From patchwork Wed Sep 9 13:36:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jakub Szczudlo (Nokia)" X-Patchwork-Id: 97738 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8622CC79FB6 for ; Wed, 9 Sep 2026 13:36:58 +0000 (UTC) Received: from AM0PR02CU008.outbound.protection.outlook.com (AM0PR02CU008.outbound.protection.outlook.com [52.101.72.61]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.12278.1788961016695980870 for ; Wed, 09 Sep 2026 06:36:57 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=FFYw32fa; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 52.101.72.61, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=iHYmmsUkp3fh32P/Z6fFAuvVMPhLehuWDW+2jKs73jFck1SV37UEB5yxjKjA3SY+Oi0xhNPnwT0YoMMsZukQOvNoJkrrBmM3tIByYvW/5gZV75gM27QEUpPg0w1ZJHiRrZmU+nmKDMrH5Xb1k4X/9G+luwbJOsPz4PBSS3D55lSZXPAMa24puMBwGYXHmxVIN+ZelT9hRSaPM1pRmsGN35aJoZHZCRQzunPu6DsfsAIFqbeWvwRlLw5FXRpv1LhEq9NHiqd5VasQCDdiWEwtt25a0mlXLMprk8JpIgVqZBZBbDDCu5QehUWrePQXKWtXXox1gouIbH8X4UFucjiBXw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ceNRAfC6knGDUFHgUhKFe2tsk28/W5oViQPKiG3oGhI=; b=jAdDQAy6PMKG6dl3hUa2YSCafKctvUjidOx1bzfwVl28MWAxjKEKEGIG2i7+xZsOerEtRt6r2FQ1o+zbIdHUXUqQVpiANzpzV+6/HPjO113MIi8luqM87FxFGFykgA/cH4+ZOxvP4JJBOn711XrFYxlS8RghY25QSBGMtSAY9HlXHS8N93vGe9u9RXS9BbNacyFf60UxFUx1DHk1R5DFRiQMfKB5nklBbHa9OTs3B9Do/cQJTTA8xhcL2Aj1znfk7Fxh72gfAHnvsZdfv6qZshhRHbhvqNsrXI/tKvlg+YuTojWfTYQzmIW0tisSYWgKNWDUvcr2gNsyJcBYlm9o7Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ceNRAfC6knGDUFHgUhKFe2tsk28/W5oViQPKiG3oGhI=; b=FFYw32fagBcrvmHQTaYP+sP2PoQBbbnKXji3u6BN9yPPxsQQteKwhtDcku7l+9Iks0lYCOJDJjz95yVVj2dPQsMmmw+SaqT2ivqGSwkiRxAMIZgVEzNi7jQqeSCr7gOFvUNr61LKd0NC8BIMo4GL1+j817MkShRTOBMx7HPfQPBHeXh1pyYdRsNsEf5w6IsRD158anNvp3Se98uPzxYtvt99xfn8CY3MBcFVIPhDR+xERD4C3sYIrIU9yW6n29Kgkbx1dYGApDG3ScgaaCxoUd1X5afeZgjFFRBpY5R7ye6c5FF8ymxXsJ2JPku9Xo2CHxpz8ffrNCkgMDf3mSTg+w== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by VI0PR07MB12084.eurprd07.prod.outlook.com (2603:10a6:800:33b::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.7; Wed, 9 Sep 2026 13:36:51 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0360.008; Wed, 9 Sep 2026 13:36:51 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [scarthgap][PATCH 4/5] gnutls: fix CVE-2026-42015 Thread-Topic: [scarthgap][PATCH 4/5] gnutls: fix CVE-2026-42015 Thread-Index: AQHdQGBFiA+c/Gem2keYu0HOxYryyg== Date: Wed, 9 Sep 2026 13:36:51 +0000 Message-ID: <20260909133633.3691-4-jakub.szczudlo@nokia.com> References: <20260909133633.3691-1-jakub.szczudlo@nokia.com> In-Reply-To: <20260909133633.3691-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|VI0PR07MB12084:EE_ x-ms-office365-filtering-correlation-id: c1b7c9f6-9c16-439a-318f-08df0e776784 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|366016|23010399003|376014|1800799024|38070700021|11063799006|10067099003|56012099006|22082099003|18002099003|12006099003|13003099007; x-microsoft-antispam-message-info: /5ukurUBysEZCURIGrgkLA0eiPC5JVBzqTbGYxZmS5t5amODrPwunmNds92GJAPU5TJRU/TGGrLL1djfDr9VehmYiVL4cL+6ITEG5LgMjrGTeNjtaD8p5mqSvUTib/x0hjDk2xGgHl6Azg3z5WOYYoO3l2mGS1k7xQ5cgAIcgIbd9c0SuRsNP8adRVS0xPUyBR1jJBIPE8WKV7MygZ1tDs54H6mD24IqbQFj8ZsQNRjh6amq/FtwfybbuOXrOqDJDXZ6glhy3LXHZnEHHoikKD/LCnOx9S/pwAMEjIFIVzj7/0ZaeZrPmmV9oXjMFRNLHPVt3/v8PjUkQZK0FCSMyVhQe2KJHTkqNqaaOdY6sSnPlZb+vip41Dq5Swad0PLmuHMXRo8UAdB8FpNoUDm97KaXFD86ru/Wyx7RSm3Mi3FDZEp375G5qos4artGzTBmSlAz5hfYVCQCIiI5wHK1HqDewACFg0Vh3mGcNvH8awfS3CBrHjG6sgW2c/nB47cPkB2c2YNSV+ecsIgweSDXpE1h+TSeUBVeZ/xaBiPFsUzD7Rj9DtJ4LBb8ck9EM2vZU+whtvRuhubfn59G3RyML+ZZZeHcPaaXPNX4SndOb705Sq/IrTLtTP+Cw8DVQhAH1OvJxl0IuIjpMR/BpAtzLAGAV67PAElbKE3xqBfR+BR41JNtHwICbJbpZmQwMBIynv9SdVj/GW+8TKJqNN3cgzdbey21m56mvshqL4TinGY= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(376014)(1800799024)(38070700021)(11063799006)(10067099003)(56012099006)(22082099003)(18002099003)(12006099003)(13003099007);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?q?g2XH+F33PbKCphhGQXm/tZx?= =?iso-8859-1?q?ZNDB5XzTwiVNLh4QPtxBWn/66J3RekWp2tWMyKvPm6IaWX3d/5S+WovXYZIn?= =?iso-8859-1?q?SBjZCNmtcCc06my6hOdHnsMO61jBPVvM2U/43zRYYQLooduufuLpAZFmNsg6?= =?iso-8859-1?q?aealmSscQLpMt0L5T/Tz/Kxv80YImfg2IUyKxttpSWmpfNc5K1WnQZvWNVZF?= =?iso-8859-1?q?v4iM2m+daf5ytnLjoPyryXsCaFGRGYbMkBpI+eHDrz98MweogGSvXDu530KQ?= =?iso-8859-1?q?5tK/vTKKMZuHdjsyYT/K44UphegqX6VwKIggV3FXLK4a5v17E4dUAdSj+Sh8?= =?iso-8859-1?q?ZmNg7nvOB+bUYrqxMZmPn9hAOm8Yk8OhrUfx4U0cFopzyM3Eic32pnxj+Poo?= =?iso-8859-1?q?/FuQTsmzPJ0w54mlsxTRWWppYE52X9NDRudq5/nn+n5ViBDOIFhaiFQyFJxL?= =?iso-8859-1?q?M6jTo7JRgtE2SSD/Y9k41AT37qEicRXd1HQTXsLQzFMt+7diTPhkzWk3ttQC?= =?iso-8859-1?q?2ndiYRfOEzWo2k3UbrigiEWusx7206WCMAD2DWB80cornj4TD5Boz3OeaVyz?= =?iso-8859-1?q?XDyEseFeJ4lB1pW3Q93nC16pG0MRnNT622ZqH25fmSTtttft2SuWHdKBLtqe?= =?iso-8859-1?q?fTMgzuvSCkMs2sV3dV2cVDU+0WuiH40FTYmC+pZdMvphAwxE5DSL8laSqhYr?= =?iso-8859-1?q?ukcwzw1GpbKCIhbrOQVKGN7w8him9DpI7YbQCEk1ujtMFqu+c6FJTPTvi+xS?= =?iso-8859-1?q?cCfnmk9miKunpH32t23sR4RC0pCDQJQOCbALOWFWbIquvuZ8/IVAda/yYJkO?= =?iso-8859-1?q?+26IqMik6ENafjV/fhxHGvvmCUSHOMKOadCSA16Vkt6cYAI2lt1UJwtzeXDn?= =?iso-8859-1?q?7+0Ia+M0bDKK3C3XtnQ4UgU61b2OHjDcuUHzMS7DAbVjVgz97+hz0Raia3RN?= =?iso-8859-1?q?+ryJX9XSlthaaB5dNOIqZ/RCwKXw+RXID6wKxhxb/WDiFE64KODRf5vF4rhw?= =?iso-8859-1?q?8U3XjUBaVm7mXOtqjzgQUNW2A+KPdaSFvOoqK9RDV/csR6ePNMk0yrIDYbqg?= =?iso-8859-1?q?F1SFlG80gp/N1gU3ck5AeUvYbd2jVeikAaEAa9vgGcOWAl5Nlcvb/4INYEMZ?= =?iso-8859-1?q?ChSNqYyn0o1wRVaSoCAKx8iR6RfvUiFinGwbwtPo0I5MamaJ56AWDYbU7+lT?= =?iso-8859-1?q?meaBxahGwim6dTYCE/pohRqVXyRiPqtVsKfhIVBVCot7hxNHVef0G5prZwNC?= =?iso-8859-1?q?Ol450h/nUJHLdyVVBYSVlbn3HsfyZ1O0nZu4WxxcrCO2eiblRMhJl5p4I3bY?= =?iso-8859-1?q?K9neydwP7RMRMXYiO2iNgBj2a6vXzME+px0aIe5w82Zfi6azU0fGZg6oyIL+?= =?iso-8859-1?q?bBkFqQygeXSIcgEMnNJpxc+hWytKslcCh9i1PurgsgpCfACCA7KL/lbrkhZ8?= =?iso-8859-1?q?P1WoNobD2B20ycdHmss5ViYrEusJ2CuWWxNn6S4D5mWJSqlR3AEP5dRAaODT?= =?iso-8859-1?q?dKBVrRSPiq9UuA+Xo5u4qdAs8G/loBqewSQieIQplRzX9bkIGgmwWzAtHGTO?= =?iso-8859-1?q?z5hQs2eg7dbkpyb9qPgWi4ezbocjiFzyxud/p5JLuLWTK2IPedpdx77a/3Io?= =?iso-8859-1?q?q12lR/EAxTsR49htLOo/4nbQD6kzeP9HmbuZeV4s+4BKgE8wFdmRoJe3zMTc?= =?iso-8859-1?q?pVQl6pZLe1VQNWXPzOFgtTTHZVT9vsB6vlFHYR7LOt2HN11gNaNfJgsWcvNL?= =?iso-8859-1?q?iZWJWSMLwTfVv36Agu/Qb6WZSULK09Gjt+YY/F15psOhW4g=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: c1b7c9f6-9c16-439a-318f-08df0e776784 X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Sep 2026 13:36:51.0191 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: fnFPdzAdAQQZbJ/MOSawJwsYNNG94LPp669bmw6oDetYySBy2khPKACRYRg3TlblQjUXby2SJosa++t6jR8l3ncw4Wp8vVRIo7tnHnQpbsY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI0PR07MB12084 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 13:36:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245471 Backport patch to fix CVE-2026-42015. References: https://nvd.nist.gov/vuln/detail/CVE-2026-42015 Upstream fix: https://gitlab.com/gnutls/gnutls/-/commit/a3e7c50d3e1761e5ef1d4b225507cab8f2b2c3ca Tested with ptest Signed-off-by: Jakub Szczudlo --- .../gnutls/gnutls/CVE-2026-42015.patch | 43 +++++++++++++++++++ meta/recipes-support/gnutls/gnutls_3.8.4.bb | 1 + 2 files changed, 44 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42015.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42015.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42015.patch new file mode 100644 index 0000000000..1a2065371d --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42015.patch @@ -0,0 +1,43 @@ +From a3e7c50d3e1761e5ef1d4b225507cab8f2b2c3ca Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Mon, 20 Apr 2026 22:42:20 +0200 +Subject: [PATCH] x509/pkcs12_bag: fix off-by-one in bag element bounds check + +Appending elements to a PKCS#12 bag had a bounds check that +prevented adding the 32nd element. +On the other hand, it is possible to import one that already has 32. +Subsequent appending then led to writing past the 32-element array, +smashing its length. + +Tighten the check to reject any bag with 32 or more elements. + +We'll treat this vulnerability as a Low due to how contrived +the requirements are: for the code to be vulnerable, +it needs to append to an imported untrusted unencrypted PKCS#12 structure. + +Reported-by: Zou Dikai +Fixes: #1840 +Fixes: CVE-2026-42015 +Fixes: GNUTLS-SA-2026-04-29-11 +CVSS: 6.1 Medium CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H +Severity: Low +Signed-off-by: Alexander Sosedkin + +CVE: CVE-2026-42015 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/a3e7c50d3e1761e5ef1d4b225507cab8f2b2c3ca] + +Signed-off-by: Jakub Szczudlo +--- +diff --git a/lib/x509/pkcs12_bag.c b/lib/x509/pkcs12_bag.c +index 911aeff..3822861 100644 +--- a/lib/x509/pkcs12_bag.c ++++ b/lib/x509/pkcs12_bag.c +@@ -375,7 +375,7 @@ int gnutls_pkcs12_bag_set_data(gnutls_pkcs12_bag_t bag, + return GNUTLS_E_INVALID_REQUEST; + } + +- if (bag->bag_elements == MAX_BAG_ELEMENTS - 1) { ++ if (bag->bag_elements >= MAX_BAG_ELEMENTS - 1) { + gnutls_assert(); + /* bag is full */ + return GNUTLS_E_MEMORY_ERROR; diff --git a/meta/recipes-support/gnutls/gnutls_3.8.4.bb b/meta/recipes-support/gnutls/gnutls_3.8.4.bb index 6f1fc4d847..38ad19633c 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.4.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.4.bb @@ -53,6 +53,7 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://CVE-2026-42013-pre1.patch \ file://CVE-2026-42013.patch \ file://CVE-2026-42014.patch \ + file://CVE-2026-42015.patch \ " SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b"