From patchwork Tue Sep 29 13:12:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jakub Szczudlo (Nokia)" X-Patchwork-Id: 99586 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D7CE0CA5FA5 for ; Tue, 29 Sep 2026 13:12:56 +0000 (UTC) Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.46]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7510.1790687570266231899 for ; Tue, 29 Sep 2026 06:12:50 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=slF8V2Am; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 40.107.159.46, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=nc5u+4JNruTN7RhXG7E/x5gC9s7+V0MXIBPYa26iJRyE+hbY3Hzh49FnjKfJRrc5PUWuKsmoPjucMdcTnPi6aqpBm7J6Wnv6YC4JeQk+qcga9uLQa6pxRCtiOjcww+lGmKJ1WzOJZj5TWhYASM6BYk6+Y8/fnz8n/cK79RB3VLh9zyrngEicKLomuObeATMTjLQEqGdcfMhmwlw7ZmicPCqCuPvwTQhl+zlgCind1nCnb9ccAeWlrOm6w3gSgVG9Z+wGgKHRsUTM/H6duxMFbAQ2LS+PnYNB55BfhvIbgqAFDt+rdRt+ZJYxL2qO49soQt/v0Ua6U+Gp7dDXTwpuwA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=KBjcSM33TakQKf3fhYP3EVHfGO6/l/1GKmn1FDZdfTA=; b=T0FGsOB3NzZJnRY8lFu2ILXhw6oMGi9Cpc9BpJaz9cGjEEfiOItkXu06Ta2QrBcnYx4b0Wry9hzrewQE9VQ0Eq3qx3OP+fs5YtzXbGrWW6EOSJdc9elQf8AK8RgxXuvcV1XER6b95gkXEJT0cTTz3xEfZY3sqM59a7J7EonPsODXL94CigTnpe01gSGHCH21xomLeiX0QGrooFkHozCvlwTPfgFBtAyoHEJusxNlQ+m9QG/eBa4qOC46c/JguVlamQM51IHofQDUkLvrUMniQT2gjAHQPjP3CEotWjA8DDnl5JH2Asd2mQEJF7rGwGdVO3sNYRq/3uxS6d1cjPLFTQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KBjcSM33TakQKf3fhYP3EVHfGO6/l/1GKmn1FDZdfTA=; b=slF8V2Amsd2X8PfbdF9SEA7Dpj6o/yvIaV8Z+ix4mcWDAaTeMtom6bcQLPcmUYGagDPs9rHQNeQLsOsDbprorBwGDTXC0Lnz/oEP7kQhL4XHK2jnFgM+OmvTL7aRYLb4DzblGNfr3MTw+qhiWrXpacXez/EkMKk/j2IlkIedaa8Crefu5JCAA86xVMUF8P3OeUZKfbGX8uqmjQngWQAjhjXNGfAgA+NBAhAFZE9fketOY0YPvtZ7IhHkSw3GtUtCai6XGLN/9jNrvRFvX5CcQDhXOC19ksS6HzrZfMmn1ho48XyVUIU0qhBniz2JH9ASryZt8XflcbOgFJArJBWqOA== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by AM9PR07MB7219.eurprd07.prod.outlook.com (2603:10a6:20b:2d1::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.24; Tue, 29 Sep 2026 13:12:47 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0451.022; Tue, 29 Sep 2026 13:12:47 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [scarthgap][PATCH v2 4/5] gnutls: fix CVE-2026-42015 Thread-Topic: [scarthgap][PATCH v2 4/5] gnutls: fix CVE-2026-42015 Thread-Index: AQHdUBQ4lETm4L2vMUOXF39/MjPELw== Date: Tue, 29 Sep 2026 13:12:47 +0000 Message-ID: <20260929131131.246533-4-jakub.szczudlo@nokia.com> References: <20260929131131.246533-1-jakub.szczudlo@nokia.com> In-Reply-To: <20260929131131.246533-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|AM9PR07MB7219:EE_ x-ms-office365-filtering-correlation-id: 687147d8-7e56-415f-d4c7-08df1e2b5b2c x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|366016|376014|1800799024|23010399003|10067099003|11063799006|56012099006|12006099003|13003099007|18002099003|22082099003|38070700021|260925021311599003|260925021911599003|260925022911599003; x-microsoft-antispam-message-info: 5JILGKZFyXLKcNIV/DVvyAk6zQsSSUzstxicfyayKrh4uxdv+6BEr7zCeVbJ03C4Ht3/ncWr6Kh/9r9xBJLt/NGK1ilYp7MzclvmVAOjQ+xhEOCQvGSlyLEojSsJWmVpRHMa/kx0dSvPNLEor9Xw9Fqy5KqskZTnLzKBDKa98Cb+HgG+zyXI8IMJeXNAfqyfwEGtiGKsuQ13dSCKpM0LHmVqvUdgGGmStd777xPgI3TMwk6t5R4ALrVcVPHqa5PiYAhRr2fEO1rRZaK7jlwjCnqjRZ3+x9Tzt1LxBWsldOURyxW+eMhVKhT/tE3ZNOFDXtBaszcRSJ+z9CKbGDA8tMafzT64DvfslBH3eIux4pT2by1PvVoaAIFVsZFn7TK9qCJNKg5yIMX9DX0qmnoA0IVE5tiVIiwEMdew/ROkZz6GoQgeWVUhkZXblbR4Lc/ha29eMJ9jnc1+FC9WTGMDDqu89Mx6f4ZSo3X6w1vDSe+40fY0QFQ8LVpH5GfFNdKHp3+Bnr4h443FvWxcelsU5nR92dnUBYBldiKADqHWpOd07pfo2K+g8VIuTGlYrY0ctYSt8ST/YjIufnCu4oEBc3ggIvKkaHPW5qyeoQrTsvw+iyDtnDWsK+AZi6vUFWLFpdZ2GPrxZpVXcHo6tMn362PBUt1XX5E+ACFzPv6Z8P0= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(376014)(1800799024)(23010399003)(10067099003)(11063799006)(56012099006)(12006099003)(13003099007)(18002099003)(22082099003)(38070700021)(260925021311599003)(260925021911599003)(260925022911599003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?q?ajIPg2F78G7JKdUT4T/Ty8cgHo/P?= =?utf-8?q?VWFuwimiVKGBPIM1knUB4IkqQV2AnHrgJg7o4A9ONxCG0/CbDGzEj1qJtKDHJx6aZ?= =?utf-8?q?borKJXkzeDzcNQ3nabeywPD6SMr6Ytv3d7wdLUfDW7hG2lTV0fs5qwGmCFypUfSzP?= =?utf-8?q?87QbF2SD03p0NjAISo3i1tynKw2TqwtvZYOb/hUjXdiqfditUXyME5qbF8l0pa6Zm?= =?utf-8?q?r5jLb5Trwt21qp3uDztjMzBhuoJEpzd2CpECHKIFDncrLiSUb4F4RGjOHkbaGnMqB?= =?utf-8?q?TFRBJk7/ly/93AL/slR+FeEnqEcxCM8/6lW7CVLT2kawfG2bHdzvMl3d2XEfiVamh?= =?utf-8?q?cbBaK1R9fIxq9y2ylQOKmHibQLnHOPUBkT1GKuoDxgNbtPG5B62YxikVtm/46Tppp?= =?utf-8?q?YEqrfRdVPBvX39f8uNcWE7QR2WNauSbi3tHD9o03rYvsmucAArAt0ananB1WAipQ6?= =?utf-8?q?uUXmq9srH5t2Ks5cg/WZon5FffLlf6ywWcyTYMWMTXXCbD8a+YPneSfHojPYHbqR2?= =?utf-8?q?HeXCZyszddq8zUw/MBxvaSHQnpdyYv/b1U6GqwD77zH2rTTcjnjRJw4KutLCzM024?= =?utf-8?q?NlSSOLFSVxu0akv/jUJBDrYwze5lTjYgMsEMo4H+o+LzRQM/mhaFtQcodI1ntu86n?= =?utf-8?q?0TJC3/afnCSktLE2v4lYM2E2cvcO4eQuvYvq3xr8uGXSX+ht6079fgfxRbyHeEaU3?= =?utf-8?q?hhtdhFY2Yjda9+MpMMs2GT2R3yGtOJJvPGdj/ddUS4n4UG7Zw8Pm9ohGCTpWl3dt4?= =?utf-8?q?WUtPblrx1yFL74q08TRFjXjQGVrnvD8mCupqewyCvTOX2f2KeCvzlkdsaTA33AN92?= =?utf-8?q?ov/cJn9d0qj5WHZtS+JN1yM0rcQ4b/GkJjwjysobP/MMhqrWgoZTjlgv4mmzdMT+f?= =?utf-8?q?LA/EQspIyk8pWQXC2tdBJUia3kkxDdi/sty3iHlnPP2mjA+c2AI+6n0dPkZiXeBxs?= =?utf-8?q?kVE6S53GU2Wo/fUTU/PiWFzaJm7J9RUi/JeyIw+SD96qFaJLYFPNHk/nDTci67XYS?= =?utf-8?q?k+z/63UQZyRxsrIL0B+N/PYlynjjUpLpZdctRZCMhJAMRsTeEXH2DMJyZN5DrQqPu?= =?utf-8?q?BtarO2GoiSb7CIVCx1psYALpdKBI3s9Bta3QpQVvsi2MfWd/RPqN0k3+aBkGpa+2j?= =?utf-8?q?fIFvq6EfuLOSEJV1ezYHQHjGxElraT2Ii5JFvpUeIeYl8DAZUVrJUGfS/ZRGklAoB?= =?utf-8?q?uIlh4mN0zE+gXOfXXdGr3kpL8UF/MUMFydKIBIKJvIsoQLsVg3vC3oI8v1tqSFPcU?= =?utf-8?q?if9NtixZidwsvoaND3eVQnPZ4CKMVAyrWa8+fD9BCLkt7MVoo2xXJS9dh/cjwIeo7?= =?utf-8?q?DO8KdeCmgTTvXhPVJDwaGnd+AsEKb2P1r5/4KVWWec+REvJ61qrDC1apbNizk1b8e?= =?utf-8?q?tBpauEWb3Iyyz5zoCvPq9AMlZMNQ6eFNJypSCmIuTA1wRGtdTgYY9sHUmDgNqfWac?= =?utf-8?q?jsGaSCiLw90xnTC+2pQvW00zgY4IRWtgJAO8TAFxpRf38PHCCQc2F3BYogEl7tckQ?= =?utf-8?q?ZQ4ASDlNgSrA8tWon0FfmbFCQketOsjQAzor8m+FXg3NkGsr9gRbDXZB81EY6vtHt?= =?utf-8?q?ji1JDbV3qzMCSNvgrrPgZQJEFoxk2ZXtgBpBlWyMEuehuz39GEvg5EQ7CPe2rGsZ+?= =?utf-8?q?+TkUEV4Uh+7M3X/33cFWGcUq1TrAWJrA=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 687147d8-7e56-415f-d4c7-08df1e2b5b2c X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Sep 2026 13:12:47.1493 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 7Ury447Bx2XbN5lLerLfwH+hsHJEtbG+EzP0hZC2t9lnF+fii7MnBpTRZByzlRNyxIC/dSbaw/GEwNRT/uDEt7ZXa62WxyfbOYTLGvFaU6s= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM9PR07MB7219 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 29 Sep 2026 13:12:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246866 Backport patch to fix CVE-2026-42015. References: https://nvd.nist.gov/vuln/detail/CVE-2026-42015 Upstream fix: https://gitlab.com/gnutls/gnutls/-/commit/a3e7c50d3e1761e5ef1d4b225507cab8f2b2c3ca Tested with ptest Signed-off-by: Jakub Szczudlo --- .../gnutls/gnutls/CVE-2026-42015.patch | 43 +++++++++++++++++++ meta/recipes-support/gnutls/gnutls_3.8.4.bb | 1 + 2 files changed, 44 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42015.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42015.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42015.patch new file mode 100644 index 0000000000..1a2065371d --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42015.patch @@ -0,0 +1,43 @@ +From a3e7c50d3e1761e5ef1d4b225507cab8f2b2c3ca Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Mon, 20 Apr 2026 22:42:20 +0200 +Subject: [PATCH] x509/pkcs12_bag: fix off-by-one in bag element bounds check + +Appending elements to a PKCS#12 bag had a bounds check that +prevented adding the 32nd element. +On the other hand, it is possible to import one that already has 32. +Subsequent appending then led to writing past the 32-element array, +smashing its length. + +Tighten the check to reject any bag with 32 or more elements. + +We'll treat this vulnerability as a Low due to how contrived +the requirements are: for the code to be vulnerable, +it needs to append to an imported untrusted unencrypted PKCS#12 structure. + +Reported-by: Zou Dikai +Fixes: #1840 +Fixes: CVE-2026-42015 +Fixes: GNUTLS-SA-2026-04-29-11 +CVSS: 6.1 Medium CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H +Severity: Low +Signed-off-by: Alexander Sosedkin + +CVE: CVE-2026-42015 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/a3e7c50d3e1761e5ef1d4b225507cab8f2b2c3ca] + +Signed-off-by: Jakub Szczudlo +--- +diff --git a/lib/x509/pkcs12_bag.c b/lib/x509/pkcs12_bag.c +index 911aeff..3822861 100644 +--- a/lib/x509/pkcs12_bag.c ++++ b/lib/x509/pkcs12_bag.c +@@ -375,7 +375,7 @@ int gnutls_pkcs12_bag_set_data(gnutls_pkcs12_bag_t bag, + return GNUTLS_E_INVALID_REQUEST; + } + +- if (bag->bag_elements == MAX_BAG_ELEMENTS - 1) { ++ if (bag->bag_elements >= MAX_BAG_ELEMENTS - 1) { + gnutls_assert(); + /* bag is full */ + return GNUTLS_E_MEMORY_ERROR; diff --git a/meta/recipes-support/gnutls/gnutls_3.8.4.bb b/meta/recipes-support/gnutls/gnutls_3.8.4.bb index 8f24f01fd3..bb9bc0af05 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.4.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.4.bb @@ -59,6 +59,7 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://CVE-2026-42013-pre1.patch \ file://CVE-2026-42013.patch \ file://CVE-2026-42014.patch \ + file://CVE-2026-42015.patch \ " SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b"