From patchwork Wed Jan 7 22:11:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 78237 X-Patchwork-Delegate: anuj.mittal@oss.qualcomm.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3CC7AD0D179 for ; Wed, 7 Jan 2026 22:14:19 +0000 (UTC) Received: from mta-65-226.siemens.flowmailer.net (mta-65-226.siemens.flowmailer.net [185.136.65.226]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.18464.1767824050969326971 for ; Wed, 07 Jan 2026 14:14:11 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=cW/p4xQM; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.226, mailfrom: fm-256628-202601072214082bb661804a000207ea-wbxc6s@rts-flowmailer.siemens.com) Received: by mta-65-226.siemens.flowmailer.net with ESMTPSA id 202601072214082bb661804a000207ea for ; Wed, 07 Jan 2026 23:14:08 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc; bh=bysgsfA7smYIoHpERJ/Z+E0610J1IFYm86fj4edtXY8=; b=cW/p4xQMx36nvNBTRSwx3fyHB8c1HUF0oB7ErsTKkhxlxfmNr3de5GCun2rqUGUTi09NTj dI+GQ0BcGCrJelyUQnQhRMo/CKg50FEdghFmiJ1ubdCdFv9vPYyhN1inmC+uqroSzgsntzwt dUBkWYvECIvLaqkBWIJOEOhTHUbHQ5eD1y6IUuF4ZMfIHRNqG/J8zDlMwUZQVrl2sO92f9ML KuBcV/PHLNFrwCC5fyRBbDgAKsEuP9qHB9eM8X7pVKRiN60e1OiBWf/6HdcJcEKLWoLsLEeV x0uGPSpVvSDSYvjM00StCXuzpP2wvmoB+gGdRnyJY2sv4S1iJ8okcnQg==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Cc: Peter Marko Subject: [meta-networking][scarthgap][PATCH] net-snmp: patch CVE-2025-68615 Date: Wed, 7 Jan 2026 23:11:17 +0100 Message-Id: <20260107221118.3556865-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 07 Jan 2026 22:14:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/123240 From: Peter Marko Pick patch per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2025-68615 Signed-off-by: Peter Marko --- .../net-snmp/net-snmp/CVE-2025-68615.patch | 33 +++++++++++++++++++ .../net-snmp/net-snmp_5.9.4.bb | 1 + 2 files changed, 34 insertions(+) create mode 100644 meta-networking/recipes-protocols/net-snmp/net-snmp/CVE-2025-68615.patch diff --git a/meta-networking/recipes-protocols/net-snmp/net-snmp/CVE-2025-68615.patch b/meta-networking/recipes-protocols/net-snmp/net-snmp/CVE-2025-68615.patch new file mode 100644 index 0000000000..865a6187c7 --- /dev/null +++ b/meta-networking/recipes-protocols/net-snmp/net-snmp/CVE-2025-68615.patch @@ -0,0 +1,33 @@ +From b4e6f826d9ddcc2d72eac432746807e1234266db Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Sun, 2 Nov 2025 14:48:55 -0800 +Subject: [PATCH] snmptrapd: Fix out-of-bounds trapOid[] accesses + +Fixes: https://issues.oss-fuzz.com/issues/457106694 +Fixes: https://issues.oss-fuzz.com/issues/458668421 +Fixes: https://issues.oss-fuzz.com/issues/458876071 + +CVE: CVE-2025-68615 +Upstream-Status: Backport [https://github.com/net-snmp/net-snmp/commit/b4e6f826d9ddcc2d72eac432746807e1234266db] +Signed-off-by: Peter Marko +--- + apps/snmptrapd_handlers.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/apps/snmptrapd_handlers.c b/apps/snmptrapd_handlers.c +index 6cd126f26..afd93ed0f 100644 +--- a/apps/snmptrapd_handlers.c ++++ b/apps/snmptrapd_handlers.c +@@ -1112,6 +1112,12 @@ snmp_input(int op, netsnmp_session *session, + */ + if (pdu->trap_type == SNMP_TRAP_ENTERPRISESPECIFIC) { + trapOidLen = pdu->enterprise_length; ++ /* ++ * Drop packets that would trigger an out-of-bounds trapOid[] ++ * access. ++ */ ++ if (trapOidLen < 1 || trapOidLen > OID_LENGTH(trapOid) - 2) ++ return 1; + memcpy(trapOid, pdu->enterprise, sizeof(oid) * trapOidLen); + if (trapOid[trapOidLen - 1] != 0) { + trapOid[trapOidLen++] = 0; diff --git a/meta-networking/recipes-protocols/net-snmp/net-snmp_5.9.4.bb b/meta-networking/recipes-protocols/net-snmp/net-snmp_5.9.4.bb index 95e900b88e..d45cee86f5 100644 --- a/meta-networking/recipes-protocols/net-snmp/net-snmp_5.9.4.bb +++ b/meta-networking/recipes-protocols/net-snmp/net-snmp_5.9.4.bb @@ -30,6 +30,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/net-snmp/net-snmp-${PV}.tar.gz \ file://0001-Android-Fix-the-build.patch \ file://netsnmp-swinst-crash.patch \ file://net-snmp-5.9.4-kernel-6.7.patch \ + file://CVE-2025-68615.patch \ " SRC_URI[sha256sum] = "8b4de01391e74e3c7014beb43961a2d6d6fa03acc34280b9585f4930745b0544"