[david-mendez1]

Jira: DLPX-100127 [CD - 2026.6.0.0] - CVE-2026-111497 on drgn

= Problem

The drgn wheel that dh_virtualenv installs into /opt/venvs/sdb bundles its own Brotli 1.0.6 (libbrotlicommon and libbrotlidec in drgn.libs/). That version has a decoder buffer overflow, CVE-2026-111497 (CVSS v4.0 9.2, listed in CISA KEV with a federal due date of 2026-11-10).

The Ubuntu libbrotli1 update does not reach the bundled copy. Refreshing the wheel does not help either: the latest PyPI release, drgn 0.3.0, still bundles Brotli 1.0.6, because the wheels are built on an EL8 image.

= Solution

After dh_virtualenv builds the venv, debian/use-system-brotli replaces the two bundled Brotli libraries with symlinks to the system libbrotlicommon.so.1 and libbrotlidec.so.1. debian/control requires libbrotli1 (>= 1.1.0-2ubuntu0.1) at build and run time, the noble security update that carries the fix.

The script fails the build if the wheel no longer bundles Brotli, so the step is removed deliberately rather than going stale. It also fails if _drgn has an unresolved library after the swap.

Rejected: building drgn from source against system libraries. It would also stop the wheel's other EL8 libraries (OpenSSL 1.1.1k, libcurl, krb5) from drifting out of date, but it needs a larger packaging rework than this CVE justifies.

= Notes To Reviewers

• The symlinks keep the wheel's hashed file names (libbrotlidec-0a7ba021.so.1.0.6), so the wheel's libcurl, which links Brotli 1.0.6 by that name, loads the system 1.1.0 library instead. That relies on the Brotli decoder ABI being compatible across those versions.
• debian/use-system-brotli is not idempotent on an already-swapped venv. A build always starts from a fresh venv.
• Backporting to release for 2026.6.0.0 is not part of this change.

= Testing

Manual, on a dlpx-develop VM (develop build 4892, noble, libbrotli1 1.1.0-2ubuntu0.1):

• dpkg-buildpackage -us -uc -b succeeds. The .deb contains the two symlinks and Depends: libbrotli1 (>= 1.1.0-2ubuntu0.1).
• After dpkg -i, dpkg -V sdb reports no differences and sudo sdb -e "threads | count" on the live kernel prints (unsigned long long)619.
• import drgn in the packaged venv maps the system libbrotlicommon.so.1.1.0 and libbrotlidec.so.1.1.0. The previous venv mapped the bundled 1.0.6 copies.
• shellcheck debian/use-system-brotli is clean.
• Crash dump, on the same VM with the packaged sdb: a forced crash (echo c > /proc/sysrq-trigger, kernel 7.0.0-38-dx2026100723) produced a 2 GB kdump. sdb <vmlinux> <dump> opens it, threads | count prints (unsigned long long)628, and dmesg | tail prints the crash-time log. threads | filter "obj.pid == 800579" | stack on the panicking task prints the full stack, from crash_setup_regs and panic through sysrq_handle_crash, write_sysrq_trigger and vfs_write to entry_SYSCALL_64. A drgn Program on the dump maps the system libbrotlicommon.so.1.1.0 and libbrotlidec.so.1.1.0.

Not tested: a userland core file, delphix-stat, support_info, analyze_system_core, and a crafted Brotli stream. The build pulled drgn 0.3.0, newer than the wheel in the previous package, and I did not compare sdb output against the old package.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.65%. Comparing base (7f3c2aa) to head (9f3101a).
⚠️ Report is 3 commits behind head on develop.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff            @@
##           develop     #363   +/-   ##
========================================
  Coverage    76.65%   76.65%           
========================================
  Files           73       73           
  Lines         4558     4558           
  Branches       728      728           
========================================
  Hits          3494     3494           
  Misses         878      878           
  Partials       186      186           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟢 Approval recommended

No active review issues are identified for the change replacing bundled Brotli with patched system libraries.

No open issues 🎉

What changed in this PR

Addresses the bundled Brotli vulnerability in SDB’s packaged drgn wheel by replacing its Brotli libraries with symlinks to patched system libraries.

Changes:

• Adds a replacement script that checks for bundled Brotli and unresolved library dependencies.
• Runs the script after dh_virtualenv creates the packaged environment.
• Requires libbrotli1 (>= 1.1.0-2ubuntu0.1) at build and runtime.

File	Description
debian/​use-system-brotli	Replaces bundled Brotli libraries with system-library symlinks and checks dependency resolution.
debian/​rules	Hooks the replacement script into the package build.
debian/​control	Adds minimum patched Brotli build and runtime dependencies.

_{Review effort: Balanced}

[prakashsurya]

Approving. The swap is correct for the wheel noble actually installs (manylinux_2_28): only the wheel's libcurl links the bundled libbrotlidec, the 5 unversioned symbols it uses are exported by system 1.1.0, and libcurl is BIND_NOW, so your import drgn check also proves they resolve. dh_md5sums and dh_link leave the symlinks alone.

One check before closing DLPX-100127 (not blocking): the files keep their …so.1.0.6 names and drgn's dist-info/RECORD still lists them with the old hashes. Running whatever scanner filed the ticket against the new image or .deb would confirm it clears rather than matching on filename.

For later, not this PR: the durable fix is to build drgn from its sdist on noble instead of installing the manylinux wheel, so _drgn links noble's system libraries and nothing is vendored. Today the wheel also carries EL8's libcurl, OpenSSL 1.1.1k, krb5 and libssh, each a future CVE apt can't patch. Roughly:

• --no-binary drgn passed to pip via dh-virtualenv's --extra-pip-arg.
• Build-Depends on libdw-dev, libelf-dev, libdebuginfod-dev, libkdumpfile-dev, liblzma-dev, libpcre2-dev, libjson-c-dev, plus the autotools drgn's build needs.
• Drop override_dh_shlibdeps so ${shlibs:Depends} tracks them again; pin drgn in requirements.txt for reproducibility. debian/use-system-brotli goes away.

The cost is older libraries: noble has elfutils 0.190 and libkdumpfile 0.5.4 against the wheel's 0.196 and 0.5.6. drgn only requires libdw >= 0.165, so it builds, but sdb on crash dumps would need re-validation. This stays on upstream drgn, not a return to the delphix/drgn fork.