diff mbox series

[meta-oe,whinlatter,3/3] opensc: patch CVE-2025-66038

Message ID 20260407095245.3971755-3-skandigraun@gmail.com
State New
Headers show
Series [meta-oe,whinlatter,1/3] opensc: patch CVE-2025-49010 | expand

Commit Message

Gyorgy Sarvari April 7, 2026, 9:52 a.m. UTC 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-66038

Backport the patch that is referenced by the upstream wiki
page[1] that is related to this vulnerability.

[1]: https://github.com/OpenSC/OpenSC/wiki/CVE-2025-66038

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 .../opensc/opensc/CVE-2025-66038.patch        | 40 +++++++++++++++++++
 .../recipes-support/opensc/opensc_0.26.1.bb   |  1 +
 2 files changed, 41 insertions(+)
 create mode 100644 meta-oe/recipes-support/opensc/opensc/CVE-2025-66038.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-support/opensc/opensc/CVE-2025-66038.patch b/meta-oe/recipes-support/opensc/opensc/CVE-2025-66038.patch
new file mode 100644
index 0000000000..185adc338e
--- /dev/null
+++ b/meta-oe/recipes-support/opensc/opensc/CVE-2025-66038.patch
@@ -0,0 +1,40 @@ 
+From 3d746f77cc886042776a78158c503f0f61421008 Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <jjelen@redhat.com>
+Date: Tue, 18 Nov 2025 14:13:59 +0100
+Subject: [PATCH] compacttlv: Fix possible buffer overrun
+
+Fixes: GHSA-72x5-fwjx-2459
+
+Signed-off-by: Jakub Jelen <jjelen@redhat.com>
+
+CVE: CVE-2025-66038
+Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/a20b91adc2fc66785c0df98abc8ef456c0eaab9d]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ src/libopensc/sc.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/src/libopensc/sc.c b/src/libopensc/sc.c
+index c6c51fe1b..253bc173d 100644
+--- a/src/libopensc/sc.c
++++ b/src/libopensc/sc.c
+@@ -1064,13 +1064,15 @@ const u8 *sc_compacttlv_find_tag(const u8 *buf, size_t len, u8 tag, size_t *outl
+ 		size_t expected_len = tag & 0x0F;
+ 
+ 	        for (idx = 0; idx < len; idx++) {
+-			if ((buf[idx] & 0xF0) == plain_tag && idx + expected_len < len &&
+-			    (expected_len == 0 || expected_len == (buf[idx] & 0x0F))) {
++			u8 ctag = buf[idx] & 0xF0;
++			size_t ctag_len = buf[idx] & 0x0F;
++			if (ctag == plain_tag && idx + ctag_len < len &&
++					(expected_len == 0 || expected_len == ctag_len)) {
+ 				if (outlen != NULL)
+-					*outlen = buf[idx] & 0x0F;
++					*outlen = ctag_len;
+ 				return buf + (idx + 1);
+ 			}
+-			idx += (buf[idx] & 0x0F);
++			idx += ctag_len;
+                 }
+         }
+ 	return NULL;
diff --git a/meta-oe/recipes-support/opensc/opensc_0.26.1.bb b/meta-oe/recipes-support/opensc/opensc_0.26.1.bb
index ce982c4aa9..1109499c44 100644
--- a/meta-oe/recipes-support/opensc/opensc_0.26.1.bb
+++ b/meta-oe/recipes-support/opensc/opensc_0.26.1.bb
@@ -15,6 +15,7 @@  SRCREV = "043343d2df7b09d1938bc3dc313d86a96be457cc"
 SRC_URI = "git://github.com/OpenSC/OpenSC;branch=0.26.1;protocol=https \
            file://CVE-2025-49010.patch \
            file://CVE-2025-66037.patch \
+           file://CVE-2025-66038.patch \
            "
 
 CVE_STATUS[CVE-2024-8443] = "fixed-version: this is fixed since 0.26.0"