diff mbox series

[meta-networking,scarthgap] ntpsec: fix CVE-2026-121506

Message ID 20261104131717.1347063-1-joaomarcos.costa@bootlin.com
State New
Headers show
Series [meta-networking,scarthgap] ntpsec: fix CVE-2026-121506 | expand

Commit Message

Joao Marcos Costa Nov. 4, 2026, 1:17 p.m. UTC 
This vulnerability, marked as High [1], was fixed upstream [2] since
v1.2.5 (tag NTPsec_1_2_5).

Backport the fix to ntpsec v1.2.2a.

[1] https://nvd.nist.gov/vuln/detail/cve-2026-121506
[2] https://security-tracker.debian.org/tracker/CVE-2026-121506

Signed-off-by: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com>
---
 .../ntpsec/ntpsec/CVE-2026-121506.patch       | 52 +++++++++++++++++++
 .../recipes-support/ntpsec/ntpsec_1.2.2a.bb   |  1 +
 2 files changed, 53 insertions(+)
 create mode 100644 meta-networking/recipes-support/ntpsec/ntpsec/CVE-2026-121506.patch
diff mbox series

Patch

diff --git a/meta-networking/recipes-support/ntpsec/ntpsec/CVE-2026-121506.patch b/meta-networking/recipes-support/ntpsec/ntpsec/CVE-2026-121506.patch
new file mode 100644
index 0000000000..cee46825de
--- /dev/null
+++ b/meta-networking/recipes-support/ntpsec/ntpsec/CVE-2026-121506.patch
@@ -0,0 +1,52 @@ 
+From dfd436ee883e9df7c170b5d8e62f534a09f54be2 Mon Sep 17 00:00:00 2001
+From: Hal Murray <halmurray@sonic.net>
+Date: Thu, 1 May 2025 22:32:56 -0700
+Subject: [PATCH] Add length checks to fix fuzzer 393742176
+
+Also fix nonce length checking.
+
+CVE: CVE-2026-121506
+
+Upstream-Status: Backport [https://gitlab.com/NTPsec/ntpsec/-/commit/0a36941e499d533dfbc3fb6b1fcd8c367679d719]
+
+Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com>
+---
+ ntpd/nts_extens.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/ntpd/nts_extens.c b/ntpd/nts_extens.c
+index 553b61b25..5442dbf1a 100644
+--- a/ntpd/nts_extens.c
++++ b/ntpd/nts_extens.c
+@@ -405,14 +405,18 @@ bool extens_client_recv(struct peer *peer, uint8_t *pkt, int lng) {
+ 			break;
+ 		    case NTS_AEEF:
+ 			adlength = buf.next-NTP_EX_HDR_LNG-pkt;  /* backup over header */
++			if (NTP_EX_U16_LNG*2 > length)
++				return false;        /* garbage packet */
+ 			noncelen = next_uint16(&buf);
+ 			outlen = next_uint16(&buf);
+ 			if (noncelen&3 || outlen&3)
+-				return false;                 /* else round up */
++				return false;        /* else round up */
+ 			nonce = buf.next;
+ 			ciphertext = nonce+noncelen;
+ 			plaintext = ciphertext+CMAC_LENGTH;
+-			outlen = buf.left-NONCE_LENGTH-CMAC_LENGTH;
++			if (noncelen+CMAC_LENGTH > length)
++				return false;        /* garbage packet */
++			outlen = buf.left-noncelen-CMAC_LENGTH;
+ 			//      printf("ECRa: %lu, %d\n", (long unsigned)outlen, noncelen);
+ 			ok = AES_SIV_Decrypt(wire_ctx,
+ 					     plaintext, &outlen,
+@@ -424,8 +428,8 @@ bool extens_client_recv(struct peer *peer, uint8_t *pkt, int lng) {
+ 			if (!ok)
+ 				return false;
+ 			/* setup to process encrypted headers */
+-			buf.next += NONCE_LENGTH+CMAC_LENGTH;
+-			buf.left -= NONCE_LENGTH+CMAC_LENGTH;
++			buf.next += noncelen+CMAC_LENGTH;
++			buf.left -= noncelen+CMAC_LENGTH;
+ 			sawAEEF = true;
+ 			break;
+ 		    default:
diff --git a/meta-networking/recipes-support/ntpsec/ntpsec_1.2.2a.bb b/meta-networking/recipes-support/ntpsec/ntpsec_1.2.2a.bb
index 4b6125b4c5..4e039a9fd2 100644
--- a/meta-networking/recipes-support/ntpsec/ntpsec_1.2.2a.bb
+++ b/meta-networking/recipes-support/ntpsec/ntpsec_1.2.2a.bb
@@ -15,6 +15,7 @@  DEPENDS += "bison-native \
 SRC_URI = "https://ftp.ntpsec.org/pub/releases/ntpsec-${PV}.tar.gz \
            file://volatiles.ntpsec \
            file://0001-wscript-Add-BISONFLAGS-support.patch \
+           file://CVE-2026-121506.patch \
            "
 
 SRC_URI[sha256sum] = "e0ce93af222a0a9860e6f5a51aadba9bb5ca601d80b2aea118a62f0a3226950e"