diff mbox series

[meta-networking,wrynose,16/33] open62541: patch CVE-2026-11946

Message ID 20260907102318.2459883-16-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-oe,wrynose,1/33] libnfs: patch CVE-2026-53689 | expand

Commit Message

Ankur Tyagi Sept. 7, 2026, 10:23 a.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-11946

[1]https://security-tracker.debian.org/tracker/CVE-2026-11946

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../opcua/open62541/CVE-2026-11946.patch      | 48 +++++++++++++++++++
 .../opcua/open62541_1.4.16.bb                 |  1 +
 2 files changed, 49 insertions(+)
 create mode 100644 meta-networking/recipes-protocols/opcua/open62541/CVE-2026-11946.patch
diff mbox series

Patch

diff --git a/meta-networking/recipes-protocols/opcua/open62541/CVE-2026-11946.patch b/meta-networking/recipes-protocols/opcua/open62541/CVE-2026-11946.patch
new file mode 100644
index 0000000000..36c9c83af1
--- /dev/null
+++ b/meta-networking/recipes-protocols/opcua/open62541/CVE-2026-11946.patch
@@ -0,0 +1,48 @@ 
+From 47df558c02eef86bec125a54284b78563d1928b8 Mon Sep 17 00:00:00 2001
+From: Niels Beier <niels.beier@o6-automation.com>
+Date: Thu, 7 May 2026 15:25:30 +0200
+Subject: [PATCH] fix(server): Enforce default message and chunk size limits to
+ prevent DoS
+
+When tcpMaxMsgSize or tcpMaxChunks are configured as 0, the server treats the
+limit as truly unbounded. A remote attacker can exploit this by sending
+arbitrarily large messages or an unbounded number of chunks, exhausting server
+memory and causing a denial of service.
+
+Set safe defaults (512 MB per message, 16384 chunks) whenever the configured
+value is zero, mirroring the existing behaviour for recv/sendBufferSize.
+
+This commit mitigates a vulnerability reported by Lorenzo Cannella.
+
+Internal Vulnerability Advisory: open62541-SA-2026-0002
+
+(cherry picked from commit c9563e8ea4a8db2f64059c8ff7efe0b49a35bea3)
+
+CVE: CVE-2026-11946
+Upstream-Status: Backport [https://github.com/open62541/open62541/commit/c9563e8ea4a8db2f64059c8ff7efe0b49a35bea3]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/server/ua_server_binary.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/src/server/ua_server_binary.c b/src/server/ua_server_binary.c
+index b2de3b271..13859ce56 100644
+--- a/src/server/ua_server_binary.c
++++ b/src/server/ua_server_binary.c
+@@ -1114,6 +1114,15 @@ createServerSecureChannel(UA_BinaryProtocolManager *bpm, UA_ConnectionManager *c
+     if(connConfig.sendBufferSize == 0)
+         connConfig.sendBufferSize = 1 << 16; /* 64kB */
+ 
++    if(connConfig.localMaxMessageSize == 0)
++        connConfig.localMaxMessageSize = 1 << 29; /* 512 MB */
++    if(connConfig.remoteMaxMessageSize == 0)
++        connConfig.remoteMaxMessageSize = 1 << 29; /* 512 MB */
++    if(connConfig.localMaxChunkCount == 0)
++        connConfig.localMaxChunkCount = 1 << 14; /* 16384 */
++    if(connConfig.remoteMaxChunkCount == 0)
++        connConfig.remoteMaxChunkCount = 1 << 14; /* 16384 */
++
+     /* Set up the new SecureChannel */
+     UA_SecureChannel_init(&entry->channel);
+     entry->channel.config = connConfig;
diff --git a/meta-networking/recipes-protocols/opcua/open62541_1.4.16.bb b/meta-networking/recipes-protocols/opcua/open62541_1.4.16.bb
index 32f7148f4b..b9edc5fe30 100644
--- a/meta-networking/recipes-protocols/opcua/open62541_1.4.16.bb
+++ b/meta-networking/recipes-protocols/opcua/open62541_1.4.16.bb
@@ -18,6 +18,7 @@  SRC_URI = " \
     git://github.com/Pro/mdnsd.git;name=mdnsd;protocol=https;branch=master;destsuffix=${BB_GIT_DEFAULT_DESTSUFFIX}/deps/mdnsd \
     git://github.com/OPCFoundation/UA-Nodeset;name=ua-nodeset;protocol=https;branch=latest;destsuffix=${BB_GIT_DEFAULT_DESTSUFFIX}/deps/ua-nodeset \
     git://github.com/LiamBindle/MQTT-C.git;name=mqtt-c;protocol=https;branch=master;destsuffix=${BB_GIT_DEFAULT_DESTSUFFIX}/deps/mqtt-c \
+    file://CVE-2026-11946.patch \
 "