diff mbox series

[meta-oe,wrynose,12/42] freeipmi: patch CVE-2026-85505

Message ID 20260923104056.457360-12-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-oe,wrynose,1/42] c-ares: mark CVEs fixed | expand

Commit Message

Ankur Tyagi Sept. 23, 2026, 10:40 a.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport commit from v1.6.19 matching NVD description.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-85505

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freeipmi/freeipmi/CVE-2026-85505.patch    | 49 +++++++++++++++++++
 .../freeipmi/freeipmi_1.6.17.bb               |  1 +
 2 files changed, 50 insertions(+)
 create mode 100644 meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85505.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85505.patch b/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85505.patch
new file mode 100644
index 0000000000..e27b8a976d
--- /dev/null
+++ b/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85505.patch
@@ -0,0 +1,49 @@ 
+From e479401fcd9588f1ffb7444e09b97afc29f21f82 Mon Sep 17 00:00:00 2001
+From: Albert L Chu <chu11@llnl.gov>
+Date: Mon, 17 Aug 2026 16:55:00 -0700
+Subject: [PATCH] ipmi-oem: clamp Fujitsu SEL long-text truncate copy to actual
+ data
+
+ipmi_oem_fujitsu_get_sel_entry_long_text, in the "truncate if there is
+overflow" branch, copied a fixed
+IPMI_OEM_FUJITSU_SEL_ENTRY_LONG_TEXT_MAX_DATA_LENGTH - offset bytes from
+&bytes_rs[16] into data_buf regardless of how many bytes the BMC
+actually returned.  bytes_rs is filled only to rs_len and is not
+memset, so a short response left the memcpy reading uninitialized stack
+past the real data.  The read stayed within the 256-byte bytes_rs and
+the data_buf destination, so it was an uninitialized read, not an
+out-of-bounds access.
+
+The truncate branch is entered only when offset + component_length
+exceeds data_length, so data_length - offset is both the number of bytes
+needed to fill data_buf to data_length and strictly less than
+component_length (= strlen of the NUL-terminated response data), hence
+always within the received bytes.  Copy that amount instead of the fixed
+maximum.
+
+Assisted-by: Claude (Opus 4.8) <noreply@anthropic.com>
+(cherry picked from commit 8e0e908c5f11f3ccbf128e09af58568767e6367c)
+
+CVE: CVE-2026-85505
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/freeipmi.git/commit/?h=freeipmi-1-6-19&id=8e0e908c5f11f3ccbf128e09af58568767e6367c]
+
+Dropped changes to the ChangeLog file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ ipmi-oem/ipmi-oem-fujitsu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ipmi-oem/ipmi-oem-fujitsu.c b/ipmi-oem/ipmi-oem-fujitsu.c
+index 10220c9fc..57d04a0bf 100644
+--- a/ipmi-oem/ipmi-oem-fujitsu.c
++++ b/ipmi-oem/ipmi-oem-fujitsu.c
+@@ -1400,7 +1400,7 @@ ipmi_oem_fujitsu_get_sel_entry_long_text (ipmi_oem_state_data_t *state_data)
+         {
+           memcpy (data_buf + offset,
+                   &bytes_rs[16],
+-                  IPMI_OEM_FUJITSU_SEL_ENTRY_LONG_TEXT_MAX_DATA_LENGTH - offset);
++                  data_length - offset);
+           offset = data_length;
+         }
+       else
diff --git a/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb b/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb
index 8438a517ec..a3a5fb5af0 100644
--- a/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb
+++ b/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb
@@ -20,6 +20,7 @@  SRC_URI = "${GNU_MIRROR}/freeipmi/freeipmi-${PV}.tar.gz \
            file://CVE-2026-85508.patch \
            file://CVE-2026-85507.patch \
            file://CVE-2026-85506.patch \
+           file://CVE-2026-85505.patch \
 "
 SRC_URI[sha256sum] = "16783d10faa28847a795cce0bf86deeaa72b8fbe71d1f0dc1101d13a6b501ec1"