From patchwork Wed Sep 9 13:36:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Jakub Szczudlo (Nokia)" X-Patchwork-Id: 97736 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7CCBFC79FBB for ; Wed, 9 Sep 2026 13:36:48 +0000 (UTC) Received: from AM0PR02CU008.outbound.protection.outlook.com (AM0PR02CU008.outbound.protection.outlook.com [52.101.72.40]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.12406.1788961004133811043 for ; Wed, 09 Sep 2026 06:36:45 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=dV6p8AyE; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 52.101.72.40, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=VEed60uk5luFTmxUFrMPN9HSZiMCLQHapI25FB8ccVnIAUmphKPZ7lJj3C7hdFqqUxdTHOya6U/U6b5+BOnQomeFkTbsYZ8AG2QBP3gxHHULLmywc2GF92FIGMP0SXLyjLDdtOdqAogSlu8hE45oUGNroKNH+8VuBsQEdU2pZE/CNHuOqeNbmwh9E0y2TwtgIicjp8za3uGU9VfVfzW4lRfQ22Mx+ZcEO0K8+lpdPSynYKqnGKIYXUmGB1ymn4HrL/wpRlbb7iYtI5LHuNZjAYySPcj8w78ZmWb0O1Kv+rhM/hM3j1iBbLrMPgSacmBYD+toCvyLeFGG5LDmtFFpng== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=e8hdsKmT9kzkLHQtyd18ij+S+NPx+0TuHrWd4XUEZEA=; b=S1IVp5xKo7T24x1NpTmqoisxEUcDMUs1B5uspwqRAW6vFAgiQeCIpGjDatmjhOAjuuXHk8JvNxS3HA1Cpk2AJyyAROorIBd3EsWnByxbi+pjEBxx3phVMxwMIFli01A3kHqkT67VqoEM5reeLeVteZgZ75MIhAf/lgXKiMjjRN9YHXH+NeXyYjhUVK06ybh1EX3cTNjnW+vODpGtwwwsK3+hcKlMQWR69QIi5z8u769q80KDR2jVbZlpsAwvFattYHEN4dmzsZkPl1aPF6us7GtQ9z2b3/PuQWseIM9sdOGMO/5Gf5qF8rkP2gPStcQhBOaaK3FHSxwwusp1nO0F5Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=e8hdsKmT9kzkLHQtyd18ij+S+NPx+0TuHrWd4XUEZEA=; b=dV6p8AyE8r5Q/kskfrT6VVmJjBGz9sc5sAveLdyNEb2mtSS0gOc/j9H18Hak67oA7SGB5rj/CoU+gTwQsy8FracrCsf90VqBpoFYB15Uc9G7AhS2RqsqhY+ICoBEgFNhXQKOvSs12iP7SUUwOL7nrsyOMmmgn1L1M4+aWkC51InOLhS824Tm7ufDVcOETKuz+TzxaEWu5WjP6SAx3zgqTajaEU8UNZ8/feZ5gHPFnnqplsKKhD5+Ijlyin2B1uF804UabgrOcPMG1pvw3TkY9ycyuN6+ax5y1QMLkJY276bgvIsWELJxGwZWkAV0dildJJTD7ZAFUC61WYBN+IkCDA== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by VI0PR07MB12084.eurprd07.prod.outlook.com (2603:10a6:800:33b::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.7; Wed, 9 Sep 2026 13:36:42 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0360.008; Wed, 9 Sep 2026 13:36:42 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [scarthgap][PATCH 2/5] gnutls: fix CVE-2026-42013 Thread-Topic: [scarthgap][PATCH 2/5] gnutls: fix CVE-2026-42013 Thread-Index: AQHdQGA/FukM/NTv5kCxfZZ9fqVcxA== Date: Wed, 9 Sep 2026 13:36:42 +0000 Message-ID: <20260909133633.3691-2-jakub.szczudlo@nokia.com> References: <20260909133633.3691-1-jakub.szczudlo@nokia.com> In-Reply-To: <20260909133633.3691-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|VI0PR07MB12084:EE_ x-ms-office365-filtering-correlation-id: 379fd0dd-c3a8-4cee-2702-08df0e77625e x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|366016|23010399003|376014|1800799024|38070700021|11063799006|10067099003|56012099006|22082099003|18002099003|12006099003|3023799007|13003099007; x-microsoft-antispam-message-info: drNI++MUxRtLhhNw6i0m8S6VHwS6OkFqMJpF6ssU6qL6dDglidCcY28HZ+2k2kJN1hY1Iso+QGObCUtEcMiCsg+4Qu8Q3ye0oHlIvQA+0sJx+kmOWk5FaqpH1Iww6suB600N4BiN90H1ICjvRw6tOoNNQCzc8rCmFnFxpDVxIU0DBaQ2fXepwVDPXOSxG9IBfSjDbFj++Yxqc/pOCzdO6dm6plDUGSSBhPQ+eR4XpCUAst9egTox9cddHsVK6+JBGXv/PKCn9hQjjq7UxrapTfnB8Z6EoREd6ci2u6Ndeq9ty/F/Hw8D7ydr+p7CJKHf+NzUFquCbmH6H89QiOqpTvFZszT/NT+Z5pbkQHfMLjpF11YoyFYmeXZh3c+q3qrCEVlyvbAqf/TF/bfOYjW/sCB+0SmRFNco5+zDlzUfRufViDnH9AYV7qCe3kKQrFuynHuIslgA7cqMfG1vx+iB75Two8md2lgvpy+kd7gGIjKlAeg///Q/vYnNS69KbjgTm/beoEt71w/zqkOJyZWL38e4SqcG66SNHdc3jcd2gZ+4Zg/7lPQDx1h5AL9bmqVJzKbSMjqzEL2EfJz8MTJbCAMOrvWt6FowvlSkvQ2XVh7zDDXziVTNkvZZPcMOfFYjjW7msr1ct12G+4uBTcGJrYYP1wRLh2tFA8pIXNxR7hCbe5Ay2JJ73po226z4eWVf0iuO9i8NRYzN4o8CwdfSAd/gLTvCBl/iy/XFnR6jcZE= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(376014)(1800799024)(38070700021)(11063799006)(10067099003)(56012099006)(22082099003)(18002099003)(12006099003)(3023799007)(13003099007);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?q?nGXU+9dULTLIvKfW29KnC61rmIXc?= =?utf-8?q?MsM9hunFZ+bN/5Gy122hILanX/6CTVqQAUkK/9bhtaFpU+Al0GbaNtHld4V+q2W85?= =?utf-8?q?/mLr+SfZ6yjziZ3u6nv9b6jkF79fSWOgUWNC6BKCSrQRQRHz5j8Sp8hSucqADzWwB?= =?utf-8?q?xJGxw5uC3XPPPbAE8zW4AFQOVwMvcIom9xZNu9W97NwTmSjPSau1tfbN0/81S/UnA?= =?utf-8?q?mJX8xqHowGBr0JrDFtwHnJ7oMEtRpILB+/wK7ZyPwfS26oawnWhVujtbqX144chII?= =?utf-8?q?ybjSD2T/k45O/CChUezT99sWejB0DqCkH54jmftl90qYLDxwlzhYP3zg9g2td0Eyj?= =?utf-8?q?F2jMJdZhRIzjFr0lTVO4PIjznrk3VbGxR+VpSM3lT2yD0wPr+hgBmx/fWbEL/56nO?= =?utf-8?q?ydhFKfnqG7hGBeBKCnAx3e38i3JfJ7x/gSAYGP7F5GhlgP3gwrufZc/EEnB6yNxkv?= =?utf-8?q?L0PHNDqMfaeycyUsCLVER5PeNfGuJ5YUdBXQ3QlJ7EmMwFYU6KlBzZpktNzFzjsvK?= =?utf-8?q?qGsnLQS+/8YcPXx9+f9ogJE4QatG6Ky3JeMRyeB7QB7yx/3OXaHPq8sdqgy6MP/gg?= =?utf-8?q?UtDA4ih9/+Fv3e5uOBbAALoAOpKvM75Ay8V/dMVG+/KvB5lzY4h0g2rxXov89QZnF?= =?utf-8?q?qqI1AzPzZYslwRV9PaMGD5ThW916Aoot9a4v38eSvr4MgINmQx5irAkyiZsChWjZA?= =?utf-8?q?JEtQHNjo7f7ydbGPs4T0oprfx+25sX03jce10BPeGXeVXVyHTq62DUpCC0chkTHYk?= =?utf-8?q?twbwCky42UUz2KHPUPhPdgwvJ9/ANxQjYi5YFt+hDlH2YC2x1IkJq+8LnkXgr1Cdj?= =?utf-8?q?ys/ZXnQcamOptv4EuOd6YyaWpN7oZ4/a10GpiBTCsXz2r7non/839FS6y1/yUOXx3?= =?utf-8?q?Di+kSr/Gz2AWsHwf3/Wwxxpog7VdzXKoyHOzBjD1KfHRw+3LTFkbre7pPAlNp7KCL?= =?utf-8?q?7lrddy4PAEs8h8/MUV1mt3yc2Boj9vR5uSxaakeNzZ9oKLvBVipp2yV5qOQrKcKqJ?= =?utf-8?q?cSzreqD2cYLrBpHk3gtf77g135HWQ5k6rSqxacvpPbhF+PFjm6gZY3abnDb/HY8wT?= =?utf-8?q?ZhMTMOO+/YeL7VozLLdVMVbRI/PGuV5U7KKiJtcX9T/GThBM6ID7t02iwmPrweag5?= =?utf-8?q?7Sq4JLDoa5Sctkr7kufHyYEEARBNYhl9Q1xPOH5J8sUzBPcim1hGTKoAwepiqjqAW?= =?utf-8?q?EuEaIIpKGGp6475EXJAv6fYstCvCwY13EcjowpoKBvASIF4Hj+OJFtYIIIAx/j54z?= =?utf-8?q?+KbdbK8z7t/bOrWcfUJiEPoWM05P0mt3JkwgnUURu4qAUKlx1qBDZuMU6rIB7yfUT?= =?utf-8?q?zuIbMVi8zuTGRR/rvjG0DL9VET2vkchPf4RTci94qyX/RTaTA3ceJfcJVw6IyDAlh?= =?utf-8?q?iI9ki01xgFyXYorUaKR4rJ05iUm9SekK7Df+nM5vCx6CujoyCi3gLTZSiiZTZYQAr?= =?utf-8?q?jzj46865ghvkRJA4HpPMcungNhAp6Sdbfu4dJWQm2vC8iytcMJWAllKKlWMGqIUQy?= =?utf-8?q?flmlzo7DpnB1mvRTeTrYQMiUNzmoheHsVZ+JmHift71CYQs49PNwy+R8klbrfAEUb?= =?utf-8?q?tg8NYkVb/rsnjVB5hGv8+WtuUv+iUgR3tFgdFzxE8RpCOe3OKtjohN/P8QCN+x/qp?= =?utf-8?q?90B5vOo2mrw1WZwp66rInajrqYzg1kOA=3D=3D?= Content-ID: MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 379fd0dd-c3a8-4cee-2702-08df0e77625e X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Sep 2026 13:36:42.3301 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: yroA9TCFMMEMc3tQjXNfYrs+HG+gM7lBa/EusydoEnYBzOJ+GN2GDLChFWnSAkVyPS1LzQS6UfnOxvkAqNqhjv4yY7meeq2Ircbin+xNqHo= X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI0PR07MB12084 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 13:36:48 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245469 Backport patch to fix CVE-2026-42013. References: https://nvd.nist.gov/vuln/detail/CVE-2026-42013 Upstream fix: https://gitlab.com/gnutls/gnutls/-/commit/29801bef00ecc0f23c0bac4cd333b269cd2c1af4 Tested with ptest Pre patch taken from upstream so CVE fix will land cleanly Signed-off-by: Jakub Szczudlo --- .../gnutls/gnutls/CVE-2026-42013-pre1.patch | 56 ++++++++++++++ .../gnutls/gnutls/CVE-2026-42013.patch | 74 +++++++++++++++++++ meta/recipes-support/gnutls/gnutls_3.8.4.bb | 2 + 3 files changed, 132 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42013-pre1.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42013.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42013-pre1.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42013-pre1.patch new file mode 100644 index 0000000000..53687cb53b --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42013-pre1.patch @@ -0,0 +1,56 @@ +From 3ee2cb707002f755e4bda3f75285caa0cb36c214 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Wed, 15 Apr 2026 15:35:59 +0200 +Subject: [PATCH] x509/email-verify: call fallback DN fallback + +A comment was inaccurately referring to DN email field fallback +as CN fallback. +Rename a few things as well to match x509/hostname-verify more closely. + +Signed-off-by: Alexander Sosedkin +CVE: CVE-2026-42013 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/3ee2cb707002f755e4bda3f75285caa0cb36c214] + +Signed-off-by: Jakub Szczudlo +--- + lib/x509/email-verify.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/lib/x509/email-verify.c b/lib/x509/email-verify.c +index dbef0bb86e..3c22ffed37 100644 +--- a/lib/x509/email-verify.c ++++ b/lib/x509/email-verify.c +@@ -42,7 +42,7 @@ unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email, + { + char rfc822name[MAX_CN]; + size_t rfc822namesize; +- int found_rfc822name = 0; ++ bool dn_fallback_allowed = true; + int ret = 0; + int i = 0; + char *a_email; +@@ -76,7 +76,7 @@ unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email, + cert, i, rfc822name, &rfc822namesize, NULL); + + if (ret == GNUTLS_SAN_RFC822NAME) { +- found_rfc822name = 1; ++ dn_fallback_allowed = false; + + if (memchr(rfc822name, '\0', rfc822namesize)) { + _gnutls_debug_log( +@@ -102,12 +102,10 @@ unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email, + } + } + +- if (!found_rfc822name) { +- /* did not get the necessary extension, use CN instead +- */ ++ if (dn_fallback_allowed) { ++ /* did not get the necessary extension, use DN email instead */ + +- /* enforce the RFC6125 (ยง1.8) requirement that only +- * a single CN must be present */ ++ /* only a single one must be present */ + rfc822namesize = sizeof(rfc822name); + ret = gnutls_x509_crt_get_dn_by_oid(cert, + GNUTLS_OID_PKCS9_EMAIL, 1, diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42013.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42013.patch new file mode 100644 index 0000000000..c63e4d7039 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42013.patch @@ -0,0 +1,74 @@ +From 29801bef00ecc0f23c0bac4cd333b269cd2c1af4 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Wed, 15 Apr 2026 16:02:19 +0200 +Subject: [PATCH] x509: prevent fallback on oversized SAN + +Passing oversized SAN did not preclude CN (or DN email) fallback +during verification, which is an RFC 6125 6.4.4 violation. + +Now oversized SAN are skipped over, +but prevent the fallback from happening. + +Reported-by: Haruto Kimura (Stella) +Reported-by: Joshua Rogers of AISLE Research Team +Fixes: #1825 +Fixes: #1849 +Fixes: CVE-2026-42013 +Fixes: GNUTLS-SA-2026-04-27-8 +CVSS: 6.5 Moderate CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N +Signed-off-by: Alexander Sosedkin +CVE: CVE-2026-42013 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/29801bef00ecc0f23c0bac4cd333b269cd2c1af4] + +Signed-off-by: Jakub Szczudlo +--- + lib/x509/email-verify.c | 14 ++++++++++++++ + lib/x509/hostname-verify.c | 14 ++++++++++++++ + 2 files changed, 28 insertions(+) + +--- a/lib/x509/email-verify.c ++++ b/lib/x509/email-verify.c +@@ -75,6 +75,20 @@ unsigned gnutls_x509_crt_check_email(gnu + ret = gnutls_x509_crt_get_subject_alt_name( + cert, i, rfc822name, &rfc822namesize, NULL); + ++ if (ret < 0) { ++ if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) { ++ /* oversized SAN; proceed without DN fallback */ ++ _gnutls_debug_log("oversized SAN ignored, " ++ "disabling DN fallback\n"); ++ dn_fallback_allowed = false; ++ ret = 0; ++ continue; ++ } ++ if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) ++ gnutls_assert(); ++ break; ++ } ++ + if (ret == GNUTLS_SAN_RFC822NAME) { + dn_fallback_allowed = false; + +--- a/lib/x509/hostname-verify.c ++++ b/lib/x509/hostname-verify.c +@@ -213,6 +213,20 @@ hostname_fallback: + ret = gnutls_x509_crt_get_subject_alt_name(cert, i, dnsname, + &dnsnamesize, NULL); + ++ if (ret < 0) { ++ if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) { ++ /* oversized SAN; proceed without CN fallback */ ++ _gnutls_debug_log("oversized SAN ignored, " ++ "disabling CN fallback\n"); ++ cn_fallback_allowed = false; ++ ret = 0; ++ continue; ++ } ++ if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) ++ gnutls_assert(); ++ break; ++ } ++ + if (PRECLUDES_CN_FALLBACK(ret)) + cn_fallback_allowed = false; + diff --git a/meta/recipes-support/gnutls/gnutls_3.8.4.bb b/meta/recipes-support/gnutls/gnutls_3.8.4.bb index 34d9603efa..72bec9b354 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.4.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.4.bb @@ -50,6 +50,8 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://CVE-2026-42012-pre2.patch \ file://CVE-2026-42012-pre3.patch \ file://CVE-2026-42012.patch \ + file://CVE-2026-42013-pre1.patch \ + file://CVE-2026-42013.patch \ " SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b"