diff mbox series

[meta-oe,wrynose,22/22] libkcapi: patch CVE-2026-71225

Message ID 20260903094954.3240723-22-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-oe,wrynose,1/22] jq: ignore CVE-2025-49014 | expand

Commit Message

Ankur Tyagi Sept. 3, 2026, 9:49 a.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport commit fixing the CVE as per the release notes[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-71225

[1]https://github.com/smuellerDD/libkcapi/releases/tag/v1.5.1

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../libkcapi/libkcapi/CVE-2026-71225.patch    | 38 +++++++++++++++++++
 .../recipes-crypto/libkcapi/libkcapi_1.5.0.bb |  1 +
 2 files changed, 39 insertions(+)
 create mode 100644 meta-oe/recipes-crypto/libkcapi/libkcapi/CVE-2026-71225.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-crypto/libkcapi/libkcapi/CVE-2026-71225.patch b/meta-oe/recipes-crypto/libkcapi/libkcapi/CVE-2026-71225.patch
new file mode 100644
index 0000000000..8a2e4220e7
--- /dev/null
+++ b/meta-oe/recipes-crypto/libkcapi/libkcapi/CVE-2026-71225.patch
@@ -0,0 +1,38 @@ 
+From ca418d6cc684057bcead18b3dd68d64cb3e156af Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Thu, 30 Jul 2026 08:39:37 +0200
+Subject: [PATCH] Add safety measure to prevent IV reuse
+
+Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+
+CVE: CVE-2026-71225
+Upstream-Status: Backport [https://github.com/smuellerDD/libkcapi/commit/017adba8f54f36f92e1919687fb67a89c4d299c6]
+
+Dropped changes to the CHANGES.md file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ lib/kcapi-kernel-if.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/lib/kcapi-kernel-if.c b/lib/kcapi-kernel-if.c
+index a54cdaa..859ecdf 100644
+--- a/lib/kcapi-kernel-if.c
++++ b/lib/kcapi-kernel-if.c
+@@ -1387,6 +1387,15 @@ ssize_t _kcapi_cipher_crypt_chunk(struct kcapi_handle *handle,
+ 		inlen -= inprocess;
+ 		out += ret;
+ 		outlen -= (size_t)ret;
++
++		/*
++		 * Clear the IV so subsequent chunks do not override the
++		 * kernel's chained IV via ALG_SET_IV.  The kernel updates
++		 * its internal IV after each operation; by not sending
++		 * ALG_SET_IV for later chunks, the next chunk continues
++		 * where the previous one left off.
++		 */
++		handle->cipher.iv = NULL;
+ 	}
+ 
+ 	return totallen;
diff --git a/meta-oe/recipes-crypto/libkcapi/libkcapi_1.5.0.bb b/meta-oe/recipes-crypto/libkcapi/libkcapi_1.5.0.bb
index f1fe6a0940..edc8c0e47a 100644
--- a/meta-oe/recipes-crypto/libkcapi/libkcapi_1.5.0.bb
+++ b/meta-oe/recipes-crypto/libkcapi/libkcapi_1.5.0.bb
@@ -9,6 +9,7 @@  SRC_URI = "git://github.com/smuellerDD/libkcapi.git;branch=master;protocol=https
            file://CVE-2026-71226-2.patch \
            file://CVE-2026-71226-3.patch \
            file://CVE-2026-71227.patch \
+           file://CVE-2026-71225.patch \
           "
 
 inherit autotools