From patchwork Tue Sep 29 13:06:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Jakub Szczudlo (Nokia)" X-Patchwork-Id: 99581 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DD6A0CA5FAC for ; Tue, 29 Sep 2026 13:06:46 +0000 (UTC) Received: from AM0PR83CU005.outbound.protection.outlook.com (AM0PR83CU005.outbound.protection.outlook.com [52.101.69.17]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7395.1790687199042747810 for ; Tue, 29 Sep 2026 06:06:39 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=IquSUxjL; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 52.101.69.17, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=iXBmMMrs2QHeqomIQRQy8JpC+oi/8Fweeh+Xkidun00toM1xf025icprava2b7BTNMnAQhgRNxGs1J3AJ4Slr6n6VT6trzLw+/rErv5LqrqQRAIM7sHXzh5z/k/iGC6lJyWgfT5aZd/GuwxYLoV5H1VAQg/+vY/4hOVHYVAfx0P4tmcvwARCaWEIdFnpfj+aWjemBMKLfwy1QhpKOz4YX1vFLpJ6PA1AVm161NSh6cVVRYBsCq5NohZ3NtcnZ4/ls+dS32Kq2VQ99xWMiV36V6DqmWuR0BqHIbAPkmROa9R2lcXYOPO8ByYfjpy0Fv6ZKsocPHkfqXh0y6Fum9pkow== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ov5DHcqbnZuFv1Y+jibQWSlggj5x2VcdvrITjMlkm0c=; b=XyfiX0jicLxjZkObVL0nKxlAf0wGQaEcqrSgDuGYpurqIO71JE48pjuPzloCK4WpOXfJ5uOFwIhXHRA5P+PxAXvk6nwDsBZfzGFbzzmZRN1C4VMdVe1SLLghByBIPK2EeTiNzZ55iYpK0E8KtOKsbV6hKfrqbKgfmTcZ6mOL8NQxbJcgWPBeLbmqibbRVLBUMFD7u1drA3BySWl4jeBUI6kwascJiEnqDFFfLRAfbWcYn9/CcbvyeIRfVsSFpV3tPfuhtEl1SfUpWnlYaYqI8E7fRdYYEupaGKvEYoOPq94/JF7Ag+KIH5Nt70WKMUOmmrUOLqQYw0MamYV2NZLvXA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ov5DHcqbnZuFv1Y+jibQWSlggj5x2VcdvrITjMlkm0c=; b=IquSUxjLBSsti5AJBZm+jhBzDzL1PuGdQFmo3aT16WqdJvgX0NTn2aOld0+m/cD1w0hNUZbiZ0+kSDK5UydwYxvmU/phU3uSvH5+RuYiTmkzObnZaOQSNw7rVOds0OisFsK8HJ0qp4hh5p+HDAghBs4swfUloeIUUKgL+30W4Ru1TIbQrDkA9+qsA5a++v1qLnfPUx9qFYekNH3iLRFLNvR+e4g2lSP0sMw8bQ3sTsj3FCtl9vZ1CZzhuRusOBhD+Bgj6Eqoa6WKvPfjnwTTbO89aORtwDrClnIEsBG6OXbzkJjTpI/31tz6HQo746d+TfcQwnLpmBCHfSl7RCEklw== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by AM9PR07MB7219.eurprd07.prod.outlook.com (2603:10a6:20b:2d1::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.24; Tue, 29 Sep 2026 13:06:34 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0451.022; Tue, 29 Sep 2026 13:06:34 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [wrynose][PATCH v2 2/5] gnutls: fix CVE-2026-42013 Thread-Topic: [wrynose][PATCH v2 2/5] gnutls: fix CVE-2026-42013 Thread-Index: AQHdUBNaZ/VAmBbIq0ODALavX051AQ== Date: Tue, 29 Sep 2026 13:06:33 +0000 Message-ID: <20260929130622.246144-2-jakub.szczudlo@nokia.com> References: <20260929130622.246144-1-jakub.szczudlo@nokia.com> In-Reply-To: <20260929130622.246144-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|AM9PR07MB7219:EE_ x-ms-office365-filtering-correlation-id: 136eea29-ae9c-4244-90ef-08df1e2a7cb8 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|366016|376014|1800799024|23010399003|10067099003|11063799006|56012099006|3023799007|12006099003|13003099007|18002099003|22082099003|38070700021|260925021311599003|260925021911599003|260925022911599003; x-microsoft-antispam-message-info: H3RMqBHuEajBGeaRiK5ZvoBimD+MjVgaj5H64eM/9gOCN07GhxT2gp4IJStf07uyvZTdfdSXLexaD2gQffEfLhQEHk8/4M2NIPPdSsO//LypKnytlhmKYnQwmNjz4OAzRHHgJRY27esKhM7+dT6NyD0IM76mHll2w1e9wg9Hb/HoqwHHnsODHcdZAf67gCESGFlLDMZ/lxKzNkYGOZDVjzKTNvYcXoU8HDs+u9lDOYbQgoC4JP55iQFjnKlhhK2hSK87HpIojh0kQJQgri8g4aboMcYJtcXAXPmCOwYz5qW4AX9dwEMfwu4OQgqetgIEqq4FydTbeGDz2k+1LzxIGOIdYcisv8b3iNpCFVLSMMvTAv9+/DvkVWXbABHn5oiVhwlMc9zp4ol+F34xrmm5Zrj3HSpvUsneUveltBPcfXMA7wlGi4lBJqxXPtdz22AEMCUKWb9kNOwqaYFARS9PRXlVRVNy+SMC5daKUUA8udiWPs0nnCaQ2h15Z60DgXmegolmS3p5yWqhGzpSg4oRgcwErpCJ4kgQLdcGIzPdpxP+7NKHUKLqHU9o677UKXHJ+VXfl+z1C37AqREkrRy3FbubIQBsmWWy3uUtYtbn3gRmhW2NhsOMfFqHXBDmhiD3ImynL/bEwpGXDuU+QmWu1EjqVMIGS1K9kd0upqFxzok= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(376014)(1800799024)(23010399003)(10067099003)(11063799006)(56012099006)(3023799007)(12006099003)(13003099007)(18002099003)(22082099003)(38070700021)(260925021311599003)(260925021911599003)(260925022911599003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?q?NXHz7WZFGFWjLOcKqicyu2Ts3POc?= =?utf-8?q?LLrDqMb3JYaJaGJGlZEUhZBLbGU3s6KG7q8mprxPDatBs34dbgOVbbcI8MQLPw6GO?= =?utf-8?q?dJ1OZ8Y34Avp5qax8NGWNR+YicbQ3zFWlyB2eukUfHJx967V2kwZBbLXAmLVQe4nf?= =?utf-8?q?uN/HQep4Ao6u+IoVvMDm2+vW2PMTZOxqY553mtFV86a2rHzNxKeCjMkUfnFr3setl?= =?utf-8?q?8c0mqXmcxLhLdw6fkTkAQl+pmfBMf4FDXbyiRJqPbtHYgOz57E+3UDj2CtK+NX3N7?= =?utf-8?q?06Gwo8bGYJMo12KNY/uYVux3POX5ScrnrUatGzf6S5joGkRcPwb7JAkQxOEDdZSeI?= =?utf-8?q?3t6uXNuuBeycvlt5A1o2zy6e13TII+CRlOkj76rjXfrgSxN3S0UeKgNi3r9HWVmRN?= =?utf-8?q?af8fwyFsTDOKuLXd3CnoqcAem7Tg0NHY69qM2kYSBAzy0WT0AHfNe6hbjGZEH04S4?= =?utf-8?q?ivhH3LWz7QYVC5I978LZ905xm/cLdDUDxFgvkgfeuMu4wguSw9VS1Dk9d0y6NLbV9?= =?utf-8?q?xRz1d0UQf7e2dCM4x8p8QzFYWTkzsGu45MyiVtjy4uCBlu/0cTf6KZT4MlLJg7Iu0?= =?utf-8?q?C2+QWb3QtnIjDw1D13kOL8NwhWY59zA7mqPlJcggL8RxAn/CtY4Gu7zzjvv9laW6A?= =?utf-8?q?y4uArw3KdWc0xujW1d9s3rRisqdJA35aDe0G9rnLip3cTDJNgvSJ1AmDWXanxNze5?= =?utf-8?q?lG3+lvg8aEpj5vFnRw/sh+oN5NzcmKh5cFsdPHGLsQWRh99aqC+sl1lWnzGcn4pLO?= =?utf-8?q?Ix/8JQmLF3k3amsk8FoTGNfWJhVg3gL5mTJxwU9I6mlZAvJdVynN5xPw62xg7LIOU?= =?utf-8?q?QQa5g7GMedEY7TiTXz3VnRVfDOSvzrBHqNeyAJ6MvuLT64wMm4VulkSs0GUdB/tFD?= =?utf-8?q?QIy4SjbV6aHtrY5mSMuNqbKqH5HSoVg+JV9OQbtyJMow6cSMlNsmIneGM4FdSMBd8?= =?utf-8?q?0pMGGaY6yeLP8x6FExnH5lxm0GAeYLhW+UVQPJYuuUQqtJXnnPicg27x+DA00bouR?= =?utf-8?q?C080xwuxCg2u1C/LFznTGdM/p/Kvb3uBqLdfb8fb0K5ycqXk+pd+a1SFQKDvsBuPu?= =?utf-8?q?iLyoBXDijh4IpuJAIwLNbgUpzwBO4Hqpy2s1mCJuEpDtpx50P13nLtZ8tHwgvjn0X?= =?utf-8?q?jX2t3H9I8TWioSHMSwNf9ucWEHogFv+7MROeeMNNSpeGcF8aKv4vMbIdKtZMEBL+s?= =?utf-8?q?Tq73VhACTKqX6OVHOYeQQj4QcttV9VzKWMjxz591/7YbIxzmsJwYJ2mp5MQB96z8f?= =?utf-8?q?3GcZ2imkbyZhMjuXJJ3JxJymSJv8ZELTJq9t0QTkA7AC1T3FYAakOndPKblGmrQ3M?= =?utf-8?q?zDE3t/WwAxNL1bvQ+C3LEMvZFqYdMj7lA/tOtVfY5NmLlpeK/rFg9BxIAhszSECtK?= =?utf-8?q?7ORqTasR6WetTwvuYBvRU2T9c1P8xBDxtiG/qHKrZ0B6ky4Ec3R4xZfMxEEZJiCr0?= =?utf-8?q?XiI2cE5h1REt9rZZGqnY+DlW6A10UNKz8CgiFigWow0840iUM1D4G1aAEUq7aUTaz?= =?utf-8?q?lvLAA8DcNiVxKs8Z0jJ9R3juh2EbZ4ukOBI3xGBg1mLL7H/r2Jk9Cl6L/YcdnPj8l?= =?utf-8?q?thZ9DTU+iy7emu8b0F7+mr3Edc2AQ96GxIGsgtrQJcheaNe/iN81NMhMoyS87Achi?= =?utf-8?q?i1Y29NeNHyGMYSh5ys+dykzNYUEnV6fA=3D=3D?= Content-ID: MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 136eea29-ae9c-4244-90ef-08df1e2a7cb8 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Sep 2026 13:06:33.9786 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: R0INLTpY8k8vASZ+WLKry5z99Ge/queIpHQ8EsahLauKHF0tBZlSoCXHL1ZGRDHK0pTtICBD5rOnOQK9ZI4ZKvqTK89OrQAhjvxKig3uNdc= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM9PR07MB7219 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 29 Sep 2026 13:06:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246859 Backport patch to fix CVE-2026-42013. References: https://nvd.nist.gov/vuln/detail/CVE-2026-42013 Upstream fix: https://gitlab.com/gnutls/gnutls/-/commit/29801bef00ecc0f23c0bac4cd333b269cd2c1af4 Tested with ptest Pre patch taken from upstream so CVE fix will land cleanly Signed-off-by: Jakub Szczudlo --- .../gnutls/gnutls/CVE-2026-42013-pre1.patch | 56 ++++++++++++++ .../gnutls/gnutls/CVE-2026-42013.patch | 74 +++++++++++++++++++ meta/recipes-support/gnutls/gnutls_3.8.12.bb | 2 + 3 files changed, 132 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42013-pre1.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42013.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42013-pre1.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42013-pre1.patch new file mode 100644 index 0000000000..53687cb53b --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42013-pre1.patch @@ -0,0 +1,56 @@ +From 3ee2cb707002f755e4bda3f75285caa0cb36c214 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Wed, 15 Apr 2026 15:35:59 +0200 +Subject: [PATCH] x509/email-verify: call fallback DN fallback + +A comment was inaccurately referring to DN email field fallback +as CN fallback. +Rename a few things as well to match x509/hostname-verify more closely. + +Signed-off-by: Alexander Sosedkin +CVE: CVE-2026-42013 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/3ee2cb707002f755e4bda3f75285caa0cb36c214] + +Signed-off-by: Jakub Szczudlo +--- + lib/x509/email-verify.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/lib/x509/email-verify.c b/lib/x509/email-verify.c +index dbef0bb86e..3c22ffed37 100644 +--- a/lib/x509/email-verify.c ++++ b/lib/x509/email-verify.c +@@ -42,7 +42,7 @@ unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email, + { + char rfc822name[MAX_CN]; + size_t rfc822namesize; +- int found_rfc822name = 0; ++ bool dn_fallback_allowed = true; + int ret = 0; + int i = 0; + char *a_email; +@@ -76,7 +76,7 @@ unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email, + cert, i, rfc822name, &rfc822namesize, NULL); + + if (ret == GNUTLS_SAN_RFC822NAME) { +- found_rfc822name = 1; ++ dn_fallback_allowed = false; + + if (memchr(rfc822name, '\0', rfc822namesize)) { + _gnutls_debug_log( +@@ -102,12 +102,10 @@ unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email, + } + } + +- if (!found_rfc822name) { +- /* did not get the necessary extension, use CN instead +- */ ++ if (dn_fallback_allowed) { ++ /* did not get the necessary extension, use DN email instead */ + +- /* enforce the RFC6125 (ยง1.8) requirement that only +- * a single CN must be present */ ++ /* only a single one must be present */ + rfc822namesize = sizeof(rfc822name); + ret = gnutls_x509_crt_get_dn_by_oid(cert, + GNUTLS_OID_PKCS9_EMAIL, 1, diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42013.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42013.patch new file mode 100644 index 0000000000..c63e4d7039 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42013.patch @@ -0,0 +1,74 @@ +From 29801bef00ecc0f23c0bac4cd333b269cd2c1af4 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Wed, 15 Apr 2026 16:02:19 +0200 +Subject: [PATCH] x509: prevent fallback on oversized SAN + +Passing oversized SAN did not preclude CN (or DN email) fallback +during verification, which is an RFC 6125 6.4.4 violation. + +Now oversized SAN are skipped over, +but prevent the fallback from happening. + +Reported-by: Haruto Kimura (Stella) +Reported-by: Joshua Rogers of AISLE Research Team +Fixes: #1825 +Fixes: #1849 +Fixes: CVE-2026-42013 +Fixes: GNUTLS-SA-2026-04-27-8 +CVSS: 6.5 Moderate CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N +Signed-off-by: Alexander Sosedkin +CVE: CVE-2026-42013 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/29801bef00ecc0f23c0bac4cd333b269cd2c1af4] + +Signed-off-by: Jakub Szczudlo +--- + lib/x509/email-verify.c | 14 ++++++++++++++ + lib/x509/hostname-verify.c | 14 ++++++++++++++ + 2 files changed, 28 insertions(+) + +--- a/lib/x509/email-verify.c ++++ b/lib/x509/email-verify.c +@@ -75,6 +75,20 @@ unsigned gnutls_x509_crt_check_email(gnu + ret = gnutls_x509_crt_get_subject_alt_name( + cert, i, rfc822name, &rfc822namesize, NULL); + ++ if (ret < 0) { ++ if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) { ++ /* oversized SAN; proceed without DN fallback */ ++ _gnutls_debug_log("oversized SAN ignored, " ++ "disabling DN fallback\n"); ++ dn_fallback_allowed = false; ++ ret = 0; ++ continue; ++ } ++ if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) ++ gnutls_assert(); ++ break; ++ } ++ + if (ret == GNUTLS_SAN_RFC822NAME) { + dn_fallback_allowed = false; + +--- a/lib/x509/hostname-verify.c ++++ b/lib/x509/hostname-verify.c +@@ -213,6 +213,20 @@ hostname_fallback: + ret = gnutls_x509_crt_get_subject_alt_name(cert, i, dnsname, + &dnsnamesize, NULL); + ++ if (ret < 0) { ++ if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) { ++ /* oversized SAN; proceed without CN fallback */ ++ _gnutls_debug_log("oversized SAN ignored, " ++ "disabling CN fallback\n"); ++ cn_fallback_allowed = false; ++ ret = 0; ++ continue; ++ } ++ if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) ++ gnutls_assert(); ++ break; ++ } ++ + if (PRECLUDES_CN_FALLBACK(ret)) + cn_fallback_allowed = false; + diff --git a/meta/recipes-support/gnutls/gnutls_3.8.12.bb b/meta/recipes-support/gnutls/gnutls_3.8.12.bb index 885e6fe8c8..bb3328b55e 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.12.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.12.bb @@ -45,6 +45,8 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://CVE-2026-42012-pre1.patch \ file://CVE-2026-42012-pre2.patch \ file://CVE-2026-42012.patch \ + file://CVE-2026-42013-pre1.patch \ + file://CVE-2026-42013.patch \ " SRC_URI[sha256sum] = "a7b341421bfd459acf7a374ca4af3b9e06608dcd7bd792b2bf470bea012b8e51"