[AutoPR- Security] Patch telegraf for CVE-2026-54332 [MEDIUM]

SPECS/telegraf/CVE-2026-54332.patch

@@ -0,0 +1,83 @@
+From 2a9d0a1dd94c8a17da2e0329b896732c1cdf9fc1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?tonghuaroot=20=28=E7=AB=A5=E8=AF=9D=29?=
+ <tonghuaroot@gmail.com>
+Date: Fri, 5 Jun 2026 04:44:08 +0800
+Subject: [PATCH] Merge commit from fork
+
+The sFlow ExtendedGatewayFlow (record type 1003) decoder allocated slices
+with make([]uint32, n) where n is a raw 32-bit wire field with no upper
+bound, and the allocation ran before the loop that consumes the bytes. A
+single ~104-byte UDP datagram could therefore request up to 16 GiB and
+OOM-kill any service parsing sFlow with gopacket (unauthenticated remote
+DoS, CWE-770).
+
+Both decodeExtendedGatewayFlowRecord (communitiesLength) and decodePath
+(ad.Count) now reject any count that exceeds the bytes actually remaining
+in the datagram (each element is 4 bytes on the wire, so the bound is
+len(remaining)/4) and return a decode error instead of pre-allocating.
+decodePath now returns that error and its caller propagates it.
+
+Adds a regression test that feeds an oversized communities count and
+asserts a decode error rather than an unbounded allocation, plus a
+negative control that a correctly sized record still decodes.
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/gopacket/gopacket/commit/76119086f5936aacd7088bdf97d565501bb6c4cc.patch
+---
+ .../gopacket/gopacket/layers/sflow.go         | 22 +++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/vendor/github.com/gopacket/gopacket/layers/sflow.go b/vendor/github.com/gopacket/gopacket/layers/sflow.go
+index 70fd787a..e2f7cabf 100644
+--- a/vendor/github.com/gopacket/gopacket/layers/sflow.go
++++ b/vendor/github.com/gopacket/gopacket/layers/sflow.go
+@@ -1270,15 +1270,23 @@ func (asd SFlowASDestination) String() string {
+ 	}
+ }
+
+-func (ad *SFlowASDestination) decodePath(data *[]byte) {
++func (ad *SFlowASDestination) decodePath(data *[]byte) error {
+ 	*data, ad.Type = (*data)[4:], SFlowASPathType(binary.BigEndian.Uint32((*data)[:4]))
+ 	*data, ad.Count = (*data)[4:], binary.BigEndian.Uint32((*data)[:4])
++	// ad.Count is an attacker-controlled 32-bit field and each member that
++	// follows is 4 bytes on the wire. Reject any count that cannot be backed
++	// by the bytes actually remaining, otherwise make([]uint32, ad.Count) lets
++	// a tiny datagram drive an arbitrarily large allocation (CWE-770).
++	if ad.Count > uint32(len(*data)/4) {
++		return fmt.Errorf("SFlow AS path member count %d exceeds remaining buffer", ad.Count)
++	}
+ 	ad.Members = make([]uint32, ad.Count)
+ 	for i := uint32(0); i < ad.Count; i++ {
+ 		var member uint32
+ 		*data, member = (*data)[4:], binary.BigEndian.Uint32((*data)[:4])
+ 		ad.Members[i] = member
+ 	}
++	return nil
+ }
+
+ func decodeExtendedGatewayFlowRecord(data *[]byte) (SFlowExtendedGatewayFlowRecord, error) {
+@@ -1299,10 +1307,20 @@ func decodeExtendedGatewayFlowRecord(data *[]byte) (SFlowExtendedGatewayFlowReco
+ 	*data, eg.ASPathCount = (*data)[4:], binary.BigEndian.Uint32((*data)[:4])
+ 	for i := uint32(0); i < eg.ASPathCount; i++ {
+ 		asPath := SFlowASDestination{}
+-		asPath.decodePath(data)
++		if err := asPath.decodePath(data); err != nil {
++			return eg, err
++		}
+ 		eg.ASPath = append(eg.ASPath, asPath)
+ 	}
+ 	*data, communitiesLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4])
++	// communitiesLength is an attacker-controlled 32-bit field and each
++	// community that follows is 4 bytes on the wire. Reject any count that
++	// cannot be backed by the bytes actually remaining, otherwise
++	// make([]uint32, communitiesLength) lets a tiny datagram drive an
++	// arbitrarily large allocation (CWE-770).
++	if communitiesLength > uint32(len(*data)/4) {
++		return eg, fmt.Errorf("SFlow community count %d exceeds remaining buffer", communitiesLength)
++	}
+ 	eg.Communities = make([]uint32, communitiesLength)
+ 	for j := uint32(0); j < communitiesLength; j++ {
+ 		*data, community = (*data)[4:], binary.BigEndian.Uint32((*data)[:4])
+-- 
+2.45.4
+

SPECS/telegraf/telegraf.spec

@@ -1,7 +1,7 @@
 Summary:        agent for collecting, processing, aggregating, and writing metrics.
 Name:           telegraf
 Version:        1.31.0
-Release:        27%{?dist}
+Release:        28%{?dist}
 License:        MIT
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -69,6 +69,7 @@ Patch53:        CVE-2026-56852.patch
 Patch54:        CVE-2025-29923.patch
 Patch55:        CVE-2025-46327.patch
 Patch56:        CVE-2026-54908.patch
+Patch57:        CVE-2026-54332.patch
 
 BuildRequires:  golang
 BuildRequires:  systemd-devel
@@ -133,6 +134,9 @@ fi
 %dir %{_sysconfdir}/%{name}/telegraf.d
 
 %changelog
+* Tue Aug 04 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.31.0-28
+- Patch for CVE-2026-54332
+
 * Thu Jul 30 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.31.0-27
 - Patch for CVE-2026-54908