From 1a3bd4d15ad49541fc2956526bbf43b4a2cd4cc5 Mon Sep 17 00:00:00 2001 From: Pawel Winogrodzki Date: Wed, 19 Aug 2026 09:37:53 -0700 Subject: [PATCH 1/4] fix(memcached): reject oversized auth tokens Backport the upstream authentication token size limit and regression test. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 136058a7-d42e-48e7-831b-56453b23dacf --- .../memcached-auth-token-length.patch | 71 +++++++++++++++++++ SPECS/memcached/memcached.spec | 6 +- 2 files changed, 76 insertions(+), 1 deletion(-) create mode 100644 SPECS/memcached/memcached-auth-token-length.patch diff --git a/SPECS/memcached/memcached-auth-token-length.patch b/SPECS/memcached/memcached-auth-token-length.patch new file mode 100644 index 00000000000..30bdec0e6f3 --- /dev/null +++ b/SPECS/memcached/memcached-auth-token-length.patch @@ -0,0 +1,71 @@ +From 9981d748f866e80a8f2ee1b12bf45717f9595df9 Mon Sep 17 00:00:00 2001 +From: dormando +Date: Fri, 1 May 2026 14:15:19 -0700 +Subject: [PATCH] auth: fix crash when given huge token + +Also prevents memory bloat when given extremely but not existentially +large auth tokens. + +Reported by Haruto Kimura (Stella) +--- + proto_text.c | 13 +++++++++++++ + t/ascii-auth.t | 6 +++++- + 2 files changed, 18 insertions(+), 1 deletion(-) + +diff --git a/proto_text.c b/proto_text.c +index b213c93..69fd169 100644 +--- a/proto_text.c ++++ b/proto_text.c +@@ -332,6 +332,8 @@ static size_t tokenize_command(char *command, token_t *tokens, + return ntokens; + } + ++#define MAX_AUTH_REQ_LEN 16384 ++ + int try_read_command_asciiauth(conn *c) { + token_t tokens[MAX_TOKENS]; + size_t ntokens; +@@ -383,6 +385,17 @@ int try_read_command_asciiauth(conn *c) { + return 1; + } + ++ if (size > MAX_AUTH_REQ_LEN) { ++ if (!c->resp) { ++ if (!resp_start(c)) { ++ conn_set_state(c, conn_closing); ++ return 1; ++ } ++ } ++ out_string(c, "CLIENT_ERROR auth token too long"); ++ return 1; ++ } ++ + // we don't actually care about the key at all; it can be anything. + // we do care about the size of the remaining read. + c->rlbytes = size + 2; +diff --git a/t/ascii-auth.t b/t/ascii-auth.t +index 40ca376ec4..4fad020195 100644 +--- a/t/ascii-auth.t ++++ b/t/ascii-auth.t +@@ -1,7 +1,7 @@ + #!/usr/bin/env perl + + use strict; +-use Test::More tests => 9; ++use Test::More tests => 10; + use FindBin qw($Bin); + use lib "$Bin/lib"; + use MemcachedTest; +@@ -21,6 +21,10 @@ like(scalar <$sock>, qr/CLIENT_ERROR/, "failed to do a read"); + print $sock "set foo 0 0 7\r\nfoo bab\r\n"; + like(scalar <$sock>, qr/CLIENT_ERROR/, "failed to authenticate"); + ++# Super long tokens are invalid. ++print $sock "set foo 0 0 2147483646\r\nasfd\r\n"; ++like(scalar <$sock>, qr/CLIENT_ERROR/, "failed to authenticate"); ++ + # Try for real. + print $sock "set foo 0 0 7\r\nfoo bar\r\n"; + like(scalar <$sock>, qr/STORED/, "authenticated?"); +-- +2.45.4 diff --git a/SPECS/memcached/memcached.spec b/SPECS/memcached/memcached.spec index abbbaa0dad4..74bafe12b06 100644 --- a/SPECS/memcached/memcached.spec +++ b/SPECS/memcached/memcached.spec @@ -7,7 +7,7 @@ Summary: High Performance, Distributed Memory Object Cache Name: memcached Version: 1.6.27 -Release: 5%{?dist} +Release: 6%{?dist} License: BSD Vendor: Microsoft Corporation Distribution: Azure Linux @@ -19,6 +19,7 @@ Patch1: CVE-2021-43519.patch Patch2: CVE-2021-44647.patch Patch3: CVE-2026-24809.patch Patch4: CVE-2026-47783.patch +Patch5: memcached-auth-token-length.patch BuildRequires: gcc BuildRequires: libevent-devel BuildRequires: systemd-devel @@ -133,6 +134,9 @@ exit 0 %{_unitdir}/memcached.service %changelog +* Tue Aug 18 2026 Pawel Winogrodzki - 1.6.27-6 +- Prevent oversized ASCII authentication tokens from crashing the daemon + * Thu May 21 2026 Azure Linux Security Servicing Account - 1.6.27-5 - Patch for CVE-2026-47783 From 5dab8b7d7bd0a055654109f96c56c55a5f6e9998 Mon Sep 17 00:00:00 2001 From: Pawel Winogrodzki Date: Wed, 19 Aug 2026 18:52:12 -0700 Subject: [PATCH 2/4] fix(memcached): fix crash in binary protocol Backport the upstream binary protocol mutation logging fix from Azure Linux pull request 18459 so a failed binary store no longer dereferences a missing item. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 136058a7-d42e-48e7-831b-56453b23dacf --- ...1-proto-fix-crash-in-binary-protocol.patch | 31 +++++++++++++++++++ SPECS/memcached/memcached.spec | 2 ++ 2 files changed, 33 insertions(+) create mode 100644 SPECS/memcached/0001-proto-fix-crash-in-binary-protocol.patch diff --git a/SPECS/memcached/0001-proto-fix-crash-in-binary-protocol.patch b/SPECS/memcached/0001-proto-fix-crash-in-binary-protocol.patch new file mode 100644 index 00000000000..46ae9cbf033 --- /dev/null +++ b/SPECS/memcached/0001-proto-fix-crash-in-binary-protocol.patch @@ -0,0 +1,31 @@ +From 2e623108dec9759ad3e258aa695288a1ef6a0c72 Mon Sep 17 00:00:00 2001 +From: dormando +Date: Fri, 1 May 2026 13:48:44 -0700 +Subject: [PATCH] proto: fix crash in binary protocol + +If `watch mutations` is running and a binary protocol SET fails the +logger code attempts to resolve a NULL item reference and will crash. + +Reported by Haruto Kimura (Stella) + +Upstream Patch Reference : https://github.com/memcached/memcached/commit/32ea7d8b5b +--- + proto_bin.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/proto_bin.c b/proto_bin.c +index 778ea9a..0e92539 100644 +--- a/proto_bin.c ++++ b/proto_bin.c +@@ -1136,7 +1136,7 @@ static void process_bin_update(conn *c, char *extbuf) { + /* FIXME: losing c->cmd since it's translated below. refactor? */ + LOGGER_LOG(c->thread->l, LOG_MUTATIONS, LOGGER_ITEM_STORE, + NULL, status, 0, key, nkey, req->message.body.expiration, +- ITEM_clsid(it), c->sfd); ++ 0, c->sfd); + + /* Avoid stale data persisting in cache because we failed alloc. + * Unacceptable for SET. Anywhere else too? */ +-- +2.55.0 + diff --git a/SPECS/memcached/memcached.spec b/SPECS/memcached/memcached.spec index 74bafe12b06..b06873eb881 100644 --- a/SPECS/memcached/memcached.spec +++ b/SPECS/memcached/memcached.spec @@ -20,6 +20,7 @@ Patch2: CVE-2021-44647.patch Patch3: CVE-2026-24809.patch Patch4: CVE-2026-47783.patch Patch5: memcached-auth-token-length.patch +Patch6: 0001-proto-fix-crash-in-binary-protocol.patch BuildRequires: gcc BuildRequires: libevent-devel BuildRequires: systemd-devel @@ -136,6 +137,7 @@ exit 0 %changelog * Tue Aug 18 2026 Pawel Winogrodzki - 1.6.27-6 - Prevent oversized ASCII authentication tokens from crashing the daemon +- Fix crash in binary protocol * Thu May 21 2026 Azure Linux Security Servicing Account - 1.6.27-5 - Patch for CVE-2026-47783 From ca611c90b7c52df6b3675c730edf16d18470ef8c Mon Sep 17 00:00:00 2001 From: Pawel Winogrodzki Date: Thu, 20 Aug 2026 12:22:21 -0700 Subject: [PATCH 3/4] chore(memcached): reference the upstream auth token patch Match the upstream reference convention used by the binary protocol patch. --- SPECS/memcached/memcached-auth-token-length.patch | 2 ++ 1 file changed, 2 insertions(+) diff --git a/SPECS/memcached/memcached-auth-token-length.patch b/SPECS/memcached/memcached-auth-token-length.patch index 30bdec0e6f3..f8753ad0e33 100644 --- a/SPECS/memcached/memcached-auth-token-length.patch +++ b/SPECS/memcached/memcached-auth-token-length.patch @@ -7,6 +7,8 @@ Also prevents memory bloat when given extremely but not existentially large auth tokens. Reported by Haruto Kimura (Stella) + +Upstream Patch Reference : https://github.com/memcached/memcached/commit/9981d748f8 --- proto_text.c | 13 +++++++++++++ t/ascii-auth.t | 6 +++++- From 034968b4d4fdf3a583c167e5c851c2f6aeee60c3 Mon Sep 17 00:00:00 2001 From: Pawel Winogrodzki Date: Thu, 20 Aug 2026 12:22:32 -0700 Subject: [PATCH 4/4] chore(memcached): drop the sequence prefix from the binary protocol patch Name the patch file consistently with the other memcached patches. --- SPECS/memcached/memcached.spec | 2 +- ...-protocol.patch => proto-fix-crash-in-binary-protocol.patch} | 0 2 files changed, 1 insertion(+), 1 deletion(-) rename SPECS/memcached/{0001-proto-fix-crash-in-binary-protocol.patch => proto-fix-crash-in-binary-protocol.patch} (100%) diff --git a/SPECS/memcached/memcached.spec b/SPECS/memcached/memcached.spec index b06873eb881..2298f96b027 100644 --- a/SPECS/memcached/memcached.spec +++ b/SPECS/memcached/memcached.spec @@ -20,7 +20,7 @@ Patch2: CVE-2021-44647.patch Patch3: CVE-2026-24809.patch Patch4: CVE-2026-47783.patch Patch5: memcached-auth-token-length.patch -Patch6: 0001-proto-fix-crash-in-binary-protocol.patch +Patch6: proto-fix-crash-in-binary-protocol.patch BuildRequires: gcc BuildRequires: libevent-devel BuildRequires: systemd-devel diff --git a/SPECS/memcached/0001-proto-fix-crash-in-binary-protocol.patch b/SPECS/memcached/proto-fix-crash-in-binary-protocol.patch similarity index 100% rename from SPECS/memcached/0001-proto-fix-crash-in-binary-protocol.patch rename to SPECS/memcached/proto-fix-crash-in-binary-protocol.patch