diff mbox series

[meta-oe,wrynose,10/42] freeipmi: patch CVE-2026-85507

Message ID 20260923104056.457360-10-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-oe,wrynose,1/42] c-ares: mark CVEs fixed | expand

Commit Message

Ankur Tyagi Sept. 23, 2026, 10:40 a.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport commit from v1.6.19 matching NVD description.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-85507

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freeipmi/freeipmi/CVE-2026-85507.patch    | 50 +++++++++++++++++++
 .../freeipmi/freeipmi_1.6.17.bb               |  1 +
 2 files changed, 51 insertions(+)
 create mode 100644 meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85507.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85507.patch b/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85507.patch
new file mode 100644
index 0000000000..f0bea66599
--- /dev/null
+++ b/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85507.patch
@@ -0,0 +1,50 @@ 
+From fa27bdb4a6df199b5a60c078ed1ce78936b6276f Mon Sep 17 00:00:00 2001
+From: Albert L Chu <chu11@llnl.gov>
+Date: Tue, 18 Aug 2026 12:56:55 -0700
+Subject: [PATCH] ipmi-oem: bound Dell CMC-info accumulation loop against
+ buffer size
+
+_output_dell_system_info_cmc_info accumulates configuration parameter
+data from four get-system-info responses into a 256-byte cmc_info stack
+buffer, copying (len - 1) bytes per iteration at a running offset with no
+check against the destination size.  The response field is BMC-controlled
+and can legitimately return up to 128 bytes per call, so a malicious BMC
+returning large blocks overflows the stack buffer with attacker-controlled
+data starting on the third iteration.
+
+Reject any copy whose cumulative length would exceed sizeof (cmc_info)
+before the memcpy, mirroring the existing invalid-length error path.
+
+Assisted-by: Claude (Opus 4.8) <noreply@anthropic.com>
+(cherry picked from commit 65759a170b0179b15a9bd3483ddc067e337bd150)
+
+CVE: CVE-2026-85507
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/freeipmi.git/commit/?h=freeipmi-1-6-19&id=65759a170b0179b15a9bd3483ddc067e337bd150]
+
+Dropped changes to the ChangeLog file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ ipmi-oem/ipmi-oem-dell.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/ipmi-oem/ipmi-oem-dell.c b/ipmi-oem/ipmi-oem-dell.c
+index ff2d39b1c..19c962cb1 100644
+--- a/ipmi-oem/ipmi-oem-dell.c
++++ b/ipmi-oem/ipmi-oem-dell.c
+@@ -937,6 +937,15 @@ _output_dell_system_info_cmc_info (ipmi_oem_state_data_t *state_data)
+           goto cleanup;
+         }
+ 
++      if ((cmc_info_len + (len - 1)) > sizeof (cmc_info))
++        {
++          pstdout_fprintf (state_data->pstate,
++                           stderr,
++                           "ipmi_cmd_get_system_info_parameters: invalid buffer length returned: %d\n",
++                           len);
++          goto cleanup;
++        }
++
+       memcpy (&cmc_info[cmc_info_len],
+               configuration_parameter_data + 1, /* remove set selector */
+               len - 1);
diff --git a/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb b/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb
index 8fa615c13a..06fc6ca174 100644
--- a/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb
+++ b/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb
@@ -18,6 +18,7 @@  SRC_URI = "${GNU_MIRROR}/freeipmi/freeipmi-${PV}.tar.gz \
            file://CVE-2026-50031-2.patch \
            file://CVE-2026-85509.patch \
            file://CVE-2026-85508.patch \
+           file://CVE-2026-85507.patch \
 "
 SRC_URI[sha256sum] = "16783d10faa28847a795cce0bf86deeaa72b8fbe71d1f0dc1101d13a6b501ec1"