| Message ID | 20251001121649.2605064-1-tgaige.opensource@witekio.com |
|---|---|
| State | Superseded |
| Delegated to: | Steve Sakoman |
| Headers | show |
| Series | [kirkstone] libxml2: fix CVE-2025-9714 | expand |
On Wed, Oct 1, 2025 at 5:32 AM Théo Gaigé via lists.openembedded.org <tgaige.opensource=witekio.com@lists.openembedded.org> wrote: > > From: Theo GAIGE <tgaige.opensource@witekio.com> > > Upstream-Status: Backport from https://git.launchpad.net/ubuntu/+source/libxml2/commit/?id=ff48b80d7ebd968eb9d4ee2d6cb3174959ad871a > > Signed-off-by: Theo GAIGE <tgaige.opensource@witekio.com> > --- > .../libxml/libxml2/CVE-2025-9714.patch | 117 ++++++++++++++++++ > meta/recipes-core/libxml/libxml2_2.9.14.bb | 1 + > 2 files changed, 118 insertions(+) > create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2025-9714.patch > > diff --git a/meta/recipes-core/libxml/libxml2/CVE-2025-9714.patch b/meta/recipes-core/libxml/libxml2/CVE-2025-9714.patch > new file mode 100644 > index 0000000000..99e0c7dfb3 > --- /dev/null > +++ b/meta/recipes-core/libxml/libxml2/CVE-2025-9714.patch > @@ -0,0 +1,117 @@ > +From b2c6511bd90063652ca1f8814f98ccae9dd24026 Mon Sep 17 00:00:00 2001 > +From: Octavio Galland <octavio.galland@canonical.com> > +Date: Fri, 5 Sep 2025 12:36:12 -0300 > +Subject: [PATCH] Make XPath depth check work with recursive invocations > + > +EXSLT functions like dyn:map or dyn:evaluate invoke xmlXPathRunEval > +recursively. Don't set depth to zero but keep and restore the original > +value to avoid stack overflows when abusing these functions. > + > +Upstream-Status: Backport [https://git.launchpad.net/ubuntu/+source/libxml2/commit/?id=ff48b80d7ebd968eb9d4ee2d6cb3174959ad871a] launchpad.net is not the upstream for libxml2. Please reference the commit in the upstream libxml2 git repository. Thanks, Steve > +CVE: CVE-2025-9714 > + > +Signed-off-by: Theo GAIGE <tgaige.opensource@witekio.com> > +--- > + xpath.c | 23 +++++++++++++++++------ > + 1 file changed, 17 insertions(+), 6 deletions(-) > + > +diff --git a/xpath.c b/xpath.c > +index c2d845888..028471d53 100644 > +--- a/xpath.c > ++++ b/xpath.c > +@@ -13883,12 +13883,11 @@ static int > + xmlXPathRunEval(xmlXPathParserContextPtr ctxt, int toBool) > + { > + xmlXPathCompExprPtr comp; > ++ int oldDepth; > + > + if ((ctxt == NULL) || (ctxt->comp == NULL)) > + return(-1); > + > +- ctxt->context->depth = 0; > +- > + if (ctxt->valueTab == NULL) { > + /* Allocate the value stack */ > + ctxt->valueTab = (xmlXPathObjectPtr *) > +@@ -13942,11 +13941,13 @@ xmlXPathRunEval(xmlXPathParserContextPtr ctxt, int toBool) > + "xmlXPathRunEval: last is less than zero\n"); > + return(-1); > + } > ++ oldDepth = ctxt->context->depth; > + if (toBool) > + return(xmlXPathCompOpEvalToBoolean(ctxt, > + &comp->steps[comp->last], 0)); > + else > + xmlXPathCompOpEval(ctxt, &comp->steps[comp->last]); > ++ ctxt->context->depth = oldDepth; > + > + return(0); > + } > +@@ -14217,6 +14218,7 @@ xmlXPathCompExprPtr > + xmlXPathCtxtCompile(xmlXPathContextPtr ctxt, const xmlChar *str) { > + xmlXPathParserContextPtr pctxt; > + xmlXPathCompExprPtr comp; > ++ int oldDepth = 0; > + > + #ifdef XPATH_STREAMING > + comp = xmlXPathTryStreamCompile(ctxt, str); > +@@ -14230,8 +14232,10 @@ xmlXPathCtxtCompile(xmlXPathContextPtr ctxt, const xmlChar *str) { > + if (pctxt == NULL) > + return NULL; > + if (ctxt != NULL) > +- ctxt->depth = 0; > ++ oldDepth = ctxt->depth; > + xmlXPathCompileExpr(pctxt, 1); > ++ if (ctxt != NULL) > ++ ctxt->depth = oldDepth; > + > + if( pctxt->error != XPATH_EXPRESSION_OK ) > + { > +@@ -14252,8 +14256,10 @@ xmlXPathCtxtCompile(xmlXPathContextPtr ctxt, const xmlChar *str) { > + comp = pctxt->comp; > + if ((comp->nbStep > 1) && (comp->last >= 0)) { > + if (ctxt != NULL) > +- ctxt->depth = 0; > ++ oldDepth = ctxt->depth; > + xmlXPathOptimizeExpression(pctxt, &comp->steps[comp->last]); > ++ if (ctxt != NULL) > ++ ctxt->depth = oldDepth; > + } > + pctxt->comp = NULL; > + } > +@@ -14409,6 +14415,7 @@ xmlXPathEvalExpr(xmlXPathParserContextPtr ctxt) { > + #ifdef XPATH_STREAMING > + xmlXPathCompExprPtr comp; > + #endif > ++ int oldDepth = 0; > + > + if (ctxt == NULL) return; > + > +@@ -14422,8 +14429,10 @@ xmlXPathEvalExpr(xmlXPathParserContextPtr ctxt) { > + #endif > + { > + if (ctxt->context != NULL) > +- ctxt->context->depth = 0; > ++ oldDepth = ctxt->context->depth; > + xmlXPathCompileExpr(ctxt, 1); > ++ if (ctxt->context != NULL) > ++ ctxt->context->depth = oldDepth; > + CHECK_ERROR; > + > + /* Check for trailing characters. */ > +@@ -14432,9 +14441,11 @@ xmlXPathEvalExpr(xmlXPathParserContextPtr ctxt) { > + > + if ((ctxt->comp->nbStep > 1) && (ctxt->comp->last >= 0)) { > + if (ctxt->context != NULL) > +- ctxt->context->depth = 0; > ++ oldDepth = ctxt->context->depth; > + xmlXPathOptimizeExpression(ctxt, > + &ctxt->comp->steps[ctxt->comp->last]); > ++ if (ctxt->context != NULL) > ++ ctxt->context->depth = oldDepth; > + } > + } > + > +-- > +2.43.0 > + > diff --git a/meta/recipes-core/libxml/libxml2_2.9.14.bb b/meta/recipes-core/libxml/libxml2_2.9.14.bb > index f34b0c25ca..932251da98 100644 > --- a/meta/recipes-core/libxml/libxml2_2.9.14.bb > +++ b/meta/recipes-core/libxml/libxml2_2.9.14.bb > @@ -42,6 +42,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20080827.tar;subdir=${BP};name=testt > file://CVE-2025-6021.patch \ > file://CVE-2025-49794-CVE-2025-49796.patch \ > file://CVE-2025-6170.patch \ > + file://CVE-2025-9714.patch \ > " > > SRC_URI[archive.sha256sum] = "60d74a257d1ccec0475e749cba2f21559e48139efba6ff28224357c7c798dfee" > -- > 2.43.0 > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#224208): https://lists.openembedded.org/g/openembedded-core/message/224208 > Mute This Topic: https://lists.openembedded.org/mt/115531861/3620601 > Group Owner: openembedded-core+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [steve@sakoman.com] > -=-=-=-=-=-=-=-=-=-=-=- >
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2025-9714.patch b/meta/recipes-core/libxml/libxml2/CVE-2025-9714.patch new file mode 100644 index 0000000000..99e0c7dfb3 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2025-9714.patch @@ -0,0 +1,117 @@ +From b2c6511bd90063652ca1f8814f98ccae9dd24026 Mon Sep 17 00:00:00 2001 +From: Octavio Galland <octavio.galland@canonical.com> +Date: Fri, 5 Sep 2025 12:36:12 -0300 +Subject: [PATCH] Make XPath depth check work with recursive invocations + +EXSLT functions like dyn:map or dyn:evaluate invoke xmlXPathRunEval +recursively. Don't set depth to zero but keep and restore the original +value to avoid stack overflows when abusing these functions. + +Upstream-Status: Backport [https://git.launchpad.net/ubuntu/+source/libxml2/commit/?id=ff48b80d7ebd968eb9d4ee2d6cb3174959ad871a] +CVE: CVE-2025-9714 + +Signed-off-by: Theo GAIGE <tgaige.opensource@witekio.com> +--- + xpath.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/xpath.c b/xpath.c +index c2d845888..028471d53 100644 +--- a/xpath.c ++++ b/xpath.c +@@ -13883,12 +13883,11 @@ static int + xmlXPathRunEval(xmlXPathParserContextPtr ctxt, int toBool) + { + xmlXPathCompExprPtr comp; ++ int oldDepth; + + if ((ctxt == NULL) || (ctxt->comp == NULL)) + return(-1); + +- ctxt->context->depth = 0; +- + if (ctxt->valueTab == NULL) { + /* Allocate the value stack */ + ctxt->valueTab = (xmlXPathObjectPtr *) +@@ -13942,11 +13941,13 @@ xmlXPathRunEval(xmlXPathParserContextPtr ctxt, int toBool) + "xmlXPathRunEval: last is less than zero\n"); + return(-1); + } ++ oldDepth = ctxt->context->depth; + if (toBool) + return(xmlXPathCompOpEvalToBoolean(ctxt, + &comp->steps[comp->last], 0)); + else + xmlXPathCompOpEval(ctxt, &comp->steps[comp->last]); ++ ctxt->context->depth = oldDepth; + + return(0); + } +@@ -14217,6 +14218,7 @@ xmlXPathCompExprPtr + xmlXPathCtxtCompile(xmlXPathContextPtr ctxt, const xmlChar *str) { + xmlXPathParserContextPtr pctxt; + xmlXPathCompExprPtr comp; ++ int oldDepth = 0; + + #ifdef XPATH_STREAMING + comp = xmlXPathTryStreamCompile(ctxt, str); +@@ -14230,8 +14232,10 @@ xmlXPathCtxtCompile(xmlXPathContextPtr ctxt, const xmlChar *str) { + if (pctxt == NULL) + return NULL; + if (ctxt != NULL) +- ctxt->depth = 0; ++ oldDepth = ctxt->depth; + xmlXPathCompileExpr(pctxt, 1); ++ if (ctxt != NULL) ++ ctxt->depth = oldDepth; + + if( pctxt->error != XPATH_EXPRESSION_OK ) + { +@@ -14252,8 +14256,10 @@ xmlXPathCtxtCompile(xmlXPathContextPtr ctxt, const xmlChar *str) { + comp = pctxt->comp; + if ((comp->nbStep > 1) && (comp->last >= 0)) { + if (ctxt != NULL) +- ctxt->depth = 0; ++ oldDepth = ctxt->depth; + xmlXPathOptimizeExpression(pctxt, &comp->steps[comp->last]); ++ if (ctxt != NULL) ++ ctxt->depth = oldDepth; + } + pctxt->comp = NULL; + } +@@ -14409,6 +14415,7 @@ xmlXPathEvalExpr(xmlXPathParserContextPtr ctxt) { + #ifdef XPATH_STREAMING + xmlXPathCompExprPtr comp; + #endif ++ int oldDepth = 0; + + if (ctxt == NULL) return; + +@@ -14422,8 +14429,10 @@ xmlXPathEvalExpr(xmlXPathParserContextPtr ctxt) { + #endif + { + if (ctxt->context != NULL) +- ctxt->context->depth = 0; ++ oldDepth = ctxt->context->depth; + xmlXPathCompileExpr(ctxt, 1); ++ if (ctxt->context != NULL) ++ ctxt->context->depth = oldDepth; + CHECK_ERROR; + + /* Check for trailing characters. */ +@@ -14432,9 +14441,11 @@ xmlXPathEvalExpr(xmlXPathParserContextPtr ctxt) { + + if ((ctxt->comp->nbStep > 1) && (ctxt->comp->last >= 0)) { + if (ctxt->context != NULL) +- ctxt->context->depth = 0; ++ oldDepth = ctxt->context->depth; + xmlXPathOptimizeExpression(ctxt, + &ctxt->comp->steps[ctxt->comp->last]); ++ if (ctxt->context != NULL) ++ ctxt->context->depth = oldDepth; + } + } + +-- +2.43.0 + diff --git a/meta/recipes-core/libxml/libxml2_2.9.14.bb b/meta/recipes-core/libxml/libxml2_2.9.14.bb index f34b0c25ca..932251da98 100644 --- a/meta/recipes-core/libxml/libxml2_2.9.14.bb +++ b/meta/recipes-core/libxml/libxml2_2.9.14.bb @@ -42,6 +42,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20080827.tar;subdir=${BP};name=testt file://CVE-2025-6021.patch \ file://CVE-2025-49794-CVE-2025-49796.patch \ file://CVE-2025-6170.patch \ + file://CVE-2025-9714.patch \ " SRC_URI[archive.sha256sum] = "60d74a257d1ccec0475e749cba2f21559e48139efba6ff28224357c7c798dfee"