the hope that it will be useful,
-+   but WITHOUT ANY WARRANTY; without even the implied warranty of
-+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+   Lesser General Public License for more details.
-+
-+   You should have received a copy of the GNU Lesser General Public
-+   License along with the GNU C Library; if not, see
-+   <https://www.gnu.org/licenses/>.  */
-+
-+#include <nss.h>
-+#include <netdb.h>
-+#include <stdlib.h>
-+#include <string.h>
-+#include <support/check.h>
-+#include <support/xstdio.h>
-+#include "nss/tst-nss-gai-hv2-canonname.h"
-+
-+#define PREPARE do_prepare
-+
-+static void do_prepare (int a, char **av)
-+{
-+  FILE *hosts = xfopen ("/etc/hosts", "w");
-+  for (unsigned i = 2; i < 255; i++)
-+    {
-+      fprintf (hosts, "ff01::ff02:ff03:%u:2\ttest.example.com\n", i);
-+      fprintf (hosts, "192.168.0.%u\ttest.example.com\n", i);
-+    }
-+  xfclose (hosts);
-+}
-+
-+static int
-+do_test (void)
-+{
-+  __nss_configure_lookup ("hosts", "test_gai_hv2_canonname");
-+
-+  struct addrinfo hints = {};
-+  struct addrinfo *result = NULL;
-+
-+  hints.ai_family = AF_INET6;
-+  hints.ai_flags = AI_ALL | AI_V4MAPPED | AI_CANONNAME;
-+
-+  int ret = getaddrinfo (QUERYNAME, NULL, &hints, &result);
-+
-+  if (ret != 0)
-+    FAIL_EXIT1 ("getaddrinfo failed: %s\n", gai_strerror (ret));
-+
-+  TEST_COMPARE_STRING (result->ai_canonname, QUERYNAME);
-+
-+  freeaddrinfo(result);
-+  return 0;
-+}
-+
-+#include <support/test-driver.c>
-diff --git a/nss/tst-nss-gai-hv2-canonname.h 
b/nss/tst-nss-gai-hv2-canonname.h
-new file mode 100644
-index 0000000000..14f2a9cb08
---- /dev/null
-+++ b/nss/tst-nss-gai-hv2-canonname.h
-@@ -0,0 +1 @@
-+#define QUERYNAME "test.example.com"
-diff --git a/nss/tst-nss-gai-hv2-canonname.root/postclean.req 
b/nss/tst-nss-gai-hv2-canonname.root/postclean.req
-new file mode 100644
-index 0000000000..e69de29bb2
-diff --git 
a/nss/tst-nss-gai-hv2-canonname.root/tst-nss-gai-hv2-canonname.script 
b/nss/tst-nss-gai-hv2-canonname.root/tst-nss-gai-hv2-canonname.script
-new file mode 100644
-index 0000000000..31848b4a28
---- /dev/null
-+++ b/nss/tst-nss-gai-hv2-canonname.root/tst-nss-gai-hv2-canonname.script
-@@ -0,0 +1,2 @@
-+cp $B/nss/libnss_test_gai_hv2_canonname.so 
$L/libnss_test_gai_hv2_canonname.so.2
-+su
-diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
-index 6ae6744fe4..47f421fddf 100644
---- a/sysdeps/posix/getaddrinfo.c
-+++ b/sysdeps/posix/getaddrinfo.c
-@@ -120,6 +120,7 @@ struct gaih_result
- {
-   struct gaih_addrtuple *at;
-   char *canon;
-+  char *h_name;
-   bool free_at;
-   bool got_ipv6;
- };
-@@ -165,6 +166,7 @@ gaih_result_reset (struct gaih_result *res)
-   if (res->free_at)
-     free (res->at);
-   free (res->canon);
-+  free (res->h_name);
-   memset (res, 0, sizeof (*res));
- }
- 
-@@ -203,9 +205,8 @@ gaih_inet_serv (const char *servicename, const struct 
gaih_typeproto *tp,
-   return 0;
- }
- 
--/* Convert struct hostent to a list of struct gaih_addrtuple objects.  
h_name
--   is not copied, and the struct hostent object must not be deallocated
--   prematurely.  The new addresses are appended to the tuple array in RES.  
*/
-+/* Convert struct hostent to a list of struct gaih_addrtuple objects.  The 
new
-+   addresses are appended to the tuple array in RES.  */
- static bool
- convert_hostent_to_gaih_addrtuple (const struct addrinfo *req, int family,
-                                  struct hostent *h, struct gaih_result *res)
-@@ -238,6 +239,15 @@ convert_hostent_to_gaih_addrtuple (const struct 
addrinfo *req, int family,
-   res->at = array;
-   res->free_at = true;
- 
-+  /* Duplicate h_name because it may get reclaimed when the underlying 
storage
-+     is freed.  */
-+  if (res->h_name == NULL)
-+    {
-+      res->h_name = __strdup (h->h_name);
-+      if (res->h_name == NULL)
-+      return false;
-+    }
-+
-   /* Update the next pointers on reallocation.  */
-   for (size_t i = 0; i < old; i++)
-     array[i].next = array + i + 1;
-@@ -262,7 +272,6 @@ convert_hostent_to_gaih_addrtuple (const struct addrinfo 
*req, int family,
-       }
-       array[i].next = array + i + 1;
-     }
--  array[0].name = h->h_name;
-   array[count - 1].next = NULL;
- 
-   return true;
-@@ -324,15 +333,15 @@ gethosts (nss_gethostbyname3_r fct, int family, const 
char *name,
-    memory allocation failure.  The returned string is allocated on the
-    heap; the caller has to free it.  */
- static char *
--getcanonname (nss_action_list nip, struct gaih_addrtuple *at, const char 
*name)
-+getcanonname (nss_action_list nip, const char *hname, const char *name)
- {
-   nss_getcanonname_r *cfct = __nss_lookup_function (nip, "getcanonname_r");
-   char *s = (char *) name;
-   if (cfct != NULL)
-     {
-       char buf[256];
--      if (DL_CALL_FCT (cfct, (at->name ?: name, buf, sizeof (buf),
--                            &s, &errno, &h_errno)) != NSS_STATUS_SUCCESS)
-+      if (DL_CALL_FCT (cfct, (hname ?: name, buf, sizeof (buf), &s, &errno,
-+                            &h_errno)) != NSS_STATUS_SUCCESS)
-       /* If the canonical name cannot be determined, use the passed
-          string.  */
-       s = (char *) name;
-@@ -771,7 +780,7 @@ get_nss_addresses (const char *name, const struct 
addrinfo *req,
-                 if ((req->ai_flags & AI_CANONNAME) != 0
-                     && res->canon == NULL)
-                   {
--                    char *canonbuf = getcanonname (nip, res->at, name);
-+                    char *canonbuf = getcanonname (nip, res->h_name, name);
-                     if (canonbuf == NULL)
-                       {
-                         __resolv_context_put (res_ctx);
--- 
-2.39.3
-
diff --git a/libs/glibc/patches/CVE-2023-4911.patch 
b/libs/glibc/patches/CVE-2023-4911.patch
deleted file mode 100644
index 7250847..0000000
--- a/libs/glibc/patches/CVE-2023-4911.patch
+++ /dev/null
@@ -1,172 +0,0 @@
-From 1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa Mon Sep 17 00:00:00 2001
-From: Siddhesh Poyarekar <siddhesh AT sourceware.org>
-Date: Tue, 19 Sep 2023 18:39:32 -0400
-Subject: [PATCH] tunables: Terminate if end of input is reached
- (CVE-2023-4911)
-
-The string parsing routine may end up writing beyond bounds of tunestr
-if the input tunable string is malformed, of the form name=name=val.
-This gets processed twice, first as name=name=val and next as name=val,
-resulting in tunestr being name=name=val:name=val, thus overflowing
-tunestr.
-
-Terminate the parsing loop at the first instance itself so that tunestr
-does not overflow.
-
-This also fixes up tst-env-setuid-tunables to actually handle failures
-correct and add new tests to validate the fix for this CVE.
-
-Signed-off-by: Siddhesh Poyarekar <siddhesh AT sourceware.org>
-Reviewed-by: Carlos O'Donell <carlos AT redhat.com>
----
- NEWS                          |  5 +++++
- elf/dl-tunables.c             | 17 +++++++++-------
- elf/tst-env-setuid-tunables.c | 37 +++++++++++++++++++++++++++--------
- 3 files changed, 44 insertions(+), 15 deletions(-)
-
-diff --git a/NEWS b/NEWS
-index a94650da64..cc4b81f0ac 100644
---- a/NEWS
-+++ b/NEWS
-@@ -64,6 +64,11 @@ Security related changes:
-   an application calls getaddrinfo for AF_INET6 with AI_CANONNAME,
-   AI_ALL and AI_V4MAPPED flags set.
- 
-+  CVE-2023-4911: If a tunable of the form NAME=NAME=VAL is passed in the
-+  environment of a setuid program and NAME is valid, it may result in a
-+  buffer overflow, which could be exploited to achieve escalated
-+  privileges.  This flaw was introduced in glibc 2.34.
-+
- The following bugs are resolved with this release:
- 
-   [The release manager will add the list generated by
-diff --git a/elf/dl-tunables.c b/elf/dl-tunables.c
-index 62b7332d95..cae67efa0a 100644
---- a/elf/dl-tunables.c
-+++ b/elf/dl-tunables.c
-@@ -180,11 +180,7 @@ parse_tunables (char *tunestr, char *valstring)
-       /* If we reach the end of the string before getting a valid name-value
-        pair, bail out.  */
-       if (p[len] == '\0')
--      {
--        if (__libc_enable_secure)
--          tunestr[off] = '\0';
--        return;
--      }
-+      break;
- 
-       /* We did not find a valid name-value pair before encountering the
-        colon.  */
-@@ -244,9 +240,16 @@ parse_tunables (char *tunestr, char *valstring)
-           }
-       }
- 
--      if (p[len] != '\0')
--      p += len + 1;
-+      /* We reached the end while processing the tunable string.  */
-+      if (p[len] == '\0')
-+      break;
-+
-+      p += len + 1;
-     }
-+
-+  /* Terminate tunestr before we leave.  */
-+  if (__libc_enable_secure)
-+    tunestr[off] = '\0';
- }
- 
- /* Enable the glibc.malloc.check tunable in SETUID/SETGID programs only when
-diff --git a/elf/tst-env-setuid-tunables.c b/elf/tst-env-setuid-tunables.c
-index 7dfb0e073a..f0b92c97e7 100644
---- a/elf/tst-env-setuid-tunables.c
-+++ b/elf/tst-env-setuid-tunables.c
-@@ -50,6 +50,8 @@ const char *teststrings[] =
-   
"glibc.malloc.perturb=0x800:not_valid.malloc.check=2:glibc.malloc.mmap_threshold=4096",
-   "glibc.not_valid.check=2:glibc.malloc.mmap_threshold=4096",
-   "not_valid.malloc.check=2:glibc.malloc.mmap_threshold=4096",
-+  "glibc.malloc.mmap_threshold=glibc.malloc.mmap_threshold=4096",
-+  "glibc.malloc.check=2",
-   
"glibc.malloc.garbage=2:glibc.maoc.mmap_threshold=4096:glibc.malloc.check=2",
-   
"glibc.malloc.check=4:glibc.malloc.garbage=2:glibc.maoc.mmap_threshold=4096",
-   ":glibc.malloc.garbage=2:glibc.malloc.check=1",
-@@ -68,6 +70,8 @@ const char *resultstrings[] =
-   "glibc.malloc.perturb=0x800:glibc.malloc.mmap_threshold=4096",
-   "glibc.malloc.mmap_threshold=4096",
-   "glibc.malloc.mmap_threshold=4096",
-+  "glibc.malloc.mmap_threshold=glibc.malloc.mmap_threshold=4096",
-+  "",
-   "",
-   "",
-   "",
-@@ -81,11 +85,18 @@ test_child (int off)
- {
-   const char *val = getenv ("GLIBC_TUNABLES");
- 
-+  printf ("    [%d] GLIBC_TUNABLES is %s\n", off, val);
-+  fflush (stdout);
-   if (val != NULL && strcmp (val, resultstrings[off]) == 0)
-     return 0;
- 
-   if (val != NULL)
--    printf ("[%d] Unexpected GLIBC_TUNABLES VALUE %s\n", off, val);
-+    printf ("    [%d] Unexpected GLIBC_TUNABLES VALUE %s, expected %s\n",
-+          off, val, resultstrings[off]);
-+  else
-+    printf ("    [%d] GLIBC_TUNABLES environment variable absent\n", off);
-+
-+  fflush (stdout);
- 
-   return 1;
- }
-@@ -106,21 +117,26 @@ do_test (int argc, char **argv)
-       if (ret != 0)
-       exit (1);
- 
--      exit (EXIT_SUCCESS);
-+      /* Special return code to make sure that the child executed all the 
way
-+       through.  */
-+      exit (42);
-     }
-   else
-     {
--      int ret = 0;
--
-       /* Spawn tests.  */
-       for (int i = 0; i < array_length (teststrings); i++)
-       {
-         char buf[INT_BUFSIZE_BOUND (int)];
- 
--        printf ("Spawned test for %s (%d)\n", teststrings[i], i);
-+        printf ("[%d] Spawned test for %s\n", i, teststrings[i]);
-         snprintf (buf, sizeof (buf), "%d\n", i);
-+        fflush (stdout);
-         if (setenv ("GLIBC_TUNABLES", teststrings[i], 1) != 0)
--          exit (1);
-+          {
-+            printf ("    [%d] Failed to set GLIBC_TUNABLES: %m", i);
-+            support_record_failure ();
-+            continue;
-+          }
- 
-         int status = support_capture_subprogram_self_sgid (buf);
- 
-@@ -128,9 +144,14 @@ do_test (int argc, char **argv)
-         if (WEXITSTATUS (status) == EXIT_UNSUPPORTED)
-           return EXIT_UNSUPPORTED;
- 
--        ret |= status;
-+        if (WEXITSTATUS (status) != 42)
-+          {
-+            printf ("    [%d] child failed with status %d\n", i,
-+                    WEXITSTATUS (status));
-+            support_record_failure ();
-+          }
-       }
--      return ret;
-+      return 0;
-     }
- }
- 
--- 
-2.39.3
-
diff --git a/libs/glibc/patches/CVE-2023-5156.patch 
b/libs/glibc/patches/CVE-2023-5156.patch
deleted file mode 100644
index 66b2c6d..0000000
--- a/libs/glibc/patches/CVE-2023-5156.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From ec6b95c3303c700eb89eebeda2d7264cc184a796 Mon Sep 17 00:00:00 2001
-From: Romain Geissler <romain.geissler AT amadeus.com>
-Date: Mon, 25 Sep 2023 01:21:51 +0100
-Subject: [PATCH] Fix leak in getaddrinfo introduced by the fix for
- CVE-2023-4806 [BZ #30843]
-
-This patch fixes a very recently added leak in getaddrinfo.
-
-Reviewed-by: Siddhesh Poyarekar <siddhesh AT sourceware.org>
----
- nss/Makefile                    | 20 ++++++++++++++++++++
- nss/tst-nss-gai-hv2-canonname.c |  3 +++
- sysdeps/posix/getaddrinfo.c     |  4 +---
- 3 files changed, 24 insertions(+), 3 deletions(-)
-
-diff --git a/nss/Makefile b/nss/Makefile
-index 8a5126ecf3..668ba34b18 100644
---- a/nss/Makefile
-+++ b/nss/Makefile
-@@ -149,6 +149,15 @@ endif
- extra-test-objs               += nss_test1.os nss_test2.os 
nss_test_errno.os \
-                          nss_test_gai_hv2_canonname.os
- 
-+ifeq ($(run-built-tests),yes)
-+ifneq (no,$(PERL))
-+tests-special += $(objpfx)mtrace-tst-nss-gai-hv2-canonname.out
-+endif
-+endif
-+
-+generated += mtrace-tst-nss-gai-hv2-canonname.out \
-+              tst-nss-gai-hv2-canonname.mtrace
-+
- include ../Rules
- 
- ifeq (yes,$(have-selinux))
-@@ -217,6 +226,17 @@ endif
- $(objpfx)tst-nss-files-alias-leak.out: $(objpfx)/libnss_files.so
- $(objpfx)tst-nss-files-alias-truncated.out: $(objpfx)/libnss_files.so
- 
-+tst-nss-gai-hv2-canonname-ENV = \
-+              MALLOC_TRACE=$(objpfx)tst-nss-gai-hv2-canonname.mtrace \
-+              LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so
-+$(objpfx)mtrace-tst-nss-gai-hv2-canonname.out: \
-+  $(objpfx)tst-nss-gai-hv2-canonname.out
-+      { test -r $(objpfx)tst-nss-gai-hv2-canonname.mtrace \
-+      || ( echo "tst-nss-gai-hv2-canonname.mtrace does not exist"; exit 77; 
) \
-+      && $(common-objpfx)malloc/mtrace \
-+      $(objpfx)tst-nss-gai-hv2-canonname.mtrace; } > $@; \
-+      $(evaluate-test)
-+
- # Disable DT_RUNPATH on NSS tests so that the glibc internal NSS
- # functions can load testing NSS modules via DT_RPATH.
- LDFLAGS-tst-nss-test1 = -Wl,--disable-new-dtags
-diff --git a/nss/tst-nss-gai-hv2-canonname.c 
b/nss/tst-nss-gai-hv2-canonname.c
-index d5f10c07d6..7db53cf09d 100644
---- a/nss/tst-nss-gai-hv2-canonname.c
-+++ b/nss/tst-nss-gai-hv2-canonname.c
-@@ -21,6 +21,7 @@
- #include <netdb.h>
- #include <stdlib.h>
- #include <string.h>
-+#include <mcheck.h>
- #include <support/check.h>
- #include <support/xstdio.h>
- #include "nss/tst-nss-gai-hv2-canonname.h"
-@@ -41,6 +42,8 @@ static void do_prepare (int a, char **av)
- static int
- do_test (void)
- {
-+  mtrace ();
-+
-   __nss_configure_lookup ("hosts", "test_gai_hv2_canonname");
- 
-   struct addrinfo hints = {};
-diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
-index 47f421fddf..531124958d 100644
---- a/sysdeps/posix/getaddrinfo.c
-+++ b/sysdeps/posix/getaddrinfo.c
-@@ -1196,9 +1196,7 @@ free_and_return:
-   if (malloc_name)
-     free ((char *) name);
-   free (addrmem);
--  if (res.free_at)
--    free (res.at);
--  free (res.canon);
-+  gaih_result_reset (&res);
- 
-   return result;
- }
--- 
-2.39.3
-