diff mbox series

[meta-networking,24/28] miniupnpd: patch CVE-2026-107159

Message ID 20261012001007.2541673-24-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-oe,1/28] capnproto: ignore CVE-2026-59704 | expand

Commit Message

Ankur Tyagi Oct. 12, 2026, 12:10 a.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-107159

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../miniupnpd/files/CVE-2026-107159.patch     | 78 +++++++++++++++++++
 .../miniupnpd/miniupnpd_2.3.11.bb             |  1 +
 2 files changed, 79 insertions(+)
 create mode 100644 meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch
diff mbox series

Patch

diff --git a/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch b/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch
new file mode 100644
index 00000000000..fa2401e0391
--- /dev/null
+++ b/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch
@@ -0,0 +1,78 @@ 
+From 8a3e282b22b16fc90740d62fe213c51696e8dc01 Mon Sep 17 00:00:00 2001
+From: Thomas Bernard <miniupnp@free.fr>
+Date: Sat, 3 Oct 2026 23:42:55 +0200
+Subject: [PATCH] minissdp.c: MX: 0 is invalid as well. 1 is the minimum
+ accepted
+
+(cherry picked from commit 8f13b7a5843f5270db684099c0a083f98869636a)
+
+CVE: CVE-2026-107159
+Upstream-Status: Backport [https://github.com/miniupnp/miniupnp/commit/8f13b7a5843f5270db684099c0a083f98869636a]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ minissdp.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/minissdp.c b/minissdp.c
+index afb11ec..d825bf6 100644
+--- a/minissdp.c
++++ b/minissdp.c
+@@ -2,7 +2,7 @@
+ /* vim: tabstop=4 shiftwidth=4 noexpandtab
+  * MiniUPnP project
+  * http://miniupnp.free.fr/ or https://miniupnp.tuxfamily.org/
+- * (c) 2006-2025 Thomas Bernard
++ * (c) 2006-2026 Thomas Bernard
+  * This software is subject to the conditions detailed
+  * in the LICENCE file provided within the distribution */
+ 
+@@ -1015,7 +1015,7 @@ ProcessSSDPData(int s, const char *bufr, int n,
+ #endif
+ #endif
+ #if defined(UPNP_STRICT) || defined(DELAY_MSEARCH_RESPONSE)
+-	int mx_value = -1;
++	int mx_value = -1;	/* -1 => not set, -2 => invalid value (0 or negative) */
+ #endif
+ 	unsigned int delay = 50; /* Non-zero default delay to prevent flooding */
+ 	/* UPnP Device Architecture v1.1.  1.3.3 Search response :
+@@ -1113,7 +1113,16 @@ ProcessSSDPData(int s, const char *bufr, int n,
+ 				memset(atoi_buffer, 0, sizeof(atoi_buffer));
+ 				memcpy(atoi_buffer, mx, MIN((int)(sizeof(atoi_buffer) - 1), mx_len));
+ 				mx_value = atoi(atoi_buffer);
+-				syslog(LOG_DEBUG, "MX: %.*s (value=%d)", mx_len, mx, mx_value);
++				/* UPnP Device Architechture v2.0 :
++				 * MX
++				 * Required. Field value contains maximum wait time in seconds.
++				 * shall be greater than or equal to 1 and should be less than
++				 * 5 inclusive. */
++				if (mx_value <= 0) {
++					syslog(LOG_WARNING, "MX: %.*s (value=%d) INVALID (must be between 1 and 5 incl.)", mx_len, mx, mx_value);
++				} else {
++					syslog(LOG_DEBUG, "MX: %.*s (value=%d)", mx_len, mx, mx_value);
++				}
+ 			}
+ #endif /* defined(UPNP_STRICT) || defined(DELAY_MSEARCH_RESPONSE) */
+ #if defined(UPNP_STRICT)
+@@ -1140,9 +1149,12 @@ ProcessSSDPData(int s, const char *bufr, int n,
+ 		/* For multicast M-SEARCH requests, if the search request does
+ 		 * not contain an MX header field, the device MUST silently
+ 		 * discard and ignore the search request. */
+-		if(mx_value < 0) {
++		if(mx_value == -1) {
+ 			syslog(LOG_INFO, "ignoring SSDP packet missing MX: header");
+ 			return;
++		} else if(mx_value <= 0) {
++			syslog(LOG_WARNING, "ignoring SSDP packet with invalid value for MX: header");
++			return;
+ 		} else if(mx_value > 5) {
+ 			/* If the MX header field specifies a field value greater
+ 			 * than 5, the device SHOULD assume that it contained the
+@@ -1150,7 +1162,7 @@ ProcessSSDPData(int s, const char *bufr, int n,
+ 			mx_value = 5;
+ 		}
+ #elif defined(DELAY_MSEARCH_RESPONSE)
+-		if(mx_value < 0) {
++		if(mx_value <= 0) {
+ 			mx_value = 1;
+ 		} else if(mx_value > 5) {
+ 			/* If the MX header field specifies a field value greater
diff --git a/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb b/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb
index 42a654e3278..920d33da94c 100644
--- a/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb
+++ b/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb
@@ -13,6 +13,7 @@  DEPENDS += "iptables net-tools util-linux libmnl libnetfilter-conntrack openssl"
 
 SRC_URI = "http://miniupnp.tuxfamily.org/files/download.php?file=${BP}.tar.gz;downloadfilename=${BP}.tar.gz \
            file://miniupnpd.service \
+           file://CVE-2026-107159.patch \
            "
 SRC_URI[sha256sum] = "91994b127da735b2c97f19992e34420648c0e8c4ace8a4bcb0596e7685c48678"