From patchwork Tue Sep 29 13:12:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Jakub Szczudlo (Nokia)" X-Patchwork-Id: 99585 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D7328CA5FA5 for ; Tue, 29 Sep 2026 13:12:46 +0000 (UTC) Received: from MRWPR03CU001.outbound.protection.outlook.com (MRWPR03CU001.outbound.protection.outlook.com [40.107.130.24]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7504.1790687565911080143 for ; Tue, 29 Sep 2026 06:12:46 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=qephIP9B; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 40.107.130.24, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=BPKfFbsI/qeAolL0qSBd5G7HfziPAfYgExY1DQBrtTaw6Nn9P8uSwGIvACaKP5xP/6dH4rquJeDx3Spu3/13tDCs6nAUt5j+wu7dnwomNAv/18ISKojre7gYrPb9b+gcfu7lwyTtvwLwjqz8HYyT1cFLvChGbYDHZBL6/NXzFpeU4tBzrfKn+jQRKQ93d7q3KzXKmA7N3wj/alvko4tvw6tec2/1L4ylK4V2M4WZNWqCMTgdjR2qQGA9+djG37QiqX0+MpeI1a5fgjyg1xo4p73I539bx2IE1pk4IlMIVrV5cV1Q/rWM3oz2PvZHVqVexI6Fkd0y8Ckr8DYG2pLwTQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=faqxKQFm7QdNajwxwqzWabedvnPXQppHK+75DTeRoE8=; b=BjVEpQuhmS5IAxZyifk+kGCz/Ps2Uvu5JFHXk3fVtPX1GXu3j7dgTFCFIcA7QVDa62J1nGCgK0X6i4sGZm/BH0VE9jYvPI3EZ1PKLEGVr3ZW2xbhadq22dgxmI1tZpcs7EOZb0iAxF4lj3jVIj4gd2hS6fNSF6zv/vbJm9o00vyROK2aV4EWniYmuzSX0+qRqVzG1FX2Ydxi4fI2VWy6itDJAG41WVAkWVrDjnBMv8IW+DSyTlys7+q+iKQktiZ6ZVF+hM1HMn5dPfpg4MABsrDi3TCXI8phHA3/njNSETkmzZMlS64sSOPPvN87wHAhbzCdrC9xCIud8knlEJ1how== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=faqxKQFm7QdNajwxwqzWabedvnPXQppHK+75DTeRoE8=; b=qephIP9BZjiTRzVTaJuoNoOSrBsNLJ499AIseMDqzEK2094nLP+yRtIRmWTO0nRLvFDH4Wc7Ii1TqgfRIeNKaPDbD4fFaSsOIWWB3u76itgglr4vyFiKW3aqvcdh4u3iQYqw/j0y+okE7tq37X2p1Mi/qzClIxUaOItmMrHXBMHn29b9kkP8T23Q1ix614bFN+i8qcO8+l2+UU9RprsrgXPNK2KyLjF+qBNxlfqpSWjcnN1DCexosG/Rp0hxtgcXMPPyycqkxUNUuQAwhN55/OdrJJKfdm0agDlJLkAEUeQn6CF3LRYQVCDdI4gzI10E/wztibFOdCRP3bPCSEsRmQ== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by AM9PR07MB7219.eurprd07.prod.outlook.com (2603:10a6:20b:2d1::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.24; Tue, 29 Sep 2026 13:12:41 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0451.022; Tue, 29 Sep 2026 13:12:41 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [scarthgap][PATCH v2 2/5] gnutls: fix CVE-2026-42013 Thread-Topic: [scarthgap][PATCH v2 2/5] gnutls: fix CVE-2026-42013 Thread-Index: AQHdUBQ1AuM047R3ME6LM/YimJaLEg== Date: Tue, 29 Sep 2026 13:12:41 +0000 Message-ID: <20260929131131.246533-2-jakub.szczudlo@nokia.com> References: <20260929131131.246533-1-jakub.szczudlo@nokia.com> In-Reply-To: <20260929131131.246533-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|AM9PR07MB7219:EE_ x-ms-office365-filtering-correlation-id: 0796b6b3-e314-489c-4dc5-08df1e2b57a6 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|366016|376014|1800799024|23010399003|10067099003|11063799006|56012099006|3023799007|12006099003|13003099007|18002099003|22082099003|38070700021|260925021311599003|260925021911599003|260925022911599003; x-microsoft-antispam-message-info: 9ibq3TRnlWPiVrMQPxRPHspbjUE6BMp6sKuplSsxiredlcrwWzf6dhMBV2GXC5kWnsa4bojL7mXd10EAJ0kR7XB81/S2nflnAz8f1ITKRmNitaWO8kZB0M6owdEj862+Uc2r/vUXLQAFeeNPN/yaIBSxEAUQARjb5SmP/pmk2VqjPHMjApprVqyHXfyZSLc19iRU5bJo7Y1t17vJ394lKQbeM3xlNuPBFophXdWUnmTX76Qm9u0DZABpsy3kCaU3ujVcBKUjUxvB7wuarmWUii6gdDb4w+oaYsUXsRbPVhRr6mSO6JwEdRBUBgO5H0sCOVgni+Eatu3oJmPsWpwTtPG8f3gM8OmfNoDI0sU+LK1+PaPdqVzzY0LMEq25g5eMjBqtDJvVp0UFHYtuH37e89Sy0J+OjKaWalUEn+lGC6fCtX0iYdp4z9jJCA/psd16FiZs4oWkjcTXVswNwjnx7jMLKYGLzLLdnTaIBtshULQfJAosWvjzAmCzBsPq+VAzEpXrYLcu/hBr3BheVil31H4rik9pGLoGxfZ98oTfcuST2IYQ1R0umfRiRRSS35HVWPeG/V/hcyR1o5FA+RQk+lulAItk1NpnbhhdDMyBnzAllFS+zZ4NSon11V9x6WeldwYhOPcpG0kfTBlFtQQwW+DT9FRXX8J1ooFRFSUYHxo= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(376014)(1800799024)(23010399003)(10067099003)(11063799006)(56012099006)(3023799007)(12006099003)(13003099007)(18002099003)(22082099003)(38070700021)(260925021311599003)(260925021911599003)(260925022911599003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?q?Quit84XJJ8WQcg1rKRvfuINjUPDa?= =?utf-8?q?GqaSwgjoTSSIn35mPmX9dbTc97Hi/zU7AgUC76cSVzpwy/mt819yA6KA2DqIDKw10?= =?utf-8?q?CJPILHttLc7hINFAmwvbu/ktZVIEf2Ksm8Dntt5aiebR+GFgoawDC0FYTkqd5Go6D?= =?utf-8?q?icA9G1BsI1BOPvgtUAc78UlI+dCmtwMQSsSq/0/3kSOqPcSjQtU5U7KvSuV4HePOX?= =?utf-8?q?JCL27SRyZvk2JHblMb5e3TMDzivgJbC8/n0i5QKR/ObyJ2f1wE/F3MxCh1tLhqbl4?= =?utf-8?q?mic2soRwYxcFcJkJk0i357Gp25yj7zZnvHRvbzd5hoStUZg8Ux1ArX6ckK2ielG5B?= =?utf-8?q?p7RbnXX5Tq/884nW9qQpZM/L83b9+5Gvfb5hmvcynJd7eVIp2LdhKJfYrzkk3ifWv?= =?utf-8?q?4YAsvMnom8kQwx4ja/U2uQO/KfpzfKTgTEgJejSCQ9bSv4crULRAe9ZqjL88kP8vG?= =?utf-8?q?sxnTRFcOe7niXM3lS3JiIE6vuQhGSlBfaLAVbq7vt2X+XJOm4KRTNpqhwsqaDmXzq?= =?utf-8?q?9KA5cCRF65mvlcPY74pYB+jU5/2VVOrcG4ZPiYyCmAGcP+MVfh44cah+X1Um1sjM3?= =?utf-8?q?/6kXmpM5BRi/f8tKAkmu85DDKnARu4rUkFf0uM0WHpvx0XgHNMTq5NMz3kYFrN1ep?= =?utf-8?q?J7GSCrlK+8mtTq/IPavknUmEnTIt3kXAlrinL0m50B6kplhbCkjOKkngsLxPQYk76?= =?utf-8?q?Uqzc2slA4JMcm42AGLcySOW16nloJl0XmF6gkMxisyv+x8R1yPBsw/U+Li+XgloLN?= =?utf-8?q?gObDb+secRszj9D5LM6GC1JhChJLFfepcrsrVSh/St1Y5C+bXKt4l3wo1gc7M1q2m?= =?utf-8?q?PTnZfpf4J9liIjQu37EEFngyV2/ygMiMUjhf8KpFUWjj5ugH7UL3IM+5cY6WVI/p3?= =?utf-8?q?eYupsPkCTvmfz98CYT1AKOiyj8tEv15/vdY+tAPj2DvUwFraet/QyOIDqH3lMid/0?= =?utf-8?q?MiDro6BnPYABOgiC3V7uBwcW/ZtO00mBPHjAjeCPYrKUq8d3wYeADLbbZ1FvQ0x1f?= =?utf-8?q?Dofs5jjl52MYA7kr7QpOG/8d/F8xdec7GwOt51p7L4bRWdgs/jaWvwafS3YVZCnsG?= =?utf-8?q?OosSAcxj7sUoSdQ01TvH1hW1Lj91NoMy6lsmaLtp75qHMVHbWLJo9C2B2Au6j4lC+?= =?utf-8?q?lJfPGtnUbMClEGZCz3nY5ZDiHuHBbXp6j/q62Sd0tDq29Z/BbrBKLLrtXfvWZA3jr?= =?utf-8?q?9HlJ4wDnXTvoBeK22YmD9J9JLDkgd4moCTi96uZ+P2TJMaz1WqSvdfo2MolFpLHR7?= =?utf-8?q?wHO8iIKCBn1277ZemH13xbSLUhEpxeEDfEgdYj4ixqk2uoI+xKfRTiMgnZQA0jA+D?= =?utf-8?q?OB28TuzS1b0HxEoU87ZPZoH6raXxn/MXQD/utmXpLzSsP9QiG2WWV0Wi7I1Qpiic3?= =?utf-8?q?19of0LBUokEJgVksqtoCDsQE0y2gIl+er/1k214IrkiuE9daAPgKzwPDfHabxkScG?= =?utf-8?q?68oHEJ7srI2VnUUWM3GyPo5fzKOHhrmwH+ce1skCAPGtsdz4PwOjzuUSqlNEpnMB1?= =?utf-8?q?IDjQETWv57WWJ8OnS4Je41cqGNyynbmh8GsjRPa+As4+0GzbaWCbHDKgJc+iks0k6?= =?utf-8?q?d0XYAWmgLH2W5ouC2ripGUVgZ7KG6on/1JFuCq78NR669YxDUVKM/zVv+v+nA1aHU?= =?utf-8?q?wGHM4++XVnifPUZl5KU+JZeDj8brQ4LA=3D=3D?= Content-ID: <58A566D64D6736438FFAB6C26B1D99DD@eurprd07.prod.outlook.com> MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0796b6b3-e314-489c-4dc5-08df1e2b57a6 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Sep 2026 13:12:41.2541 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: WBBK84n0zY6Ycm1kv4A/Ypb7i7OWtRCtG/SQEqKoJzh3p68oU9FzGdtV76Fcnt+wDXYdyWygu9gAbtAbDqeGX+XZ78T2dJsLb13OUW4UR0w= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM9PR07MB7219 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 29 Sep 2026 13:12:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246864 Backport patch to fix CVE-2026-42013. References: https://nvd.nist.gov/vuln/detail/CVE-2026-42013 Upstream fix: https://gitlab.com/gnutls/gnutls/-/commit/29801bef00ecc0f23c0bac4cd333b269cd2c1af4 Tested with ptest Pre patch taken from upstream so CVE fix will land cleanly Signed-off-by: Jakub Szczudlo --- .../gnutls/gnutls/CVE-2026-42013-pre1.patch | 56 ++++++++++++++ .../gnutls/gnutls/CVE-2026-42013.patch | 74 +++++++++++++++++++ meta/recipes-support/gnutls/gnutls_3.8.4.bb | 2 + 3 files changed, 132 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42013-pre1.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42013.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42013-pre1.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42013-pre1.patch new file mode 100644 index 0000000000..53687cb53b --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42013-pre1.patch @@ -0,0 +1,56 @@ +From 3ee2cb707002f755e4bda3f75285caa0cb36c214 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Wed, 15 Apr 2026 15:35:59 +0200 +Subject: [PATCH] x509/email-verify: call fallback DN fallback + +A comment was inaccurately referring to DN email field fallback +as CN fallback. +Rename a few things as well to match x509/hostname-verify more closely. + +Signed-off-by: Alexander Sosedkin +CVE: CVE-2026-42013 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/3ee2cb707002f755e4bda3f75285caa0cb36c214] + +Signed-off-by: Jakub Szczudlo +--- + lib/x509/email-verify.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/lib/x509/email-verify.c b/lib/x509/email-verify.c +index dbef0bb86e..3c22ffed37 100644 +--- a/lib/x509/email-verify.c ++++ b/lib/x509/email-verify.c +@@ -42,7 +42,7 @@ unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email, + { + char rfc822name[MAX_CN]; + size_t rfc822namesize; +- int found_rfc822name = 0; ++ bool dn_fallback_allowed = true; + int ret = 0; + int i = 0; + char *a_email; +@@ -76,7 +76,7 @@ unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email, + cert, i, rfc822name, &rfc822namesize, NULL); + + if (ret == GNUTLS_SAN_RFC822NAME) { +- found_rfc822name = 1; ++ dn_fallback_allowed = false; + + if (memchr(rfc822name, '\0', rfc822namesize)) { + _gnutls_debug_log( +@@ -102,12 +102,10 @@ unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email, + } + } + +- if (!found_rfc822name) { +- /* did not get the necessary extension, use CN instead +- */ ++ if (dn_fallback_allowed) { ++ /* did not get the necessary extension, use DN email instead */ + +- /* enforce the RFC6125 (ยง1.8) requirement that only +- * a single CN must be present */ ++ /* only a single one must be present */ + rfc822namesize = sizeof(rfc822name); + ret = gnutls_x509_crt_get_dn_by_oid(cert, + GNUTLS_OID_PKCS9_EMAIL, 1, diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42013.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42013.patch new file mode 100644 index 0000000000..c63e4d7039 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42013.patch @@ -0,0 +1,74 @@ +From 29801bef00ecc0f23c0bac4cd333b269cd2c1af4 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Wed, 15 Apr 2026 16:02:19 +0200 +Subject: [PATCH] x509: prevent fallback on oversized SAN + +Passing oversized SAN did not preclude CN (or DN email) fallback +during verification, which is an RFC 6125 6.4.4 violation. + +Now oversized SAN are skipped over, +but prevent the fallback from happening. + +Reported-by: Haruto Kimura (Stella) +Reported-by: Joshua Rogers of AISLE Research Team +Fixes: #1825 +Fixes: #1849 +Fixes: CVE-2026-42013 +Fixes: GNUTLS-SA-2026-04-27-8 +CVSS: 6.5 Moderate CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N +Signed-off-by: Alexander Sosedkin +CVE: CVE-2026-42013 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/29801bef00ecc0f23c0bac4cd333b269cd2c1af4] + +Signed-off-by: Jakub Szczudlo +--- + lib/x509/email-verify.c | 14 ++++++++++++++ + lib/x509/hostname-verify.c | 14 ++++++++++++++ + 2 files changed, 28 insertions(+) + +--- a/lib/x509/email-verify.c ++++ b/lib/x509/email-verify.c +@@ -75,6 +75,20 @@ unsigned gnutls_x509_crt_check_email(gnu + ret = gnutls_x509_crt_get_subject_alt_name( + cert, i, rfc822name, &rfc822namesize, NULL); + ++ if (ret < 0) { ++ if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) { ++ /* oversized SAN; proceed without DN fallback */ ++ _gnutls_debug_log("oversized SAN ignored, " ++ "disabling DN fallback\n"); ++ dn_fallback_allowed = false; ++ ret = 0; ++ continue; ++ } ++ if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) ++ gnutls_assert(); ++ break; ++ } ++ + if (ret == GNUTLS_SAN_RFC822NAME) { + dn_fallback_allowed = false; + +--- a/lib/x509/hostname-verify.c ++++ b/lib/x509/hostname-verify.c +@@ -213,6 +213,20 @@ hostname_fallback: + ret = gnutls_x509_crt_get_subject_alt_name(cert, i, dnsname, + &dnsnamesize, NULL); + ++ if (ret < 0) { ++ if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) { ++ /* oversized SAN; proceed without CN fallback */ ++ _gnutls_debug_log("oversized SAN ignored, " ++ "disabling CN fallback\n"); ++ cn_fallback_allowed = false; ++ ret = 0; ++ continue; ++ } ++ if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) ++ gnutls_assert(); ++ break; ++ } ++ + if (PRECLUDES_CN_FALLBACK(ret)) + cn_fallback_allowed = false; + diff --git a/meta/recipes-support/gnutls/gnutls_3.8.4.bb b/meta/recipes-support/gnutls/gnutls_3.8.4.bb index 646cc350d9..f85feb7dd2 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.4.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.4.bb @@ -56,6 +56,8 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://CVE-2026-42012-pre2.patch \ file://CVE-2026-42012-pre3.patch \ file://CVE-2026-42012.patch \ + file://CVE-2026-42013-pre1.patch \ + file://CVE-2026-42013.patch \ " SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b"