diff mbox series

[meta-oe,wrynose,13/42] freeipmi: patch CVE-2026-85504

Message ID 20260923104056.457360-13-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-oe,wrynose,1/42] c-ares: mark CVEs fixed | expand

Commit Message

Ankur Tyagi Sept. 23, 2026, 10:40 a.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport commit from v1.6.19 matching NVD description.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-85504

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freeipmi/freeipmi/CVE-2026-85504.patch    | 93 +++++++++++++++++++
 .../freeipmi/freeipmi_1.6.17.bb               |  1 +
 2 files changed, 94 insertions(+)
 create mode 100644 meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85504.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85504.patch b/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85504.patch
new file mode 100644
index 0000000000..d0614beb17
--- /dev/null
+++ b/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85504.patch
@@ -0,0 +1,93 @@ 
+From 23bdae46ad532196ccd8a85d8a5c771e2aea1339 Mon Sep 17 00:00:00 2001
+From: Albert L Chu <chu11@llnl.gov>
+Date: Tue, 25 Aug 2026 11:40:41 -0700
+Subject: [PATCH] libfreeipmi: bound Fujitsu SEL long-text responses
+
+Reject short and oversized Fujitsu iRMC responses and cap each text chunk before copying it into the fixed-size output buffer.
+
+Assisted-by: Codex, GPT-5.6-SOL
+(cherry picked from commit 29fa34264e1eff685dcb9e0176e1eea0a6788e59)
+
+CVE: CVE-2026-85504
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/freeipmi.git/commit/?h=freeipmi-1-6-19&id=29fa34264e1eff685dcb9e0176e1eea0a6788e590]
+
+Dropped changes to the ChangeLog file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ .../sel/ipmi-sel-string-fujitsu-irmc-common.c | 41 +++++++++++--------
+ 1 file changed, 24 insertions(+), 17 deletions(-)
+
+diff --git a/libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c b/libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c
+index f514a56c5..24aa94fb7 100644
+--- a/libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c
++++ b/libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c
+@@ -80,10 +80,10 @@ _ipmi_sel_oem_fujitsu_get_sel_entry_long_text (ipmi_sel_ctx_t ctx,
+   uint8_t severity = 0;
+   char data_buf[IPMI_OEM_FUJITSU_SEL_ENTRY_LONG_TEXT_MAX_DATA_LENGTH + 1];
+   char string_buf[IPMI_OEM_FUJITSU_SEL_ENTRY_LONG_TEXT_MAX_STRING_LENGTH + 1];
+-  uint8_t data_length;
++  unsigned int data_length;
+   uint8_t max_read_length;
+-  uint8_t offset = 0;
+-  uint8_t component_length = 0;
++  unsigned int offset = 0;
++  size_t component_length = 0;
+   const char *css_str = NULL;
+   const char *severity_str = NULL;
+   int rv = -1;
+@@ -208,8 +208,10 @@ _ipmi_sel_oem_fujitsu_get_sel_entry_long_text (ipmi_sel_ctx_t ctx,
+                             "[Fujitsu OEM decoding requires administrator privilege]");
+                   goto out;
+                 }
+-              goto cleanup;
+             }
++
++          SEL_SET_ERRNUM (ctx, IPMI_SEL_ERR_IPMI_ERROR);
++          goto cleanup;
+         }
+ 
+       /* Get severity and CSS flag only once */
+@@ -224,24 +226,29 @@ _ipmi_sel_oem_fujitsu_get_sel_entry_long_text (ipmi_sel_ctx_t ctx,
+ 
+       data_length = bytes_rs[15];
+ 
++      if (data_length > IPMI_OEM_FUJITSU_SEL_ENTRY_LONG_TEXT_MAX_DATA_LENGTH
++          || offset > data_length)
++        {
++          SEL_SET_ERRNUM (ctx, IPMI_SEL_ERR_IPMI_ERROR);
++          goto cleanup;
++        }
++
+       bytes_rs[rs_len-1] = '\0'; /* just to be sure it's terminated */
+       component_length = strlen ((char *)bytes_rs + 16);
+ 
+-      /* achu: truncate if there is overflow */
+-      if (offset + component_length > data_length)
+-        {
+-          memcpy (data_buf + offset,
+-                  &bytes_rs[16],
+-                  IPMI_OEM_FUJITSU_SEL_ENTRY_LONG_TEXT_MAX_DATA_LENGTH - offset);
+-          offset = data_length;
+-        }
+-      else
++      if (component_length > (data_length - offset))
++        component_length = data_length - offset;
++
++      if (!component_length && offset < data_length)
+         {
+-          memcpy (data_buf + offset,
+-                  &bytes_rs[16],
+-                  component_length);
+-          offset += component_length;
++          SEL_SET_ERRNUM (ctx, IPMI_SEL_ERR_IPMI_ERROR);
++          goto cleanup;
+         }
++
++      memcpy (data_buf + offset,
++              &bytes_rs[16],
++              component_length);
++      offset += component_length;
+     }
+ 
+   if (css == IPMI_OEM_FUJITSU_CSS_COMPONENT)
diff --git a/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb b/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb
index a3a5fb5af0..aea282803a 100644
--- a/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb
+++ b/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb
@@ -21,6 +21,7 @@  SRC_URI = "${GNU_MIRROR}/freeipmi/freeipmi-${PV}.tar.gz \
            file://CVE-2026-85507.patch \
            file://CVE-2026-85506.patch \
            file://CVE-2026-85505.patch \
+           file://CVE-2026-85504.patch \
 "
 SRC_URI[sha256sum] = "16783d10faa28847a795cce0bf86deeaa72b8fbe71d1f0dc1101d13a6b501ec1"