From patchwork Tue Apr 7 09:52:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gyorgy Sarvari X-Patchwork-Id: 85406 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DDC53EDB7E5 for ; Tue, 7 Apr 2026 09:52:52 +0000 (UTC) Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.77624.1775555569189988525 for ; Tue, 07 Apr 2026 02:52:49 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=gDx00BFF; spf=pass (domain: gmail.com, ip: 209.85.128.47, mailfrom: skandigraun@gmail.com) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-488ba6366a7so10953765e9.0 for ; Tue, 07 Apr 2026 02:52:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775555567; x=1776160367; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=Ne1AvBzyqORogGygIHHNihkmXzzc5mZ7Qgud3hcwc4c=; b=gDx00BFFa2fO6ENPZSl3iEdskiuhAxIs3gKoCEFDQVcxuFeJOu6pWZAwhobsiAhuQA /ly/+asJM9Mpa4V/5bTlvC+SUSOSAOrOsYTJldAe+8r5m8OMCNXzLtAbRoCraxljY4ft GYPFBnrW6Ywk6F5Nnv2smtOK8sQN4uuJnWa0GDslBnXMTPc4mVObsGAFppseia2b1MnT w0pYwKDQknm6+dV8JK4wOBLuN2V66I0yqblyyQvpL8vXi7CXk9/Q8GrYRIPWcxjdVDEf rwTo6zAGoC7gq27dumrYYBldl1PYRaWms6TDuI4M5y+40Uvu47m5AsIQIs8o7ER9FnY8 AJ8g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775555567; x=1776160367; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Ne1AvBzyqORogGygIHHNihkmXzzc5mZ7Qgud3hcwc4c=; b=mSzDL8IB1XaE6zCfcB1D8e4aqacJk/qOiSo7ka1nr052ug2AxsmeQw0gL86eNtCsdb Mw+Fn5oFSQ4CSOnownm9jkoQoV9IjyFvcCWKevKLPSlMnm6g2NYudS+tnySZLII9mThT ewcf599kyFN6b4iPCz0zgvrDUldyso7sv0qAqysYBgXWqsTqtzjCzO6UiyaVxvBgIExl uXWruF3Qkt0o5T3UPEc3W2zav7FXFr4jGE0qwt2+GEi+tUscqQzWPWUisvzI+C9Dve1N BnmkkdYZaXpAbbpkYTml/RhXvRaVwvHmJnblio1IjwigwSOXOIgMXNEqrcZOf1s0MTui 3Hjw== X-Gm-Message-State: AOJu0Yw6HQSf9udgqlH2E/j7quhOFwBcEzFuEgFodTlK+Aqiq6Ly9DSp UYQ3d18b8a0mk0EqMI7mQjPaXdkDafnaNoxiq7iE1loBUvyx4DRkBldS8o0CRg== X-Gm-Gg: AeBDiesRDUUqK/P+yFEt4Yk4tQSSA4CDadA8ZVP+hW4T1vRX2flCHtPLD+kDTZkLDab Jdg/StA2ToU0Q4jsouZhgZnOp+zVvX+bl64ZEJldHSjU6kgoNxRHnbKgG+xb6UZGo0KFXtYzPvY 7BM4hV/q9EwuoNbAArCtt4ifqcGciPEqlBKOtwJ9w4SKnh68PS7wbkStWmkR0KirOulBkKRGiY0 FjJowDISf1dU5vB/06mY+7ntpSUPocU1pAe0R2ilFfZWAozCUCzgt6nUjm6i7D40vZc4riL8BjZ KSjJLAWWQwMNcUvOGp3zOO3d4pxDdJ3J8lmZAod87TiHGD7hqERPTtvVxxrR6IVL5w9OWKdBfPx p33ACDHM6mvIamMELLTo/OUToFJ0BZpq6MJqYSVMlzc6KXHghDbBA7PkjzqLCI5NnG0VK9DDCS/ 7EqrU5B9qFf6g603s3g3L1fY6HHADviSE= X-Received: by 2002:a05:600c:4593:b0:488:9696:488a with SMTP id 5b1f17b1804b1-488997e7dc7mr266824145e9.30.1775555567329; Tue, 07 Apr 2026 02:52:47 -0700 (PDT) Received: from desktop ([51.154.145.205]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48899eccecasm113877725e9.34.2026.04.07.02.52.45 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Apr 2026 02:52:45 -0700 (PDT) From: Gyorgy Sarvari To: openembedded-devel@lists.openembedded.org Subject: [meta-oe][whinlatter][PATCH 1/3] opensc: patch CVE-2025-49010 Date: Tue, 7 Apr 2026 11:52:43 +0200 Message-ID: <20260407095245.3971755-1-skandigraun@gmail.com> X-Mailer: git-send-email 2.53.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 07 Apr 2026 09:52:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/126082 Details: https://nvd.nist.gov/vuln/detail/CVE-2025-49010 Backport the patch that is referenced by the upstream wiki page[1] that is related to this vulnerability. [1]: https://github.com/OpenSC/OpenSC/wiki/CVE-2025-49010 Signed-off-by: Gyorgy Sarvari --- .../opensc/opensc/CVE-2025-49010.patch | 71 +++++++++++++++++++ .../recipes-support/opensc/opensc_0.26.1.bb | 4 +- 2 files changed, 74 insertions(+), 1 deletion(-) create mode 100644 meta-oe/recipes-support/opensc/opensc/CVE-2025-49010.patch diff --git a/meta-oe/recipes-support/opensc/opensc/CVE-2025-49010.patch b/meta-oe/recipes-support/opensc/opensc/CVE-2025-49010.patch new file mode 100644 index 0000000000..6d869d2983 --- /dev/null +++ b/meta-oe/recipes-support/opensc/opensc/CVE-2025-49010.patch @@ -0,0 +1,71 @@ +From 02cce9f62a3c28aac4bee4741817a864f1f76d24 Mon Sep 17 00:00:00 2001 +From: Frank Morgner +Date: Thu, 22 May 2025 00:24:32 +0200 +Subject: [PATCH] fixed Stack-buffer-overflow WRITE in GET RESPONSE + +The do-while loop in apdu.c requires the output data to be set in any +case, otherwise non existent data may be copied to the output data. + +fixes https://issues.oss-fuzz.com/issues/416351800 +fixes https://issues.oss-fuzz.com/issues/416295951 + +CVE: CVE-2025-49010 +Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/953986f65db61871bbbff72788d861d67d5140c6] +Signed-off-by: Gyorgy Sarvari +--- + src/libopensc/card-nqApplet.c | 11 ++++++----- + src/libopensc/iso7816.c | 5 +++-- + 2 files changed, 9 insertions(+), 7 deletions(-) + +diff --git a/src/libopensc/card-nqApplet.c b/src/libopensc/card-nqApplet.c +index f9075b948..90706f4b1 100644 +--- a/src/libopensc/card-nqApplet.c ++++ b/src/libopensc/card-nqApplet.c +@@ -190,9 +190,10 @@ static int nqapplet_finish(struct sc_card *card) + LOG_FUNC_RETURN(card->ctx, SC_SUCCESS); + } + +-static int nqapplet_get_response(struct sc_card *card, size_t *cb_resp, u8 *resp) ++static int ++nqapplet_get_response(struct sc_card *card, size_t *cb_resp, u8 *resp) + { +- struct sc_apdu apdu; ++ struct sc_apdu apdu = {0}; + int rv; + size_t resplen; + +@@ -204,12 +205,12 @@ static int nqapplet_get_response(struct sc_card *card, size_t *cb_resp, u8 *resp + + rv = sc_transmit_apdu(card, &apdu); + LOG_TEST_RET(card->ctx, rv, "APDU transmit failed"); +- if (apdu.resplen == 0) { +- LOG_FUNC_RETURN(card->ctx, sc_check_sw(card, apdu.sw1, apdu.sw2)); +- } + + *cb_resp = apdu.resplen; + ++ if (apdu.resplen == 0) { ++ LOG_FUNC_RETURN(card->ctx, sc_check_sw(card, apdu.sw1, apdu.sw2)); ++ } + if (apdu.sw1 == 0x90 && apdu.sw2 == 0x00) { + rv = SC_SUCCESS; + } else if (apdu.sw1 == 0x61) { +diff --git a/src/libopensc/iso7816.c b/src/libopensc/iso7816.c +index e17549cd1..8535ea1a4 100644 +--- a/src/libopensc/iso7816.c ++++ b/src/libopensc/iso7816.c +@@ -920,11 +920,12 @@ iso7816_get_response(struct sc_card *card, size_t *count, u8 *buf) + + r = sc_transmit_apdu(card, &apdu); + LOG_TEST_RET(card->ctx, r, "APDU transmit failed"); +- if (apdu.resplen == 0) +- LOG_FUNC_RETURN(card->ctx, sc_check_sw(card, apdu.sw1, apdu.sw2)); + + *count = apdu.resplen; + ++ if (apdu.resplen == 0) { ++ LOG_FUNC_RETURN(card->ctx, sc_check_sw(card, apdu.sw1, apdu.sw2)); ++ } + if (apdu.sw1 == 0x90 && apdu.sw2 == 0x00) + r = 0; /* no more data to read */ + else if (apdu.sw1 == 0x61) diff --git a/meta-oe/recipes-support/opensc/opensc_0.26.1.bb b/meta-oe/recipes-support/opensc/opensc_0.26.1.bb index 78258c965a..3aed590347 100644 --- a/meta-oe/recipes-support/opensc/opensc_0.26.1.bb +++ b/meta-oe/recipes-support/opensc/opensc_0.26.1.bb @@ -12,7 +12,9 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=cb8aedd3bced19bd8026d96a8b6876d7" DEPENDS = "openssl" SRCREV = "043343d2df7b09d1938bc3dc313d86a96be457cc" -SRC_URI = "git://github.com/OpenSC/OpenSC;branch=0.26.1;protocol=https" +SRC_URI = "git://github.com/OpenSC/OpenSC;branch=0.26.1;protocol=https \ + file://CVE-2025-49010.patch \ + " CVE_STATUS[CVE-2024-8443] = "fixed-version: this is fixed since 0.26.0" From patchwork Tue Apr 7 09:52:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gyorgy Sarvari X-Patchwork-Id: 85408 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 32859EDB7E7 for ; Tue, 7 Apr 2026 09:52:53 +0000 (UTC) Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.77697.1775555569783456295 for ; Tue, 07 Apr 2026 02:52:50 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=GJTkd15u; spf=pass (domain: gmail.com, ip: 209.85.128.45, mailfrom: skandigraun@gmail.com) Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-488b0046078so18652925e9.1 for ; Tue, 07 Apr 2026 02:52:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775555568; x=1776160368; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=8auPaXD6IunLJ5fKvH07hvgkO1N5f2P0iNJINWkhf7U=; b=GJTkd15uT2vLtusYUEeZir/haCu2tkwCHuc/PEwXg0VdUsyhOfI5Vs951N9nVZs/2d MCZUsPXSLb6zGx5llUwREuYXOfuHfOVlT5FXk7qIgTCxys37Ipag6V0gJx9udTBvdtGt TFP34uyekyzVs2SnNc3KffNJYwQGmrC0BumyQcM+c5AtSEFanE/T2h3q1Fbcgad003H/ 60poLLesLyKirTkLi5dPUZQ+IgZPssFD4d81pDUqTdf+uBJahuTvQ8Q1chhSYG6dNu/j ky15aYu8Y+q2iGUlLFOE0aueBBwa8gCws/XyMqpwH3wMR9gqN9RactBDrz7N7MDl4smT Ttpw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775555568; x=1776160368; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=8auPaXD6IunLJ5fKvH07hvgkO1N5f2P0iNJINWkhf7U=; b=j1yCFmfmeOha7uKuypES1OX0PK0t3p4wsTAprUviKZsV9rDZcxq4NRyz8gnMK/UIpE HzmpNprVXRwuhloRNwdkJTADH4PWUzjBtVu4iFBMBGVMyZ61kKsNdfzTFj9h3z6DyGJR ELcJ8qB4rtGZbzYbpx57+4cbkAc4lppenjmu9hL+2xQ/XKabxgbsOYvCmxJ88PISAA6N vm8rA0QHG/1IiCf0zbCsod1Z6NxjE2obNqG8GV3Gzj88dd455Phpz8j9mEJtRqmpEDEu FaCvFGg8Udo+XUQF1iVvD/lxPS0UiJO2Dtruh0lTYRKi+E1Ou8sEsmoLuXYGs9MzXIoA SdYw== X-Gm-Message-State: AOJu0Yz5aYQAXQoi/5d+y2wtWFLg6xHrtenBx9kn8jvSu0aEw4NhTlVj FdxXJOxCDLCEpVIyIC4TE64x4LF++8JzNw9xMr3xOhj9H9yPB4C3uqatUbVSzw== X-Gm-Gg: AeBDiesw7WbOvkYt+3RvB0mclLmIxJkenfDfjO7Hxghn20DKkzbQdyPOJJ7cnqaANsK GVWhvv2RcPBUGhwFAQVzUX4xj2Xdydz19bQuxYcnAVD7EURxfSJTPH7Bu3RTzdcWKw88xgDQjIL JHDZYWSpjts9hWV4dE92+SVuMIVVpNA4AEODrXCm+hoh1ULZRmQQPGNg4RJNwM3MaBXUoXQzzFN IJZA75fjjkaZnzEa9rv3qXvQDqgCvFrZtNFtQgoaAjdmIeHpHvbh/dwjN1IMScze+Jhmj8Pc0b2 OrMZaAUIMqtfiYYsBvY3Tf5rAsIU6xq+x7SkOMgonCMJ00eg2q+FoA10m2rfRW/DY8oO2ApZHJP SoBYbt0n3GlOwg+CC05rXrULFi43mA7+zkUyrYo6gqlCWGprup8EdjkhrO7tTzN+fjqr5bgM44v cmUMzCrWWnKeHP0e7CuDgX X-Received: by 2002:a05:600c:4743:b0:487:219e:42d with SMTP id 5b1f17b1804b1-4889970642emr226225055e9.11.1775555568009; Tue, 07 Apr 2026 02:52:48 -0700 (PDT) Received: from desktop ([51.154.145.205]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48899eccecasm113877725e9.34.2026.04.07.02.52.47 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Apr 2026 02:52:47 -0700 (PDT) From: Gyorgy Sarvari To: openembedded-devel@lists.openembedded.org Subject: [meta-oe][whinlatter][PATCH 2/3] opensc: patch CVE-2025-66037 Date: Tue, 7 Apr 2026 11:52:44 +0200 Message-ID: <20260407095245.3971755-2-skandigraun@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260407095245.3971755-1-skandigraun@gmail.com> References: <20260407095245.3971755-1-skandigraun@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 07 Apr 2026 09:52:53 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/126083 Details: https://nvd.nist.gov/vuln/detail/CVE-2025-66037 Backport the patch that is referenced by the upstream wiki page[1] that is related to this vulnerability. [1]: https://github.com/OpenSC/OpenSC/wiki/CVE-2025-66037 Signed-off-by: Gyorgy Sarvari --- .../opensc/opensc/CVE-2025-66037.patch | 34 +++++++++++++++++++ .../recipes-support/opensc/opensc_0.26.1.bb | 1 + 2 files changed, 35 insertions(+) create mode 100644 meta-oe/recipes-support/opensc/opensc/CVE-2025-66037.patch diff --git a/meta-oe/recipes-support/opensc/opensc/CVE-2025-66037.patch b/meta-oe/recipes-support/opensc/opensc/CVE-2025-66037.patch new file mode 100644 index 0000000000..2c0fcab23e --- /dev/null +++ b/meta-oe/recipes-support/opensc/opensc/CVE-2025-66037.patch @@ -0,0 +1,34 @@ +From 29fce41f0b65e8467745b385b0bafbb79e72d33d Mon Sep 17 00:00:00 2001 +From: Jakub Jelen +Date: Tue, 25 Nov 2025 15:58:02 +0100 +Subject: [PATCH] pkcs15: Avoid buffer overrun on invalid data + +Invalid data can contain zero-length buffer, which after copying +was dereferenced without length check + +Credit: Aldo Ristori + +Signed-off-by: Jakub Jelen + +CVE: CVE-2025-66037 +Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/65fc211015cfcac27b10d0876054156c97225f50] +Signed-off-by: Gyorgy Sarvari +--- + src/libopensc/pkcs15-pubkey.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/libopensc/pkcs15-pubkey.c b/src/libopensc/pkcs15-pubkey.c +index 83f3feb26..e6bf803f4 100644 +--- a/src/libopensc/pkcs15-pubkey.c ++++ b/src/libopensc/pkcs15-pubkey.c +@@ -1328,6 +1328,10 @@ sc_pkcs15_pubkey_from_spki_fields(struct sc_context *ctx, struct sc_pkcs15_pubke + "sc_pkcs15_pubkey_from_spki_fields() called: %p:%"SC_FORMAT_LEN_SIZE_T"u\n%s", + buf, buflen, sc_dump_hex(buf, buflen)); + ++ if (buflen < 1) { ++ LOG_TEST_RET(ctx, SC_ERROR_INVALID_DATA, "subjectPublicKeyInfo can not be empty"); ++ } ++ + tmp_buf = malloc(buflen); + if (!tmp_buf) { + r = SC_ERROR_OUT_OF_MEMORY; diff --git a/meta-oe/recipes-support/opensc/opensc_0.26.1.bb b/meta-oe/recipes-support/opensc/opensc_0.26.1.bb index 3aed590347..ce982c4aa9 100644 --- a/meta-oe/recipes-support/opensc/opensc_0.26.1.bb +++ b/meta-oe/recipes-support/opensc/opensc_0.26.1.bb @@ -14,6 +14,7 @@ DEPENDS = "openssl" SRCREV = "043343d2df7b09d1938bc3dc313d86a96be457cc" SRC_URI = "git://github.com/OpenSC/OpenSC;branch=0.26.1;protocol=https \ file://CVE-2025-49010.patch \ + file://CVE-2025-66037.patch \ " CVE_STATUS[CVE-2024-8443] = "fixed-version: this is fixed since 0.26.0" From patchwork Tue Apr 7 09:52:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gyorgy Sarvari X-Patchwork-Id: 85407 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D0AC4EDB7E3 for ; Tue, 7 Apr 2026 09:52:52 +0000 (UTC) Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com [209.85.128.44]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.77698.1775555571040651970 for ; Tue, 07 Apr 2026 02:52:51 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=dQ/yrsuk; spf=pass (domain: gmail.com, ip: 209.85.128.44, mailfrom: skandigraun@gmail.com) Received: by mail-wm1-f44.google.com with SMTP id 5b1f17b1804b1-488af96f6b2so26202395e9.0 for ; Tue, 07 Apr 2026 02:52:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775555569; x=1776160369; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=MCAQq6mWVdvo8sa70KE4Vy1q6SgcHNFfQ6qxj2440qk=; b=dQ/yrsukyFIqEhrCksV/xQR3L5FTmv3MkIPmAed4jPVAWiqOcaqGLHisbPZs2fyE2B lGHScgDY0biRRgw2av9Z2s311+tu35aWQr8ERD5DjW2qy0ZkOTv/OysI1PpjCyCqs7QP PdCkhC7kMFsVCMo0Ce+es3+hxvPZb9wdg2UJBQVSnlFZ2ihcWPBlZYsLNe3zlkAW66hU CLFfmeqtDZkLl9Mg26anrSvxIwoxnZur7bd7YzBV9HndaPyPSViy7JhW8XdxJpYJT8Uc sVYZNrFBoz8tnQC94UWcRfEd6tvdoSSJnZnp+dJl1/ETs1qls9vhrC7jcsOqDy81Z6Wq VrZg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775555569; x=1776160369; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=MCAQq6mWVdvo8sa70KE4Vy1q6SgcHNFfQ6qxj2440qk=; b=bhQ3ABceWIuMgKxSMYQ0pxLOKXpSjLDayBsEObgfb3UVz365+aMdb2yeGn0VN2usEV pAGq654Py6B18J9hRbbLrIJMG7pbgtBvLYgHtcH/GFsaaygItnPB++p3vCedYzeDoiGw lmpazjtCxXKjGSa9m/A9Mhcwpgb9foYLFkwWgUHjpja9ZhpUz+44NJXwMOAvVXgG/SZ2 7O4jbUlW18PaM+mS8PoJTK60fLg1keiaP3aA5YvrPS8Wr4i9x4XK5Qer1Z5lBjf+YLIy x7NorFEDX2vZgMGqQU8q27vqakDqVPJWPtqZSIj/yY244ReXsS7ytWno0gOfUb5lC9jo 3mnQ== X-Gm-Message-State: AOJu0YzGzidLRmmMzvoZM6Uq3t4wEJKk4Fb2qlXG2karGNaU67yky6jt 8PRuewsaB0b0cXmSyWf6t/yfNC+Yda1EhuI32NVSP2L1PkyY2nS6Nbu7Z8fCbg== X-Gm-Gg: AeBDiesjcEsXDKiph83fSvH8GJr1he/v329quSF+drOtOdvxwBD/7SLRcvAOa00YaQB d67vNjzzP//VfyLh9+cO60ZTG/OZ0iivUAGnzDiJp4vwHPqovEGO40EXYdVGbcVafDJg9ZfYB9/ 8NU0cO8GznU1eN0oyUd57/VWdmFAOZ34NrQstf9x3tGY0wtpAuUqNMvLgcr/qc9THLH8fKHZ4Cf JFvvRMZHaaRVno1vPCx3WXMDgqsGBMASNAJuHWNVFg3Dzx7C6p09wF35Q19SqS5gnZMlz/g5+xl h2jLBnG+7nXQ4P12DJ+Bc8Ttaxd+UdBeV1ZDbqqTe2cwpqETEntf1aHu9w232+gUnT0pnOh3llr v1JnXcH2DgmsvfU8foWK12dJ99OO8U5qKo2Q9jfc9rXPUQ/mBOK36kexfG45LbDQpZBiplKR0mr SKOiJClqcmDLSiCKltipgfTHWhGAvXbSk= X-Received: by 2002:a05:600c:3b1e:b0:486:ff92:63e5 with SMTP id 5b1f17b1804b1-488996ced63mr236891715e9.6.1775555569285; Tue, 07 Apr 2026 02:52:49 -0700 (PDT) Received: from desktop ([51.154.145.205]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48899eccecasm113877725e9.34.2026.04.07.02.52.48 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Apr 2026 02:52:48 -0700 (PDT) From: Gyorgy Sarvari To: openembedded-devel@lists.openembedded.org Subject: [meta-oe][whinlatter][PATCH 3/3] opensc: patch CVE-2025-66038 Date: Tue, 7 Apr 2026 11:52:45 +0200 Message-ID: <20260407095245.3971755-3-skandigraun@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260407095245.3971755-1-skandigraun@gmail.com> References: <20260407095245.3971755-1-skandigraun@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 07 Apr 2026 09:52:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/126084 Details: https://nvd.nist.gov/vuln/detail/CVE-2025-66038 Backport the patch that is referenced by the upstream wiki page[1] that is related to this vulnerability. [1]: https://github.com/OpenSC/OpenSC/wiki/CVE-2025-66038 Signed-off-by: Gyorgy Sarvari --- .../opensc/opensc/CVE-2025-66038.patch | 40 +++++++++++++++++++ .../recipes-support/opensc/opensc_0.26.1.bb | 1 + 2 files changed, 41 insertions(+) create mode 100644 meta-oe/recipes-support/opensc/opensc/CVE-2025-66038.patch diff --git a/meta-oe/recipes-support/opensc/opensc/CVE-2025-66038.patch b/meta-oe/recipes-support/opensc/opensc/CVE-2025-66038.patch new file mode 100644 index 0000000000..185adc338e --- /dev/null +++ b/meta-oe/recipes-support/opensc/opensc/CVE-2025-66038.patch @@ -0,0 +1,40 @@ +From 3d746f77cc886042776a78158c503f0f61421008 Mon Sep 17 00:00:00 2001 +From: Jakub Jelen +Date: Tue, 18 Nov 2025 14:13:59 +0100 +Subject: [PATCH] compacttlv: Fix possible buffer overrun + +Fixes: GHSA-72x5-fwjx-2459 + +Signed-off-by: Jakub Jelen + +CVE: CVE-2025-66038 +Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/a20b91adc2fc66785c0df98abc8ef456c0eaab9d] +Signed-off-by: Gyorgy Sarvari +--- + src/libopensc/sc.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/src/libopensc/sc.c b/src/libopensc/sc.c +index c6c51fe1b..253bc173d 100644 +--- a/src/libopensc/sc.c ++++ b/src/libopensc/sc.c +@@ -1064,13 +1064,15 @@ const u8 *sc_compacttlv_find_tag(const u8 *buf, size_t len, u8 tag, size_t *outl + size_t expected_len = tag & 0x0F; + + for (idx = 0; idx < len; idx++) { +- if ((buf[idx] & 0xF0) == plain_tag && idx + expected_len < len && +- (expected_len == 0 || expected_len == (buf[idx] & 0x0F))) { ++ u8 ctag = buf[idx] & 0xF0; ++ size_t ctag_len = buf[idx] & 0x0F; ++ if (ctag == plain_tag && idx + ctag_len < len && ++ (expected_len == 0 || expected_len == ctag_len)) { + if (outlen != NULL) +- *outlen = buf[idx] & 0x0F; ++ *outlen = ctag_len; + return buf + (idx + 1); + } +- idx += (buf[idx] & 0x0F); ++ idx += ctag_len; + } + } + return NULL; diff --git a/meta-oe/recipes-support/opensc/opensc_0.26.1.bb b/meta-oe/recipes-support/opensc/opensc_0.26.1.bb index ce982c4aa9..1109499c44 100644 --- a/meta-oe/recipes-support/opensc/opensc_0.26.1.bb +++ b/meta-oe/recipes-support/opensc/opensc_0.26.1.bb @@ -15,6 +15,7 @@ SRCREV = "043343d2df7b09d1938bc3dc313d86a96be457cc" SRC_URI = "git://github.com/OpenSC/OpenSC;branch=0.26.1;protocol=https \ file://CVE-2025-49010.patch \ file://CVE-2025-66037.patch \ + file://CVE-2025-66038.patch \ " CVE_STATUS[CVE-2024-8443] = "fixed-version: this is fixed since 0.26.0"