Update glibc from 2.36 to 2.43

[Paul Menzel (pmenzel)]

Update with

$ sudo bee remove glibc-memusage-fixup-2.36-0.x86_64 && sudo bee install libxcrypt-4.5.2 && sudo bee update glibc-2.43

• Tested on dose: SSH and sudo work afterward. Restarting dose with sudo mxgrub --reboot also worked.
• Tested on maleficent (amdgpu): Xfce keeps running and working while doing the glibc update.
• Test on afk with HTTPD servers

[Paul Menzel (pmenzel)]

Currently breaks PAM, and therefore SSH and sudo.

$ ssh dose
Connection closed by 141.14.17.51 port 22

@dose:~$ sudo bee remove glibc-memusage-fixup-2.36-0.x86_64
sudo: PAM account management error: Module is unknown
sudo: a password is required
$ su
su: Module is unknown

I’ll fix dose in the next days.

[Thomas Kreitler (thomas)]

Maybe this is related to the removal/deprecation of libcrypt.so.1 in glibc 2.38 /1/ ?
I guess introducing libxcrypt /2/ will solve the issue.

/1/ https://sourceware.org/glibc/wiki/Release/2.38#Building_libcrypt_is_disabled_by_default
/2/ https://github.com/besser82/libxcrypt

[Paul Menzel (pmenzel)]

Thomas Kreitler (@thomas), thank you for the tip. That was indeed it. After

$ sudo bee install libxcrypt-4.5.2
$ sudo bee update glibc-2.43

sudo still works, and I am able to log in over SSH.

[Paul Menzel (pmenzel)]

Tested on maleficent.

[Donald Buczek (donald)]

tested on theinternet

[Donald Buczek (donald)]

Possible problem: mariux64/mariux64-issues#217

[Donald Buczek (donald)]

Can we get C.UTF8 locale?

[Peter Marquardt (wwwutz)]

Can we get C.UTF8 locale?

Are there cookies included ? Ice ?

Go for it.

[Donald Buczek (donald)]

When we update we need to make sure, that fixes for these are included:

GLIBC-SA-2026-0022:
===================
AT_SECURE programs may load attacker-controlled code via $ORIGIN

A time-of-check to time-of-use (TOCTOU) race condition in the dynamic
loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44
allows a local attacker to escalate privileges. When expanding $ORIGIN
in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the
lexically normalized search path against the trusted directories but
then opens the raw, un-normalized path. On systems where the Linux
fs.protected_hardlinks sysctl is disabled, a local attacker who
hard-links such a program into an attacker-controlled directory and wins
a race to replace an intermediate path component with a symbolic link
can direct the loader outside the trusted directory, causing it to load
an attacker-controlled shared object and execute arbitrary code with the
elevated privileges of the program.

Exploitation requires an installed setuid or setgid binary whose DT_RPATH
uses $ORIGIN followed by ".." traversal that normalizes into a trusted
directory, and the ability to hard-link that binary and win the race by
swapping a path component for a symbolic link. Major Linux-based OS
distributions ship with fs.protected_hardlinks enabled by default and
mitigate the vulnerability.

CVE-Id: CVE-2026-86805
Public-Date: 2026-07-06
Vulnerable-Commit: 47c3cd7a74e8c089d60d603afce6d9cf661178d6 (2.13-113)
Fix-Commit: ed0c137b97eb940b4b64981e84ed806d3276edd9 (2.45)
Reported-by: Jann Horn [<jannh@google.com>](mailto:jannh@google.com)
CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L - 6.3

GLIBC-SA-2026-0023:
===================
AT_SECURE program buffer overflow via $ORIGIN processing

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C
Library (glibc) versions 2.14 through 2.44 allows a local attacker to
crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.

When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is
followed by NUL or '/' the loader both reads past the end of the path
buffer and writes past the end of a stack-allocated internal buffer.
The corrupted loader stack can lead to a loader crash (denial of
service) and limited disclosure of process memory.

CVE Id: CVE-2026-95818
Public-Date: 2026-08-14
Vulnerable-Commit: 47c3cd7a74e8c089d60d603afce6d9cf661178d6 (2.13-113)
Fix-Commit: ed0c137b97eb940b4b64981e84ed806d3276edd9 (2.45)
Reported-by: AISLE in partnership with Red Hat
CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - 3.6

[Donald Buczek (donald)]

The patches are not in 2.43 and they don't apply naively to 2.43. They are complex, adding new modules. 2.45 is not yet released, last tag in git://sourceware.org/git/glibc.git is glibc-2.44. 2.45 is development branch, expected February 2027. I think we shouldn't risk to update to master. So the patches will not be included this time. Paul Menzel (@pmenzel): Can I merge and distribute this as is now before the power shutdown tomorrow?

[Paul Menzel (pmenzel)]

Yes, go ahead. I wanted to clean up the commit history a little, but it’s good enough.

$ ls -l --full-time /src/mariux/beeroot/bee-files/glibc-2.43-0.bee
-rw-r--r-- 1 pmenzel pmenzel 4070 2026-07-01 12:14:21.935465647 +0200 /src/mariux/beeroot/bee-files/glibc-2.43-0.bee
$ grep enable-kernel /src/mariux/beeroot/bee-files/glibc-2.43-0.bee
        --enable-kernel=5.15 \

Looks like this was resolved and closed, no idea, why github still shows it.

[Donald Buczek (donald)]

Oh dear

buczek@deinemuddah:~/git/bee-files (master)$ sudo -s
sudo: PAM account management error: Module is unknown
sudo: a password is required
buczek@deinemuddah:~/git/bee-files (master)$ 

buczek@afk:~$ ssh root@deinemuddah
kex_exchange_identification: read: Connection reset by peer
Connection reset by 141.14.30.156 port 22
buczek@afk:~$ 

[Donald Buczek (donald)]

Forgot the libxcrypt :-)

[Donald Buczek (donald)]

Hmm. Removal of glibc-memusage-fixup was not part of the PR. Did it nontheless and made sure glibc versions are in place.

[Peter Marquardt (wwwutz)]

static. static. static.