diff mbox series

[meta-networking,whinlatter,3/14] wolfssl: patch CVE-2026-2646

Message ID 20260405124916.2881008-3-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-multimedia,whinlatter,1/14] libde265: patch CVE-2026-33165 | expand

Commit Message

Ankur Tyagi April 5, 2026, 12:49 p.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-2646

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../wolfssl/files/CVE-2026-2646-1.patch       | 39 ++++++++++++++
 .../wolfssl/files/CVE-2026-2646-2.patch       | 51 +++++++++++++++++++
 .../wolfssl/wolfssl_5.8.0.bb                  |  2 +
 3 files changed, 92 insertions(+)
 create mode 100644 meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-2646-1.patch
 create mode 100644 meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-2646-2.patch
diff mbox series

Patch

diff --git a/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-2646-1.patch b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-2646-1.patch
new file mode 100644
index 0000000000..65daca16eb
--- /dev/null
+++ b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-2646-1.patch
@@ -0,0 +1,39 @@ 
+From 693e9d5e986ac642090331e5f76cfdfd656e3bbc Mon Sep 17 00:00:00 2001
+From: Reda Chouk <reda@wolfssl.com>
+Date: Fri, 6 Feb 2026 17:00:42 +0100
+Subject: [PATCH] add missing checks in wolfSSL_d2i_SSL_SESSION
+
+(cherry picked from commit f94eb68ea36aee271e0645812ec3bb038f43098b)
+
+CVE: CVE-2026-2646
+Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/f94eb68ea36aee271e0645812ec3bb038f43098b]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/ssl_sess.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/src/ssl_sess.c b/src/ssl_sess.c
+index c5e0e682a..75680f1bf 100644
+--- a/src/ssl_sess.c
++++ b/src/ssl_sess.c
+@@ -2840,12 +2840,20 @@ WOLFSSL_SESSION* wolfSSL_d2i_SSL_SESSION(WOLFSSL_SESSION** sess,
+         goto end;
+     }
+     s->chain.count = data[idx++];
++    if (s->chain.count > MAX_CHAIN_DEPTH) {
++        ret = BUFFER_ERROR;
++        goto end;
++    }
+     for (j = 0; j < s->chain.count; j++) {
+         if (i - idx < OPAQUE16_LEN) {
+             ret = BUFFER_ERROR;
+             goto end;
+         }
+         ato16(data + idx, &length); idx += OPAQUE16_LEN;
++        if (length > MAX_X509_SIZE) {
++            ret = BUFFER_ERROR;
++            goto end;
++        }
+         s->chain.certs[j].length = length;
+         if (i - idx < length) {
+             ret = BUFFER_ERROR;
diff --git a/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-2646-2.patch b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-2646-2.patch
new file mode 100644
index 0000000000..a1dfa8975d
--- /dev/null
+++ b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-2646-2.patch
@@ -0,0 +1,51 @@ 
+From e5a887b643850138d225ec47febf1c117c38464a Mon Sep 17 00:00:00 2001
+From: jordan <jordan@wolfssl.com>
+Date: Wed, 11 Mar 2026 09:47:15 -0500
+Subject: [PATCH] ssl_sess: check fields in wolfSSL_d2i_SSL_SESSION.
+
+(cherry picked from commit 0a99a08b0f196cad1cd35e2261465c5d5f080739)
+
+CVE: CVE-2026-2646
+Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/0a99a08b0f196cad1cd35e2261465c5d5f080739]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/ssl_sess.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/src/ssl_sess.c b/src/ssl_sess.c
+index 75680f1bf..08b2219ef 100644
+--- a/src/ssl_sess.c
++++ b/src/ssl_sess.c
+@@ -2808,6 +2808,10 @@ WOLFSSL_SESSION* wolfSSL_d2i_SSL_SESSION(WOLFSSL_SESSION** sess,
+     ato32(data + idx, &s->bornOn); idx += OPAQUE32_LEN;
+     ato32(data + idx, &s->timeout); idx += OPAQUE32_LEN;
+     s->sessionIDSz = data[idx++];
++    if (s->sessionIDSz > ID_LEN) {
++        ret = BUFFER_ERROR;
++        goto end;
++    }
+ 
+     /* sessionID | secret | haveEMS | haveAltSessionID */
+     if (i - idx < s->sessionIDSz + SECRET_LEN + OPAQUE8_LEN + OPAQUE8_LEN) {
+@@ -2890,6 +2894,10 @@ WOLFSSL_SESSION* wolfSSL_d2i_SSL_SESSION(WOLFSSL_SESSION** sess,
+         goto end;
+     }
+     ato16(data + idx, &s->idLen); idx += OPAQUE16_LEN;
++    if (s->idLen > SERVER_ID_LEN) {
++        ret = BUFFER_ERROR;
++        goto end;
++    }
+ 
+     /* ServerID */
+     if (i - idx < s->idLen) {
+@@ -2905,6 +2913,10 @@ WOLFSSL_SESSION* wolfSSL_d2i_SSL_SESSION(WOLFSSL_SESSION** sess,
+         goto end;
+     }
+     s->sessionCtxSz = data[idx++];
++    if (s->sessionCtxSz > ID_LEN) {
++        ret = BUFFER_ERROR;
++        goto end;
++    }
+ 
+     /* app session context ID */
+     if (i - idx < s->sessionCtxSz) {
diff --git a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.8.0.bb b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.8.0.bb
index e9be766e67..5db019c9cb 100644
--- a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.8.0.bb
+++ b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.8.0.bb
@@ -28,6 +28,8 @@  SRC_URI = " \
     file://CVE-2025-7394-5.patch \
     file://CVE-2025-7394-6.patch \
     file://CVE-2026-0819.patch \
+    file://CVE-2026-2646-1.patch \
+    file://CVE-2026-2646-2.patch \
 "
 
 SRCREV = "b077c81eb635392e694ccedbab8b644297ec0285"