From patchwork Tue Sep 29 13:06:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jakub Szczudlo (Nokia)" X-Patchwork-Id: 99583 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E3031CA5FAE for ; Tue, 29 Sep 2026 13:06:56 +0000 (UTC) Received: from AM0PR02CU008.outbound.protection.outlook.com (AM0PR02CU008.outbound.protection.outlook.com [52.101.72.1]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7357.1790687207044132166 for ; Tue, 29 Sep 2026 06:06:47 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=Q+Re/b7Z; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 52.101.72.1, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=FiaGRBjE+jS9+s6Ygtq7w6meo19KFMnVlJgl9uhZGoySDIxmMk3ig4GSy0OU5vku9R+e+ILcd6WCKJ2n7dMZl0Ss/PTTR2NHwGo5wQq1KqqI9vaIqmp+/dRnPYGX49um8P9InY1h+fiWRGPX0j45fZWis5qUNnfkAiz+RipTNMd17+wcy6WB0GAqbbkr2aKd6WDw50mNWzEaxVkpDPmC/oUD9bfGIV5Aze49uLGIKymbjdozYWZROrpmsUBX4bMtVVKtNmgr7znBZIA3EDan2lSTWaI+actEl+linMUIibLSBvc46Gjw9yHSFqlu6OqHsYoCWjfWO2JdnrEsusOWog== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=8x8Ky4ZhnLgG3/8KIKQwEKg/04ToRNomMiusFu2uXtw=; b=AbrlaNRlGm4lV/x+P4ju0ecuUaAYvRzZR37ywRRAAkzvtIzsB9WU3uAshTjxyEgDtW1MIENmV2MLUv7qPtUp1WrCw+iXeDu8U0cTx8UZ+Hs4j27Dif5r3Od2IYAnOZyk0nXwGoqxNpDpwYVGqCH0FJjpCseUqzm5DewQgWoDQ5uCtqmooBwYwhYe11QUJg35Qd2JscAYRLZ/Fsh3v6ZF52WYJXnZnb6DF1yLn9Y5R+DEVuyuJKjjyPcaA6oY+4+wJtyx2Cxbp37T44XUQ2fJqfusPs8auDKMRQPfF7B4Lpr4ce4TYLY63oo22ZQi7XuDtIygk8jlqEXJplfAe5gT8A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8x8Ky4ZhnLgG3/8KIKQwEKg/04ToRNomMiusFu2uXtw=; b=Q+Re/b7ZhnK9dJclfqYdoCr7Z3Gx6AOtxkgvI83/LUImazk8oxe7g0sjFYhbGkfyo9REZcaGFp9bANmBiu0KAK3Jkfl+dVTWKwcRzV+Pgf2QOEDb97mFjB15pmIW9DVdwjX3RtydMDiJT6BbqaIF6BndSLSE49qmln6sBrVJ7a+0itVjcakM1x6H5FKxy9XMVUZdVY/f31600molSFzgTZ3AOP8y2kFBxQb/wnIZVEFlNJ1Xg00PYxMZQgIQb64dNXBa44kIEzOpb2gm76fKWcJpON2Ne5NuvflalTLTsVSPl35YS7ZY0H1bRlvRwr4gUDjDoXp3bFT47oSrJLoB+g== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by PAXPR07MB7855.eurprd07.prod.outlook.com (2603:10a6:102:133::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.24; Tue, 29 Sep 2026 13:06:42 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0451.022; Tue, 29 Sep 2026 13:06:39 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [wrynose][PATCH v2 4/5] gnutls: fix CVE-2026-42015 Thread-Topic: [wrynose][PATCH v2 4/5] gnutls: fix CVE-2026-42015 Thread-Index: AQHdUBNdaffaZWRm+EOn2uHOZATWXA== Date: Tue, 29 Sep 2026 13:06:39 +0000 Message-ID: <20260929130622.246144-4-jakub.szczudlo@nokia.com> References: <20260929130622.246144-1-jakub.szczudlo@nokia.com> In-Reply-To: <20260929130622.246144-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|PAXPR07MB7855:EE_ x-ms-office365-filtering-correlation-id: 34239177-1cae-44ea-df2e-08df1e2a7fe6 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|376014|366016|1800799024|23010399003|12006099003|18002099003|22082099003|13003099007|38070700021|10067099003|260925022911599003|260925021311599003|260925021911599003|56012099006|11063799006; x-microsoft-antispam-message-info: lXylZXe5rYFu0fXrFA3LvqvZtVdA9E2IO190yFIjkOJFlcfYu+cwjKzK8ICXqUBa8sA8KzZ4qJEmz1B0uO1OKT67EpUmDLyi6NqQBHSyxUxhP5tN6dnl1r2CLyDqE74ycVEQBuDEx567zV/YovXCCwnGiwC7oWj0ZrzeOFfv/70BMa0ayg0GYr/9HgP+SeJGPh19srNBPCuKJQHPHqtJjq9GhiIqiXYO9MGTSHlERJ6faR9JYekMrk80aawwiJWuqTtWsKBh7m59MdaYJK1WHp/45bq9buRxmNRNHTPmrSOQoLr20Go2sT5oxCxNoXJtpZyyZ4bys7Dd3r9xT2GmiihqvIISEaMuNKwo6WeHqAxJWuKyzi+gk0F1YrdC0xVR6w6GEwGOU8DGm+t6RQfa7zcquI5LNM6/X6fa6F6ZYOeyNkzxyOyBQZ6y5l13xhDnTdVYPJ5I8i00fSaS7+VRtNyLjcQGjZXFEklXc88+9CfYKPg4SfoDN1HLfYKNNoN15m2lXKWPX1Dzg0ZSpKBz2AnpACuTekL/XIjR2bMJ89AgvUhlIapLYbEI38GgQe8AHzQBtib21f5QLa5gcFQjpgLYH7MulHW89gRiYPkNowh3mmvqIZQ9/ZWQqA6IbCI0L+NTjTOvQY0mkVFwpHAfzFFPoqI9/baDihIJ1T07sb4= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024)(23010399003)(12006099003)(18002099003)(22082099003)(13003099007)(38070700021)(10067099003)(260925022911599003)(260925021311599003)(260925021911599003)(56012099006)(11063799006);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?q?spRBO6RI0p4Z2cmY3xtOltgVUf/A?= =?utf-8?q?mdHNAw8DzGRhtsLz9hn/8uKX9o12nY+rvPqJymfCYM1qKJT2osyzv01pARnRgZ3Xn?= =?utf-8?q?b/1SmTm+mDxoXn+OS6HfZa7cPEVbLL5DVf6/YJSXTwZiqzXx/CuIEHJMq9pH0inGy?= =?utf-8?q?x9OZFX6ZuYyIaPpKB6oJOFD5IWRs8/N3VaXKoD24YETt8oBXNsyTFBOADasmD/5VF?= =?utf-8?q?O2JdqW4BYVkAnfqRbwyH6xPhS9SM9tVJIqfFp0iarA7cxKya0ZqVqEdtxe9CrV8UN?= =?utf-8?q?8hzHyyzUZUezJt7Gy/PcvJ+XseeyXvwhTb9De9HlGgppf3U+6XNTwoUK8uXti2VGH?= =?utf-8?q?XH0IlqksMemQVJV1g2rBhhqxTl+L0RhxzMfPwaKhAuIe1r6WmY+bOJRNJfVs7l4aH?= =?utf-8?q?Bdp4bEkcX6v0Co25mUhYMeibBS526dOZd9Tc083+fILwdaz8XWoBPLFqyHJnFG0f5?= =?utf-8?q?uKjbNF1V83xe3WlKL4HDezJBwVGtT6ZxM0lCOn8ukqkHXd39Xz8zgF2G7dTtIMWPX?= =?utf-8?q?xsrEFBf/i8NeYiIWSwUI9KTjC9hggLWZ4YyHCbuqaPHn0BwETkSd/BeyzuDFLt/R7?= =?utf-8?q?1tzYSxFwvr7x+OcUMsHkuYPa4xRnLnscTLXGozKDNz8ZIWJWIWcUYErG3Ph8Q+7c6?= =?utf-8?q?+xY+0bbz0vgosj+r52GoZTw5zkh3aN1ceRs1Z0RSfbGtmPcyYpvNFWnbqcPdfNUgT?= =?utf-8?q?Q1n9UE5Y/KkwJ32VYvWKzmQpWyIPpdemmb3oPA1r+TJpk4teQq6unIEX1lVYykdTQ?= =?utf-8?q?NEN3qe3orLUn/c5fuWz/QnLBmQ6MhjXd8pBrqhkZuDNcamsjEwmY+gPJTlLg7Fd5v?= =?utf-8?q?p9OeFsV1WeWkDCBPqYejoX/xQxnsbnG0hCtjYNOHkXhkZ48rr5anuFurAIbBldSCt?= =?utf-8?q?W/ktEs9ajlqFcq9kyhPDP5vr7j6r/97XHaAEfmKbPWIf6zNNkecyfTPCNYNAuGab4?= =?utf-8?q?B8XQNQa52L4/FHnQ1WBrwpf8sjneUGlOVoTBJFQgyEaP6KnKDU+fQ4Hp69d49sYwW?= =?utf-8?q?N4i9zvWsZhbKagH5vLsFYHIvt0yZNfAohqqJuCQJ9HXOO1u2L6LVLOG3LsMedFurm?= =?utf-8?q?vybx1LW9WMZPswUQUBH2XwnfM4arM6JosKD2SIxBxyqMIsKMQwW3JtktkgkSG5N8V?= =?utf-8?q?X58sMQ7Z8Fo0YNiMImNeqh1LjshoyF6CCrdWSNWU7i4jaZOdaAD7FKispEbFOAm3B?= =?utf-8?q?0BRX7/YoAYfd9HGWsMnwzGBp5Imed51ynzhLRgbOSZ954NiM84qo1PMQnGSxkVj5T?= =?utf-8?q?afMzZ2ylIZFQT6GHQmcCKspl0vhVATqsZliu75xmcl6kKKiVULIXMdfdrWYbrt+mM?= =?utf-8?q?zEIiTahfWXufXnIapoNtEr2ASOaqMMVt7kcHMlbloc98ysO2M2VL47TnbG43XDuhS?= =?utf-8?q?WOCASdtmodhqMI01Ug13+zUsl0J3ZBsS78W1CpquI1EjHtM6/47K0fYED2GL6a5wY?= =?utf-8?q?Ku8i1pXNJcm1nxDxcy2EinZaZtqV9kK3GydCTWbgJbAzanpfGu39lJY5ad2C78y+7?= =?utf-8?q?fyOlwPsJyUnCDvxpIdGJf3NM4QsefLXc4HqOgFzCHFCPpWv4WRl0R8o4iOxGyoWEZ?= =?utf-8?q?Al4LPpoUaM47+9oT6YHi3lvxxpgPh5USubI0jkq/ng+9Fh6p6NDnpF0zr3t4dguQX?= =?utf-8?q?oKkeC0KeaNw4t+wDQYO1tp/riVMj0XSA=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 34239177-1cae-44ea-df2e-08df1e2a7fe6 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Sep 2026 13:06:39.3140 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: pr+YoCagpur2166iDgDo976wYquELCBeURHytw3PNSIL7oIX7lCEytca8LxOesMg8bBtplrtteGWWywAy7Bq7iahCJHCzFjRE7GqpcczagA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAXPR07MB7855 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 29 Sep 2026 13:06:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246861 Backport patch to fix CVE-2026-42015. References: https://nvd.nist.gov/vuln/detail/CVE-2026-42015 Upstream fix: https://gitlab.com/gnutls/gnutls/-/commit/a3e7c50d3e1761e5ef1d4b225507cab8f2b2c3ca Tested with ptest Signed-off-by: Jakub Szczudlo --- .../gnutls/gnutls/CVE-2026-42015.patch | 43 +++++++++++++++++++ meta/recipes-support/gnutls/gnutls_3.8.12.bb | 1 + 2 files changed, 44 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42015.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42015.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42015.patch new file mode 100644 index 0000000000..1a2065371d --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42015.patch @@ -0,0 +1,43 @@ +From a3e7c50d3e1761e5ef1d4b225507cab8f2b2c3ca Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Mon, 20 Apr 2026 22:42:20 +0200 +Subject: [PATCH] x509/pkcs12_bag: fix off-by-one in bag element bounds check + +Appending elements to a PKCS#12 bag had a bounds check that +prevented adding the 32nd element. +On the other hand, it is possible to import one that already has 32. +Subsequent appending then led to writing past the 32-element array, +smashing its length. + +Tighten the check to reject any bag with 32 or more elements. + +We'll treat this vulnerability as a Low due to how contrived +the requirements are: for the code to be vulnerable, +it needs to append to an imported untrusted unencrypted PKCS#12 structure. + +Reported-by: Zou Dikai +Fixes: #1840 +Fixes: CVE-2026-42015 +Fixes: GNUTLS-SA-2026-04-29-11 +CVSS: 6.1 Medium CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H +Severity: Low +Signed-off-by: Alexander Sosedkin + +CVE: CVE-2026-42015 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/a3e7c50d3e1761e5ef1d4b225507cab8f2b2c3ca] + +Signed-off-by: Jakub Szczudlo +--- +diff --git a/lib/x509/pkcs12_bag.c b/lib/x509/pkcs12_bag.c +index 911aeff..3822861 100644 +--- a/lib/x509/pkcs12_bag.c ++++ b/lib/x509/pkcs12_bag.c +@@ -375,7 +375,7 @@ int gnutls_pkcs12_bag_set_data(gnutls_pkcs12_bag_t bag, + return GNUTLS_E_INVALID_REQUEST; + } + +- if (bag->bag_elements == MAX_BAG_ELEMENTS - 1) { ++ if (bag->bag_elements >= MAX_BAG_ELEMENTS - 1) { + gnutls_assert(); + /* bag is full */ + return GNUTLS_E_MEMORY_ERROR; diff --git a/meta/recipes-support/gnutls/gnutls_3.8.12.bb b/meta/recipes-support/gnutls/gnutls_3.8.12.bb index f0696e500b..81fb880c45 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.12.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.12.bb @@ -48,6 +48,7 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://CVE-2026-42013-pre1.patch \ file://CVE-2026-42013.patch \ file://CVE-2026-42014.patch \ + file://CVE-2026-42015.patch \ " SRC_URI[sha256sum] = "a7b341421bfd459acf7a374ca4af3b9e06608dcd7bd792b2bf470bea012b8e51"