diff mbox series

[meta-oe,wrynose,11/42] freeipmi: patch CVE-2026-85506

Message ID 20260923104056.457360-11-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-oe,wrynose,1/42] c-ares: mark CVEs fixed | expand

Commit Message

Ankur Tyagi Sept. 23, 2026, 10:40 a.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport commit from v1.6.19 matching NVD description.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-85506

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freeipmi/freeipmi/CVE-2026-85506.patch    | 51 +++++++++++++++++++
 .../freeipmi/freeipmi_1.6.17.bb               |  1 +
 2 files changed, 52 insertions(+)
 create mode 100644 meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85506.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85506.patch b/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85506.patch
new file mode 100644
index 0000000000..267754ec9a
--- /dev/null
+++ b/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85506.patch
@@ -0,0 +1,51 @@ 
+From 8652f7ca02cb6920c7a4c89add8effa6e9419ec7 Mon Sep 17 00:00:00 2001
+From: Albert L Chu <chu11@llnl.gov>
+Date: Tue, 18 Aug 2026 14:09:35 -0700
+Subject: [PATCH] ipmi-oem: bound Dell iDRAC-info accumulation loop against
+ buffer size
+
+_get_dell_system_info_idrac_info accumulates configuration parameter data
+from three get-system-info responses into a 256-byte idrac_info stack
+buffer, copying (len - 1) bytes per iteration at a running offset with no
+check against the destination size.  The response field is BMC-controlled
+and can legitimately return up to 128 bytes per call, so a malicious BMC
+returning large blocks overflows the stack buffer with attacker-controlled
+data on the third iteration.  This helper is also reached via
+dell get-system-info mac-addresses.
+
+Reject any copy whose cumulative length would exceed sizeof (idrac_info)
+before the memcpy, mirroring the existing invalid-length error path.
+
+Assisted-by: Claude (Opus 4.8) <noreply@anthropic.com>
+(cherry picked from commit 301458ac7b230dbfa42e73ee2c2959e4bbaecf30)
+
+CVE: CVE-2026-85506
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/freeipmi.git/commit/?h=freeipmi-1-6-19&id=301458ac7b230dbfa42e73ee2c2959e4bbaecf30]
+
+Dropped changes to the ChangeLog file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ ipmi-oem/ipmi-oem-dell.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/ipmi-oem/ipmi-oem-dell.c b/ipmi-oem/ipmi-oem-dell.c
+index 19c962cb1..f8e5ae165 100644
+--- a/ipmi-oem/ipmi-oem-dell.c
++++ b/ipmi-oem/ipmi-oem-dell.c
+@@ -595,6 +595,15 @@ _get_dell_system_info_idrac_info (ipmi_oem_state_data_t *state_data,
+           goto cleanup;
+         }
+ 
++      if ((idrac_info_len + (len - 1)) > sizeof (idrac_info))
++        {
++          pstdout_fprintf (state_data->pstate,
++                           stderr,
++                           "ipmi_cmd_get_system_info_parameters: invalid buffer length returned: %d\n",
++                           len);
++          goto cleanup;
++        }
++
+       memcpy (&idrac_info[idrac_info_len],
+               configuration_parameter_data + 1, /* remove set selector */
+               len - 1);
diff --git a/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb b/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb
index 06fc6ca174..8438a517ec 100644
--- a/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb
+++ b/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb
@@ -19,6 +19,7 @@  SRC_URI = "${GNU_MIRROR}/freeipmi/freeipmi-${PV}.tar.gz \
            file://CVE-2026-85509.patch \
            file://CVE-2026-85508.patch \
            file://CVE-2026-85507.patch \
+           file://CVE-2026-85506.patch \
 "
 SRC_URI[sha256sum] = "16783d10faa28847a795cce0bf86deeaa72b8fbe71d1f0dc1101d13a6b501ec1"