From patchwork Tue Sep 29 13:12:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jakub Szczudlo (Nokia)" X-Patchwork-Id: 99588 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2318FCA5FA1 for ; Tue, 29 Sep 2026 13:12:57 +0000 (UTC) Received: from MRWPR03CU001.outbound.protection.outlook.com (MRWPR03CU001.outbound.protection.outlook.com [40.107.130.24]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7504.1790687565911080143 for ; Tue, 29 Sep 2026 06:12:47 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=QjJmtmMh; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 40.107.130.24, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=lQ2kDPuDioA9U6GPsqhovsPOnluXILQwtq22TvCEyH2aHAuD/RndtHbR+5PWxFjeWF+CCIQHDHUz+4G23Ebct+8zC4cztUswmk5mRdcfkp3phsPgCN3ioTXTsfkTkYvsI1etwHDmyRaZLeyxHj7ym45s3dA3l0HmkSe88PYfasTwvp2bybJ1y8lO9bweCMJP1p6fAE96hBCrgKh1/wEyM8EbHzjnjpIBSHsPMjBB/H77mYWbxoQEbKCtC6FEnnEJcLc2+jGOOhSYsC1VoEwOlN8Gz0zx9D8lQOeku4ShWzJFx34SiiAhNmgD/6myxv02EVpil2e5FqEimWkK0CsLYA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=qENOzkWq0jnM/m02mNSLuzQeFvUnN4sOEB2gcFIPsYo=; b=ch8bGrDUUScPVtX2/MK7SpcIYaP5RRkV8AqWc+P98P4N0YYNtf9AC+0BWDO9QjeLJVZliYvkgJ8PCvIPRFlM98aMmVsKo/uXbblVh7Je4BiW3SUeUZUYAHJ1mBqgf7xP8TujRBs+cCLngX26VoRzLHDL42VDX57X9lRyeBp9praMLLNYoCOGOEihqQJ6s3AtUZd6xpl2aMPl+oRsZQqbySXi7AUn5b9u4K0X79kLNMHzQUyPzsM49eEyiNfAYo+u8tB4WKF8boeNS7SadL83Ak0Ob6VIAZqQ9D3EOH0Uj8kGKREiLdC1MMK4l56mxUI28Gql5+jV/uT43xA5WCNUMg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qENOzkWq0jnM/m02mNSLuzQeFvUnN4sOEB2gcFIPsYo=; b=QjJmtmMhfnVeo4YWzrFVwWkbIoS+XZKqIwWzhNyBzB7KrhIFD4aul07jRF6HvHG+S8++7GC84BhBLQrZWLd1tcyzDgMwnJ0jcouVi8AaEzQ6HuNFvS8FyYgTu1HBtHjeXiywuhR1tLQ5URbfBhIK3RRdQIB7W00hCcdiU2ByIpSfUpY99PWOBryROidTxop3rg7Zjj6JlsPv+2u42hXmg/m8EaVysfCHHHSpz/wfJiAkvZmJ/JJZXJXNXLNpmNaOmP1AdWiLcj/QBeWccAZkNE423MyV0qAY0sBC8aFL3mWO+aMMXI8zx8gP+ZSflZP0ju0nqLAYdWbpCik3wg+oFA== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by AM9PR07MB7219.eurprd07.prod.outlook.com (2603:10a6:20b:2d1::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.24; Tue, 29 Sep 2026 13:12:44 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0451.022; Tue, 29 Sep 2026 13:12:44 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [scarthgap][PATCH v2 3/5] gnutls: fix CVE-2026-42014 Thread-Topic: [scarthgap][PATCH v2 3/5] gnutls: fix CVE-2026-42014 Thread-Index: AQHdUBQ30mWc8AjsDUOPvfdsaQVsdQ== Date: Tue, 29 Sep 2026 13:12:44 +0000 Message-ID: <20260929131131.246533-3-jakub.szczudlo@nokia.com> References: <20260929131131.246533-1-jakub.szczudlo@nokia.com> In-Reply-To: <20260929131131.246533-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|AM9PR07MB7219:EE_ x-ms-office365-filtering-correlation-id: 4fa41189-2406-4d67-65ce-08df1e2b598f x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|366016|376014|1800799024|23010399003|29003799003|10067099003|11063799006|56012099006|12006099003|25016099003|13003099007|18002099003|22082099003|38070700021|260925021311599003|260925021911599003|260925022911599003; x-microsoft-antispam-message-info: 5D3UNaHSYfN8EtNO6d3pY5K1M9g9/UdsX3HdWaNRq2m4quS8x+NRco2uY2epQoSNwF+NvcQ55UCGCMTEnHgmD10O0ztebi0+o9bkx8jC9kEkFbhRPPi/JheVZKQOxTi3RMY6MeW3XUIpclWrptmCJbEM7GGs3TQbtAnVjXrG4wRZmVtP8as19PUPFTxVQgzMlmV39FsXzsgd/u4A7Rg5184t85tjrxzOV0v/5UlE4BYYomrKAOVjZFf7AZ3kne/c69gMbNdIvmCShAW6MiuSOegoKImOjNrS77rUMg+O5fviwpQpWdObtG+CYNlysgkDp6pFyqpI0kPOGI+hA1dryHqBfZFaUtBkLo/BXlhQWNXfO9p2ukCTNsdyTu0yNpwpZqjgoYQpq6jTmsbXi/zcPZO3rQtl6i95XjjG45Chi3IHiOEoVIyUVvqGObgxKU/L1iIdVNaeVFBysLfz/9eo1PtD4CngkZRkVM8LJFz3pphMcwEZQMKtsuMf8t8k3V2rZoQ/+kVPbJoPjyeyMM4h1swLclLgSkvbaQGZfbk9YFuRc5Uwfbga827WLPscMzrpHpVFUlB+PDFLUDVkG8JjaWV3qduojiQxBU6JTUIFYWWi3CzxGI82bKJlMSrGsjNrBym3NcmFqUCRHrehzT6bCoVSKoHNwN+Qw2eM1NvBnh4= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(376014)(1800799024)(23010399003)(29003799003)(10067099003)(11063799006)(56012099006)(12006099003)(25016099003)(13003099007)(18002099003)(22082099003)(38070700021)(260925021311599003)(260925021911599003)(260925022911599003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?q?KvXINSWthXrSjZWevnFoNAX5kvK6?= =?utf-8?q?SDa3Wkoaiph/OsDxv20aAje33Py79twIHYN2ckAOVzi0sCfMeVqHuo4NOqUI2FoPy?= =?utf-8?q?eHNevrUWtYhOGCPAkZ57paPXO3TDUgLNWXnScIOHYhQ7OfmC29pE5UAJlvYquQWQR?= =?utf-8?q?bW7LXZpWg6OlrcVYAPTa5UR1tDWi7mzBXO8J3AmFjWsQV7V6yy5RKEBHI8Skn27+B?= =?utf-8?q?oJGimea+flsUwZS5tgLqS2OacUAHU4FkfBWQ/qwf5Q7oP9ur6J3bhXbGv5DtZxWP+?= =?utf-8?q?Qr/OjzaWEzKBq0W4Mov9nRhkpzXwJLWmZ1nfgYuqBKmdIJrzSzFuHPh7oK4HT3ay2?= =?utf-8?q?Q82PBB8teUvK/l7Aq28vi2OmF7LxrqrR+9cWYSAgfRPl47TlJIBrOsgLBC/nSFYNS?= =?utf-8?q?xicx9f1ZftpTG9c/r8fbUh6zMllmMqu3pinr/XtQ3TpsTuQA+KYYk/nwKZVu5x8z6?= =?utf-8?q?UMNS18ZyAVRcQvQPTzOnG8/A2HqkURUpeQUTHH8wApcMvGlKWVAZUKkHLjbNTdmoO?= =?utf-8?q?qEH1usWezVaU/3vP9AVE2dHovzYiGjICJnAAIhaXkQGjyITS7vSicy+hXa9VGvCzC?= =?utf-8?q?8wcUjIi4QP+YSW4/V4D5V3/hSpqzgbX40mWOz0FPYDbRZ6VLZzlYoTPnXRF+9b+JS?= =?utf-8?q?LgFyEqpsu6lZBXViVDXh3Kd24meRgz7I67d8iw3x582khCLY6Y8KlT5qMQ86vTrkN?= =?utf-8?q?+pkS5PAMvmkH/L6ORSpwdmJoyTuEbwPJHKH+ZdRggYWa+Gv/88i23P2hnzU8Ng+a8?= =?utf-8?q?r6PUfP1Tx6nDzWhoGCDBH1l8uRjxw+tlQdkPUJq0uI8yCwtEb9lNd0ThSJnaE7oKv?= =?utf-8?q?jrM6xiJQeBxXYNAL4JiHGlRp9RmKwZrNJjqsnJGcJFooYJMlWpeok8yU/lOhk/Fj6?= =?utf-8?q?viDHOxOOQREYhxSgIx7RhTigU6YSZYvR8YQEZiTYtJvF6P54WN+fRns90TG+7Rlfm?= =?utf-8?q?X2o8sbRYeKUg/cGs9uf1arGuWy8/Dy9XqDY0giDoHWtYibj07xB+9hk6Ec2RUi9RP?= =?utf-8?q?y/zu54U6iWLVUD7KBEHTAq/9X6scwexS9ZwWpE2zkfuKV5pqEVT9uOl3FO7eGPdA7?= =?utf-8?q?JVvEXvtPRN8sJ9DwDfoFHzxzIahT40+PHmwqaEoeq159blBJTYko/9KT76OwSs2P9?= =?utf-8?q?Lsya1WT3zzfjMnRdAY8stVHGQvfQI52zewryEAakRJT8XKo27dYuNcg0MI6o6I44U?= =?utf-8?q?v0ftV9SmdFHW24Suzg6TOqYmpTCaCNxBjgKfTnVFaboaKpmfodgvWAMxWl/81xufl?= =?utf-8?q?QXx0L6WtdQ5BTeCgnY/ZprHQrdhsvYuxPuGJQ2FtInxdNl2ZCk+Sfv5SK+O59Edbo?= =?utf-8?q?a/xwYypRsX3OItJXMROnpocn6s/GH8BpA6VkoS5B3drEzijpoJ3rpY1UVOF7px4/8?= =?utf-8?q?FtH+Zm9GtYeClqpFU6/VZmaqD3hsIxu/ja6PYhwiskd5HDWmApGsW7xzln9V/Zrrj?= =?utf-8?q?uJnNQ4ZQyGrbxEdOwwUIpSbgj5GUJCqdNpfawgegtcBLaiWe0LVaYiXvPOvxpiRt/?= =?utf-8?q?hvUR0Okhyn4BzYEgmzGBRfDYOX1YDSS70B2Ug4lyFI+uDZRI20Do2BJ4FUESDYK4B?= =?utf-8?q?k8Hykr/r67hBI8tMGkGmY0iNmwIGyuQrxQAORtFFV6xSl36BVb3SohVwct6gmzmOk?= =?utf-8?q?E1cvMuujjLrQtxqmyJTDWqB1/rmNV+GQ=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4fa41189-2406-4d67-65ce-08df1e2b598f X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Sep 2026 13:12:44.4570 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: ucq4nqZHdkkJn6KrBgWRAizY8maWeo+ENIln1OOF9hh3Ui6xO21iNHZUNny4wygJb6r7JQf4rwiqd7sxP9yRcs8e4TC5gH6gueKkwoqx0jc= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM9PR07MB7219 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 29 Sep 2026 13:12:57 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246865 Backport patch to fix CVE-2026-42014. References: https://nvd.nist.gov/vuln/detail/CVE-2026-42014 Upstream fix: https://gitlab.com/gnutls/gnutls/-/commit/3957f136e2ed23caf176a594b54b3827f5cef701 Tested with ptest Signed-off-by: Jakub Szczudlo --- .../gnutls/gnutls/CVE-2026-42014.patch | 60 +++++++++++++++++++ meta/recipes-support/gnutls/gnutls_3.8.4.bb | 1 + 2 files changed, 61 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42014.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42014.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42014.patch new file mode 100644 index 0000000000..7fd0c163f8 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42014.patch @@ -0,0 +1,60 @@ +From 3957f136e2ed23caf176a594b54b3827f5cef701 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Wed, 18 Mar 2026 18:19:06 +0100 +Subject: [PATCH] pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin + +Changing Security Officer PIN with gnutls_pkcs11_token_set_pin() with +oldpin == NULL for a token that lacks a protected authentication path +led to a use-after-free. + +Reported-by: Luigino Camastra and Joshua Rogers of AISLE Research Team +Fixes: #1766 +Fixes: #1809 +Fixes: CVE-2026-42014 +Fixes: GNUTLS-SA-2026-04-29-9 +CVSS: 4.0 Medium CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L +Signed-off-by: Alexander Sosedkin + +CVE: CVE-2026-42014 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/3957f136e2ed23caf176a594b54b3827f5cef701] + +Signed-off-by: Jakub Szczudlo +--- +diff --git a/lib/pkcs11_write.c b/lib/pkcs11_write.c +index 961e1b9..9fe571e 100644 +--- a/lib/pkcs11_write.c ++++ b/lib/pkcs11_write.c +@@ -1267,10 +1267,9 @@ int gnutls_pkcs11_token_set_pin(const char *token_url, const char *oldpin, + ses_flags = SESSION_WRITE | SESSION_LOGIN; + + ret = pkcs11_open_session(&sinfo, NULL, info, ses_flags); +- p11_kit_uri_free(info); +- + if (ret < 0) { + gnutls_assert(); ++ p11_kit_uri_free(info); + return ret; + } + +@@ -1291,9 +1290,11 @@ int gnutls_pkcs11_token_set_pin(const char *token_url, const char *oldpin, + oldpin_size = L(oldpin); + + if (!(sinfo.tinfo.flags & CKF_PROTECTED_AUTHENTICATION_PATH)) { +- if (newpin == NULL) +- return gnutls_assert_val( ++ if (newpin == NULL) { ++ ret = gnutls_assert_val( + GNUTLS_E_INVALID_REQUEST); ++ goto finish; ++ } + + if (oldpin == NULL) { + struct pin_info_st pin_info; +@@ -1325,6 +1326,7 @@ int gnutls_pkcs11_token_set_pin(const char *token_url, const char *oldpin, + ret = 0; + + finish: ++ p11_kit_uri_free(info); + pkcs11_close_session(&sinfo); + return ret; + } diff --git a/meta/recipes-support/gnutls/gnutls_3.8.4.bb b/meta/recipes-support/gnutls/gnutls_3.8.4.bb index f85feb7dd2..8f24f01fd3 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.4.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.4.bb @@ -58,6 +58,7 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://CVE-2026-42012.patch \ file://CVE-2026-42013-pre1.patch \ file://CVE-2026-42013.patch \ + file://CVE-2026-42014.patch \ " SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b"