diff mbox series

[meta-oe,wrynose,8/42] freeipmi: patch CVE-2026-85509

Message ID 20260923104056.457360-8-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-oe,wrynose,1/42] c-ares: mark CVEs fixed | expand

Commit Message

Ankur Tyagi Sept. 23, 2026, 10:40 a.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport commit from v1.6.19 matching NVD description.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-85509

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../freeipmi/freeipmi/CVE-2026-85509.patch    | 54 +++++++++++++++++++
 .../freeipmi/freeipmi_1.6.17.bb               |  1 +
 2 files changed, 55 insertions(+)
 create mode 100644 meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85509.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85509.patch b/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85509.patch
new file mode 100644
index 0000000000..71de8a533c
--- /dev/null
+++ b/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85509.patch
@@ -0,0 +1,54 @@ 
+From f0360d8816918c1f8de6aa8ea7cbe2ee51971a32 Mon Sep 17 00:00:00 2001
+From: Albert L Chu <chu11@llnl.gov>
+Date: Tue, 11 Aug 2026 14:24:56 -0700
+Subject: [PATCH] libfreeipmi: clamp count_returned in _read_fru_data before
+ memcpy
+
+_read_fru_data reads FRU inventory in chunks, requesting at most
+count_to_read (<= IPMI_FRU_COUNT_TO_READ_BLOCK_SIZE, 16) bytes per
+iteration and copying the response into a fixed stack buffer frubuf.
+The BMC-supplied count_returned was validated only as non-zero and as
+equal to the returned data length -- never against the number of bytes
+requested.  A malicious or malfunctioning BMC returning more bytes than
+were asked for (up to 255) with a matching payload passes both existing
+checks, so memcpy(frubuf + num_bytes_read, buf, count_returned) writes
+past the intended chunk and can advance num_bytes_read beyond
+fru_read_bytes, overflowing the stack frubuf buffer.
+
+Reject count_returned > count_to_read before the memcpy.
+
+Assisted-by: Claude (Opus 4.8) <noreply@anthropic.com>
+(cherry picked from commit b7d4f1021c89a9a5dede0f481b10d438a9e18e23)
+
+CVE: CVE-2026-85509
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/freeipmi.git/commit/?h=freeipmi-1-6-19&id=b7d4f1021c89a9a5dede0f481b10d438a9e18e23]
+
+Dropped changes to the ChangeLog file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libfreeipmi/fru/ipmi-fru.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/libfreeipmi/fru/ipmi-fru.c b/libfreeipmi/fru/ipmi-fru.c
+index f9dc8866d..bf35911c0 100644
+--- a/libfreeipmi/fru/ipmi-fru.c
++++ b/libfreeipmi/fru/ipmi-fru.c
+@@ -488,6 +488,17 @@ _read_fru_data (ipmi_fru_ctx_t ctx,
+           goto cleanup;
+         }
+ 
++      /* The BMC must not return more bytes than were requested.  A
++       * larger count_returned would advance num_bytes_read past
++       * fru_read_bytes and overflow frubuf via the memcpy below, so
++       * reject it rather than trust the device-supplied count.
++       */
++      if (count_returned > count_to_read)
++        {
++          FRU_SET_ERRNUM (ctx, IPMI_FRU_ERR_IPMI_ERROR);
++          goto cleanup;
++        }
++
+       memcpy (frubuf + num_bytes_read,
+               buf,
+               count_returned);
diff --git a/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb b/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb
index f612caf3ac..ee0c05fb6f 100644
--- a/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb
+++ b/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb
@@ -16,6 +16,7 @@  LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504 \
 SRC_URI = "${GNU_MIRROR}/freeipmi/freeipmi-${PV}.tar.gz \
            file://CVE-2026-50031-1.patch \
            file://CVE-2026-50031-2.patch \
+           file://CVE-2026-85509.patch \
 "
 SRC_URI[sha256sum] = "16783d10faa28847a795cce0bf86deeaa72b8fbe71d1f0dc1101d13a6b501ec1"