[MEDIUM] Patch glib for CVE-2024-34397

[archana25-ms]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

What does the PR accomplish, why was it needed?
Patch glib for CVE-2024-34397

CVE-2024-24397 was merged in PR-14223 and was later reverted back in PR-14745 since there was test failure in ModemManager package during full build because of the CVE fix.

Hence in this PR the CVE patch is backported from https://gitlab.gnome.org/GNOME/glib/-/issues/3268#fixes
and verified the test execution of ModemManager package with the fixed glib present in toolchain.

Change Log

• added: SPECS/glib/CVE-2024-34397.patch
• modified: SPECS/glib/glib.spec
• modified: toolkit/resources/manifests/package/pkggen_core_aarch64.txt
• modified: toolkit/resources/manifests/package/pkggen_core_x86_64.txt
• modified: toolkit/resources/manifests/package/toolchain_aarch64.txt
• modified: toolkit/resources/manifests/package/toolchain_x86_64.txt

Does this affect the toolchain?

YES

Associated issues

• [MEDIUM] Patch glib for CVE-2024-34397 #14223

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2024-34397

Test Methodology

• Pipeline build id: 1010969

Patch applies cleanly

Build is Successful

Verified ModemManager test with patched glib and its passed

[Kanishk-Bansal]

Buddy Build

[archana25-ms]

Buddy Build

Buddy build is successful.

[archana25-ms]

CVE-2024-24397 was merged in PR-14223 and was later reverted back in PR-14745 since there was test failure in ModemManager package during full build because of this CVE fix.

Hence in this PR the CVE patch is backported from https://gitlab.gnome.org/GNOME/glib/-/issues/3268#fixes
and verified the test execution of ModemManager package with the fixed glib present in toolchain.

Requesting for Full build so that other dependency packages test and build can also be verified.

[suresh-thelkar]

Code changes look good to me. Since the patch is huge, I have also run the full build given below. Please make sure all the packages and ptests run successfully and pass.

https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1038532&view=results

[Kanishk-Bansal]

Build

[archana25-ms]

Added another CVE-2025-1484 patch and buddy build link - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1038685&view=results
Buddy build is successful. Waiting for above mentioned full build results

[suresh-thelkar]

Added another CVE-2025-1484 patch and buddy build link - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1038685&view=results Buddy build is successful. Waiting for above mentioned full build results

Please make sure that you fix the issues with the full build first and make sure everything goes fine. Then only add this CVE. Probably you can add this CVE in a new PR. Already the patch is huge and adding another CVE patch in the same PR is not advisable according to me.

[archana25-ms]

Removed CVE-2025-1484 from this PR and created new PR - #15774 as requested

[suresh-thelkar]

The recent code changes look good to me. I have also run the full build, here is is the link - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1077265&view=results

[archana25-ms]

Latest Buddy build link: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1099481&view=results

Result is successful

Full Build link - https://polite-mud-0e83c8510.6.azurestaticapps.net/#/?buildNumber=2.0.20260421-sthelkar-1099526&environment=Development

[kgodara912]

The changes are widespread and previously caused failure for some other package which was dependent on glib. As the CVE is not high or critical and changes are disruptive and can cause failure for users relying on old behavior. We will hold this CVE.