diff mbox series

[meta-oe,scarthgap] opensc: fix for CVE-2026-40528

Message ID 20260821121517.128373-1-hprajapati@mvista.com
State New
Headers show
Series [meta-oe,scarthgap] opensc: fix for CVE-2026-40528 | expand

Commit Message

Hitendra Prajapati Aug. 21, 2026, 12:15 p.m. UTC 
Pick patch from [1] also mentioned at NVD report in [2]

[1] https://github.com/OpenSC/OpenSC/commit/0358817ec74aeca654f83e7709c7720b14c5db59
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-40528

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
---
 .../opensc/files/CVE-2026-40528.patch         | 44 +++++++++++++++++++
 .../recipes-support/opensc/opensc_0.25.1.bb   |  1 +
 2 files changed, 45 insertions(+)
 create mode 100644 meta-oe/recipes-support/opensc/files/CVE-2026-40528.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-support/opensc/files/CVE-2026-40528.patch b/meta-oe/recipes-support/opensc/files/CVE-2026-40528.patch
new file mode 100644
index 0000000000..d3820b6009
--- /dev/null
+++ b/meta-oe/recipes-support/opensc/files/CVE-2026-40528.patch
@@ -0,0 +1,44 @@ 
+From 0358817ec74aeca654f83e7709c7720b14c5db59 Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <jjelen@redhat.com>
+Date: Tue, 3 Mar 2026 15:04:33 +0100
+Subject: [PATCH] profile: Avoid possible buffer overrun
+
+Profile file of the following format will cause buffer overrun
+when parsed during the pkcs15-init invocation:
+
+```
+cardinfo {
+    key CHV1 {
+        value = "=XXXX...";  // 200+ X characters
+    }
+}
+```
+This will cause both stack and heap buffer overrun.
+
+Thanks Nicholas Carlini from Anthropic for the report.
+
+CVE: CVE-2026-40528
+Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/0358817ec74aeca654f83e7709c7720b14c5db59]
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ src/pkcs15init/profile.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/pkcs15init/profile.c b/src/pkcs15init/profile.c
+index a6b2103f8..58416b7e1 100644
+--- a/src/pkcs15init/profile.c
++++ b/src/pkcs15init/profile.c
+@@ -987,6 +987,10 @@ do_key_value(struct state *cur, int argc, char **argv)
+ 	if (key[0] == '=') {
+ 		++key;
+ 		key_len = strlen(key);
++		if (key_len > sizeof(keybuf)) {
++		    parse_error(cur, "Key value too long (%zu > %zu)\n", key_len, sizeof(keybuf));
++		    return 1;
++		}
+ 		memcpy(keybuf, key, key_len);
+ 	} else {
+ 		key_len = sizeof(keybuf);
+-- 
+2.50.1
+
diff --git a/meta-oe/recipes-support/opensc/opensc_0.25.1.bb b/meta-oe/recipes-support/opensc/opensc_0.25.1.bb
index 5f4382642c..689bb4f01e 100644
--- a/meta-oe/recipes-support/opensc/opensc_0.25.1.bb
+++ b/meta-oe/recipes-support/opensc/opensc_0.25.1.bb
@@ -24,6 +24,7 @@  SRC_URI = "git://github.com/OpenSC/OpenSC;branch=stable-0.25;protocol=https \
            file://CVE-2025-66215-2.patch \
            file://CVE-2025-66215-3.patch \
            file://CVE-2025-66215-4.patch \
+           file://CVE-2026-40528.patch \
          "
 DEPENDS = "virtual/libiconv openssl"