Bug 2565679 (CVE-2026-121997)

Summary: CVE-2026-121997 gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via QTDPsrc declared/actual length mismatch
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-03 10:03:20 UTC 
Heap buffer overflow in cmd_qtdpsrc (gdbserver/tracepoint.cc). The function allocates xmalloc(slen+1) sized by the packet's declared slen field, but calls hex2bin(packet, src, strlen(packet)/2) using the actual hex data length independently. When actual data exceeds declared slen, hex2bin overflows the heap buffer by the difference with attacker-controlled content. Demonstrated exploitation: overflow corrupts process_info_private::thread_db, replacing the td_ta_map_lwp2thr_p function pointer with an attacker-chosen address. A subsequent qGetTLSAddr packet causes gdbserver to call through the forged pointer, achieving RIP control and native code execution.