diff mbox series

[meta-oe,wrynose] nmap: Fix CVE-2026-72712

Message ID 20261105053034.2201317-1-asparmar@cisco.com
State New
Headers show
Series [meta-oe,wrynose] nmap: Fix CVE-2026-72712 | expand

Commit Message

Ashishkumar Parmar X (asparmar - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 5, 2026, 5:30 a.m. UTC 
From: Ashishkumar Parmar <asparmar@cisco.com>

This patch applies the upstream nmap master backport for
CVE-2026-72712 to the Wrynose nmap 7.95 recipe. The upstream
fix commit is referenced in [1], and the public CVE advisory
is referenced in [2].

[1] https://github.com/nmap/nmap/commit/7ef4ee030a0023fe22616387a000032e1a678b6a
[2] https://github.com/advisories/GHSA-7j7x-fg87-hwwg

Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
---
 .../nmap/files/CVE-2026-72712.patch           | 50 +++++++++++++++++++
 meta-oe/recipes-security/nmap/nmap_7.95.bb    |  1 +
 2 files changed, 51 insertions(+)
 create mode 100644 meta-oe/recipes-security/nmap/files/CVE-2026-72712.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-security/nmap/files/CVE-2026-72712.patch b/meta-oe/recipes-security/nmap/files/CVE-2026-72712.patch
new file mode 100644
index 0000000000..8e47810e0d
--- /dev/null
+++ b/meta-oe/recipes-security/nmap/files/CVE-2026-72712.patch
@@ -0,0 +1,50 @@ 
+From 1c14f984d3b5574099db3a0cf415e74b70330128 Mon Sep 17 00:00:00 2001
+From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
+Date: Thu, 11 Jun 2026 18:31:31 +0000
+Subject: [PATCH] Stop parsing on a zero-length packet option
+
+Fixes #3368. Closes #3373.
+
+CVE: CVE-2026-72712
+Upstream-Status: Backport [https://github.com/nmap/nmap/commit/7ef4ee030a0023fe22616387a000032e1a678b6a]
+
+Backport Changes:
+- Omitted the upstream CHANGELOG hunk because its master-branch context
+  is absent from the Wrynose nmap 7.95 changelog. The
+  nselib/packet.lua security fix is retained verbatim.
+
+Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
+---
+ nselib/packet.lua | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/nselib/packet.lua b/nselib/packet.lua
+index b09dcc967..19400c8bb 100644
+--- a/nselib/packet.lua
++++ b/nselib/packet.lua
+@@ -692,10 +692,7 @@ function Packet:parse_options(offset, length)
+   local opt_ptr = 0
+   while opt_ptr < length do
+     local t, l, d
+-    options[op] = {}
+-
+     t = self:u8(offset + opt_ptr)
+-    options[op].type = t
+     if t==0 or t==1 then
+       l = 1
+       d = nil
+@@ -705,6 +702,11 @@ function Packet:parse_options(offset, length)
+         d = self:raw(offset + opt_ptr + 2, l-2)
+       end
+     end
++    if l==0 then
++      break
++    end
++    options[op] = {}
++    options[op].type = t
+     options[op].len  = l
+     options[op].data = d
+     opt_ptr = opt_ptr + l
+-- 
+2.35.6
+
diff --git a/meta-oe/recipes-security/nmap/nmap_7.95.bb b/meta-oe/recipes-security/nmap/nmap_7.95.bb
index e2bd57b114..0b8c7009d3 100644
--- a/meta-oe/recipes-security/nmap/nmap_7.95.bb
+++ b/meta-oe/recipes-security/nmap/nmap_7.95.bb
@@ -13,6 +13,7 @@  SRC_URI = "http://nmap.org/dist/${BP}.tar.bz2 \
            file://0003-Fix-off-by-one-overflow-in-the-IP-protocol-table.patch \
            file://0001-fix-racing-between-build-ncat-and-build-lua.patch \
            file://CVE-2026-58058.patch \
+           file://CVE-2026-72712.patch \
            "
 SRC_URI[sha256sum] = "e14ab530e47b5afd88f1c8a2bac7f89cd8fe6b478e22d255c5b9bddb7a1c5778"