Bug 2544484
| Summary: | CVE-2026-49014 gdal: GDAL: Arbitrary code execution via stack-based buffer overflow in NetCDF driver [fedora-all] | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Tomas Hoger <thoger> | ||||
| Component: | gdal | Assignee: | Sandro Mani <manisandro> | ||||
| Status: | ON_QA --- | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | high | ||||||
| Version: | rawhide | CC: | alex, artem, devrim, manisandro, neteler, pavel.lisy, praiskup | ||||
| Target Milestone: | --- | Keywords: | Security, SecurityTracking | ||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | {"flaws": ["f155cdb6-ab8f-458c-b62d-e3933c21896a"]} | ||||||
| Fixed In Version: | Doc Type: | --- | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | Type: | --- | |||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 2481758 | ||||||
| Attachments: |
|
||||||
|
Description
Tomas Hoger
2026-10-01 09:30:46 UTC
Hello, Thank you for maintaining GDAL in Fedora. I've attached a backport of the upstream fix for CVE-2026-49014 for Fedora 43 and 44, and would appreciate your review. CVE-2026-49014 is a stack buffer overflow in the netCDF driver. When GDAL opens a netCDF file that declares CF-1.8 or later conventions, scanForGeometryContainers() (frmts/netcdf/netcdfsg.cpp) copies each variable's "geometry" attribute into a fixed 255-byte stack buffer without checking the attribute's length. A crafted file with a longer attribute overflows the buffer, which the CVE describes as leading to arbitrary code execution in the process running GDAL. Fedora 43 (3.11.5) and Fedora 44 (3.12.4) are affected. Fedora 45 and Rawhide (3.13.3) already include the fix, which first shipped upstream in 3.13.1. The attachment is upstream commit c49254dc6380af2f02ff43ca79e3cf7c1bc82f01 (OSGeo/gdal#14594), unmodified. It adds an NCDFGetAttr() overload that checks the attribute type and length and reads into a std::string of the right size. It then switches the fixed-buffer text-attribute reads in netcdfsg.cpp and netcdfdataset.cpp over to it, replacing the old attrf() helper. Testing: the patch applies cleanly to the current Fedora 43 and 44 sources (those three files are identical to upstream 3.11.5 and 3.12.4). I confirmed that the patched Fedora 44 source no longer has the fixed-buffer read. I did not have a crafted netCDF file to reproduce the overflow at runtime. AI assistance was used to prepare this patch and its validation. The resulting changes and validation results were reviewed by a human. Thank you for taking a look. Created attachment 2161890 [details]
upstream patch
FEDORA-2026-a002fccd0d (gdal-3.12.4-2.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-a002fccd0d FEDORA-2026-a002fccd0d has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-a002fccd0d` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-a002fccd0d See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. |