From patchwork Mon Aug 3 12:59:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adarsh Jagadish Kamini X-Patchwork-Id: 94318 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0EECC55182 for ; Mon, 3 Aug 2026 13:06:34 +0000 (UTC) Received: from PA4PR04CU001.outbound.protection.outlook.com (PA4PR04CU001.outbound.protection.outlook.com [40.107.162.19]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.42528.1785761978156741678 for ; Mon, 03 Aug 2026 05:59:40 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=T1nvBf38; spf=pass (domain: est.tech, ip: 40.107.162.19, mailfrom: adarsh.jagadish.kamini@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=I295ddIsNj6MU2f+Q/Wq6Tq9+81uUwHGbdEKNG2fJvVY7+AbBJsoBjiMefk0HR+qhBCIpYStfZrDBc97a0EadsGM4Xdm94b8zPeBSKRqW1EYHyk1kQH1fO+Y6daOL8SaQIHUuLoZQxjJphAbX1x18r6i2Ap1g/uuM54sIwNCZrw9TivMmBxq6Radp/1lIou3jH6oGHZo45Tfibx8NgjvZhISAqqNxRYyQ/B93PhfB1g+B6T4ovmNMD2itIWdWK4JZS4Kt1FKW3KzsFjNAsavO6+8Ay8D4r4S5N+pgdMpJi0oZ9RXByCBcFVaE6RGtkYF+kPLcyK5AIov9xBRri4xJw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=5K9Oxc4GQfRNdlyps/mA2Z/DuAylp6/XLoYkKK7eslw=; b=ZdGvcmH473mTaiYtwjQs6ZME86vRam4l6f1zE5vqcpy/2AXcnXJ/dr1kYVTKF1kE6ALZe6VMtamMSp3eyitDe2TC2GUxNanxeeAtdFzvGm2833hSMDVscuy1yQiGWUfPbYK9h0GNIThRP8+ItPjsLRqfs0+AXwnfKkNBg1Nk9XpuUMKHrLNHd/4wJY9heLap9YUcWqOrlXJEjuxXGXe78rQdqW0JQvrf+qcxOZu3lJ6BaFQareWZezi6SHNmJvOD5SSk+mzQdDY8VO4nzcd/ucy50laNU6oHiJ4TihyQlJ0P2fe5KMPt40zlOn7Cr5eG/WKw9d+yW3luiNcfN5+h8Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5K9Oxc4GQfRNdlyps/mA2Z/DuAylp6/XLoYkKK7eslw=; b=T1nvBf38W8LInJyXfshkbSagrH2BBtt52jEGz0wBjzgSlN4XV3QLbWXsDYzSBOb2IHUFrPnXMzOa5LH4bZGqUU7kpqKL8dfH4bJr8bHJgBH0si5M1OykwPv/VvEw1zEnt0daqjREF2hm1ju340xxpGPE+L77QL1nV10MaGBprttF/OFSCU97hYA2rEXC2XK/SRl6zRuu9ZjZSIxekQKYbCMdPsJRp1wevor4ZzGouiPlAjeNSDsnApBBxTz4XEbJ+4Coa09pnsD4HxDPl/kDCT9hWB8GXsMrC6ZRcWWZIehYCdOpSyQtv/Jzxqw1W82bd+M0sKvXaTT9lj7LVtXpcA== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AS8P189MB1672.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:396::9) by DB9P189MB2050.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:392::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.13; Mon, 3 Aug 2026 12:59:37 +0000 Received: from AS8P189MB1672.EURP189.PROD.OUTLOOK.COM ([fe80::f147:85e5:34de:eeff]) by AS8P189MB1672.EURP189.PROD.OUTLOOK.COM ([fe80::f147:85e5:34de:eeff%4]) with mapi id 15.21.0292.012; Mon, 3 Aug 2026 12:59:37 +0000 From: "Adarsh Jagadish Kamini" To: openembedded-devel@lists.openembedded.org Subject: [meta-oe][wrynose][PATCH 1/4] thrift: fix CVE-2026-55971 Date: Mon, 3 Aug 2026 14:59:19 +0200 Message-ID: <20260803125927.831690-2-adarsh.jagadish.kamini@est.tech> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260803125927.831690-1-adarsh.jagadish.kamini@est.tech> References: <20260803125927.831690-1-adarsh.jagadish.kamini@est.tech> X-ClientProxiedBy: DUZPR01CA0128.eurprd01.prod.exchangelabs.com (2603:10a6:10:4bc::21) To AS8P189MB1672.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:396::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AS8P189MB1672:EE_|DB9P189MB2050:EE_ X-MS-Office365-Filtering-Correlation-Id: 81ab4128-e0b7-4c15-caa9-08def15f1199 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|23010399003|1800799024|376014|12006099003|22082099003|18002099003|20052099010|11063799006|3023799007|13003099007|6133799003|10067099003|56012099006; X-Microsoft-Antispam-Message-Info: lU6M/CHf5AryhXFPrqvzho5+osTlvgsZLRfkrs1RmT3qSxzMyq6W0TJ7ozWOkpuGDAJib6/L4CEEL8vShW3TYqgq8oL7kSEAMcGw76u15QeGymxbRts7WWIyVnTs9wjnzj9Xhl7dXHnL+ERVLp/AOg+2xgrkfffP1O6klnQh40Sp7HA+IQk7Zpt9lPAQdMgkiu9UtykC1ioWPrZr0YSh2xua44QUqGfFBJKY6K8QAlfjcD4CTq2ZP35x/CvR0/oXbbX32fuFN+NhqsmW13qJRPNhVmneYAdszuu97zIFy7FfrpduvE5CvL7w6diMbUsKgK5XqaXxap3jpHLO2e3AJlxw7BQzBZkEgyJqWpq1Ner9mEwZqRlUlaJxZcvH2hOqCZnZ5me5b5+QuI6kdwMs6AGQHoH3OzrcFFYcORmCUFaPHFrO4GN3uHveVH6CAhKEo1rdUexTykkCpYu0NUC1DK7ZOSK8b41dpmnDTBCcpEt0DatNkefEBIJgHTpiSZwXI7a8zuKI3LcxpubkAB9y3oveA3+dToqLAJamz5a2vk66uYJ0I/yJaJ/DChFOv+DJi9ZIbqG0ecGeuFFaw16w6CZUgC7LTdx8VxoXb+O5NCsZbf0XwCnKvjoGpJVUOG4aPdvuve9jCSoxIjyL6bdWZiA+jI+hDnKnKTaI46rpD4E= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AS8P189MB1672.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(1800799024)(376014)(12006099003)(22082099003)(18002099003)(20052099010)(11063799006)(3023799007)(13003099007)(6133799003)(10067099003)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 1N3aXWVsqIMwZuNKn/9voGCwvLfvxiAwViPofz1TVOcC4gPHzWP2XZZaP9eHzHLOtngZ5B/ZuiVLB8kg/GF7c7Y9sJFXN9I77gljWLb5GkVoxkVVMFJvxbsWQhwAGsgYxuhkb+gJvizYTmIVNRwCF3qOetWtbHDsaiM0IpNHnhzSIHV9ltuAN1vSvilVl8kV2kef26FM0dElavMwOmWEcG4ZH+uB0CaOdya09+n49xXSC7xjEFBoES4h8OUZWI99eJPJpiwISj1md/XEvseKYk5B8KadUxBRQxObv0lm+cLSSXFg6VajLS2D8wzY0Xon5Zz3gKdq0oCTaWLvMbuXml2Wu+xCI3rQALPEYHyK2QOyTTWOnRuBwZ3XTaJkFpmO29PpsxgiX8tiDOWjc/r9lHzhBCFsNiBc4rMcd14thglWF3DV9r3PzJcA5KuKYGDfmPdJSKxnEFuQvNaraGbGKMqfMNZM5cfqyt/qX3c/pCNra85Fl4gcl97yBKZVAd4KQjIX644T0mmPRzwCbgg294CvQ7q4X6VUcuA9zKhKSrHYxcCPNVIHTbGA9l//gWXoUmtFMb26C4KUZC25YlbfJacjOIAVN4FMS4yrG8I+MLeeUs3qGhkSUTxqGhVPG5cfAxqr3Oib8PWabgYGoDr7x+hcW7wAAEAyGIIpWSklYY61QPqbcx2Wg4eRBt4w1gGpxLqnEazQRHEGuEztdQPIORzOO8wBNMBcLUngiFqUUVGmXf4njC5/w9mb+HxuwoqLwezDBoGQHVpCsVD+EK/GYxW/avofVkb6IiQ0TnbHyVZitDdnphfHJWz2uQQpEUxhn62vsEY7NbrtfEG+RBypwYs3JwessWryXZHQrePvhhYDkMZmhEAyGULbPxmJX9xJ1cUDw38HuHtcz0+8/+TTjK6lGmGXkL2raaMJcyb9RFhiX9CZ+LzsNQV/gtbKoB7YeM0ywkQfuvkUI7I7qwyaN8ohbh7LY7nbN44D44nFvT/TyfnikExFazp9vdOmcuMyL7scnIwtTUCN2M37junoJi9dqtv/eo7+lRGnJNdCEzsExNkVbwvkiwwgbS3HdrE+t600LFKdFcv4tmdu4pQTX4XHnACdl6CszUX1dA0OVDWpWb+N1MOAEKrS33RRO6tegL9k3rL+RmdvQsRMgwsbqCcj7wlIuygG6RpdoQ0UQ6YwqzVI/egU9GwsDoWWf/Cq0dkZamA9/v7ahAYicAluNb06+XfbK9tEg/NVFUPdBohan2coxQd8vYHmvOZAWUTw6VdYnVXHIOEWR0k5gu1e8MpHhfGSSzFgOhjVQvO4KCjX8jLoUsJdv3O1Th8qTMLwzhot+/TOje40ESK/4SYd3TWtNzhVezm/YrHO9y3+uQgbl1IuajHlx/h3HqMhzmtZCQxYKhPTHbXrKXmEA4Q8/8nqbIHPlIbN8qPTeUHEkhpZKef5bfqO1igXDUevWbwPdpks7OiUKOi70dRyPI9sszJcIrlKWnpSLC/kEH9AHnqNcih5927I3Um7u9RC2yqZLSBeM5siJO3Mqu9mAylifpP7lvxBZlS1e1nvhhECX8Iztqr++PdFx3eN27Ajbx5Lg6tHl32uCLVCH1r8Ca5PGnqhNmrvH7H3aQ8PaRYwtpBnoFdNAIE37NNtUHAfeTkfk3VXu0+Ax+toMQ/6p7940a/pKs8AyUJMVHuHA/5qHe/7Go1RbmPpMOBMsn9VIOEbbTz6+X8deoiVu9a5C3uAydh3DjgizOQmE3Z0wQEz1IGVW608cYPFilym9/6NL0es X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 81ab4128-e0b7-4c15-caa9-08def15f1199 X-MS-Exchange-CrossTenant-AuthSource: AS8P189MB1672.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Aug 2026 12:59:36.9416 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Q/zewdlhljGA7BUnWi2WoaqgFnIlqmPCp7F2JL0sXvY5zoerZVHaPL9YJ2qvYfswLQUjl02jn5rhK8QSiUX/qn56o/dqX+fM1CVtzY8vnD0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9P189MB2050 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 03 Aug 2026 13:06:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/128685 From: Adarsh Jagadish Kamini Backport patch to fix CVE-2026-55971. References: https://nvd.nist.gov/vuln/detail/CVE-2026-55971 Upstream fix: https://github.com/apache/thrift/commit/db4a473f3a984eee27273256fe737be5dd175595 Testing: The backported fix ships with a C++ Boost regression test, test_theadertransport_zlib_roundtrip, in lib/cpp/test/ThrifttReadCheckTests.cpp. The recipe builds with -DBUILD_TESTING=OFF, so the C++ test suite is not compiled during a normal build. To verify the fix, the suite was built with BUILD_TESTING=ON (using the native thrift compiler for codegen via THRIFT_COMPILER) and the resulting UnitTests binary was executed against the target sysroot for MACHINE=qemux86-64. Result: test_theadertransport_zlib_roundtrip passed. Full C++ UnitTests suite: 79 of 80 test cases passed, 107659 of 107660 assertions passed. The single failure (ToStringTest/locale_de_DE_floating_point_to_string) is unrelated to this fix and is caused by the de_DE locale not being present in the minimal test sysroot. Signed-off-by: Adarsh Jagadish Kamini --- .../thrift/thrift/CVE-2026-55971.patch | 92 +++++++++++++++++++ .../thrift/thrift_0.22.0.bb | 1 + 2 files changed, 93 insertions(+) create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55971.patch diff --git a/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55971.patch b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55971.patch new file mode 100644 index 0000000000..e13b6464e0 --- /dev/null +++ b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55971.patch @@ -0,0 +1,92 @@ +From e5f8281298e4809d57143ed52933487fa90f20e0 Mon Sep 17 00:00:00 2001 +From: Jens Geyer +Date: Wed, 17 Jun 2026 23:27:46 +0200 +Subject: [PATCH] Read the zlib transform result directly in THeaderTransport + untransform Client: cpp + +The zlib read path decompressed the frame into the transform buffer and then copied the result back into the receive buffer. Swap the transform buffer in as the receive buffer and read the result directly instead of copying it. + +Adds a write/read round-trip test through the zlib transform. + +Co-Authored-By: Claude Opus 4.8 + +Backport notes: + - lib/cpp/src/thrift/transport/THeaderTransport.cpp: taken unchanged + from upstream. + - lib/cpp/test/ThrifttReadCheckTests.cpp: kept only the new + test_theadertransport_zlib_roundtrip test. The upstream + test_theadertransport_header_size_exceeds_frame test was dropped + because it depends on THRIFT-5854, which is not in 0.22.0. Added the + #include that the new test + needs (added upstream by THRIFT-5854). + +Assisted-by: kiro:claude-sonnet-5 + +CVE: CVE-2026-55971 +Upstream-Status: Backport [https://github.com/apache/thrift/commit/db4a473f3a984eee27273256fe737be5dd175595] + +Signed-off-by: Adarsh Jagadish Kamini +--- + .../src/thrift/transport/THeaderTransport.cpp | 8 ++++++- + lib/cpp/test/ThrifttReadCheckTests.cpp | 24 +++++++++++++++++++ + 2 files changed, 31 insertions(+), 1 deletion(-) + +diff --git a/lib/cpp/src/thrift/transport/THeaderTransport.cpp b/lib/cpp/src/thrift/transport/THeaderTransport.cpp +index b3b833389..117c8edd5 100644 +--- a/lib/cpp/src/thrift/transport/THeaderTransport.cpp ++++ b/lib/cpp/src/thrift/transport/THeaderTransport.cpp +@@ -298,7 +298,13 @@ void THeaderTransport::untransform(uint8_t* ptr, uint32_t sz) { + "Error while zlib deflateEnd"); + } + +- memcpy(ptr, tBuf_.get(), sz); ++ // The result now lives in tBuf_ and is typically larger than the source ++ // section it was read from, so it does not fit back into the receive ++ // buffer at ptr. Swap the transform buffer in as the receive buffer and ++ // continue from its start instead of copying the result back in place. ++ rBuf_.swap(tBuf_); ++ std::swap(rBufSize_, tBufSize_); ++ ptr = rBuf_.get(); + } else { + throw TApplicationException(TApplicationException::MISSING_RESULT, "Unknown transform"); + } +diff --git a/lib/cpp/test/ThrifttReadCheckTests.cpp b/lib/cpp/test/ThrifttReadCheckTests.cpp +index 09dffe228..963286100 100644 +--- a/lib/cpp/test/ThrifttReadCheckTests.cpp ++++ b/lib/cpp/test/ThrifttReadCheckTests.cpp +@@ -31,6 +31,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -269,4 +270,27 @@ BOOST_AUTO_TEST_CASE(test_tthriftjsonprotocol_read_check_exception) { + protocol->readMapEnd(); + } + ++BOOST_AUTO_TEST_CASE(test_theadertransport_zlib_roundtrip) { ++ using apache::thrift::transport::THeaderTransport; ++ // A run of identical bytes compresses to far fewer bytes than it occupies ++ // once expanded again, so the result of the zlib transform is much larger ++ // than the frame section it is read from. This drives the full write/read ++ // round trip through the zlib transform path. Keep the payload small enough ++ // to stay within the transform buffer the reader sizes from its write buffer. ++ const std::size_t N = 700; ++ std::vector payload(N, 0x42); ++ ++ std::shared_ptr buffer(new TMemoryBuffer()); ++ std::shared_ptr writer(new THeaderTransport(buffer)); ++ writer->setTransform(THeaderTransport::ZLIB_TRANSFORM); ++ writer->write(payload.data(), static_cast(payload.size())); ++ writer->flush(); ++ ++ std::shared_ptr reader(new THeaderTransport(buffer)); ++ std::vector out(N, 0x00); ++ reader->readAll(out.data(), static_cast(out.size())); ++ ++ BOOST_CHECK(out == payload); ++} ++ + BOOST_AUTO_TEST_SUITE_END() diff --git a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb index 8d885dadc4..26849da0c8 100644 --- a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb +++ b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb @@ -13,6 +13,7 @@ SRC_URI = "https://downloads.apache.org/${BPN}/${PV}/${BP}.tar.gz \ file://0001-support-reproducible-builds.patch \ file://CVE-2026-43868.patch \ file://CVE-2026-43870.patch \ + file://CVE-2026-55971.patch \ " SRC_URI[sha256sum] = "794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5" From patchwork Mon Aug 3 12:59:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adarsh Jagadish Kamini X-Patchwork-Id: 94320 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 097BAC55184 for ; Mon, 3 Aug 2026 13:06:45 +0000 (UTC) Received: from PA4PR04CU001.outbound.protection.outlook.com (PA4PR04CU001.outbound.protection.outlook.com [40.107.162.53]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.42531.1785761983669860443 for ; Mon, 03 Aug 2026 05:59:44 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=CH6IiGy4; spf=pass (domain: est.tech, ip: 40.107.162.53, mailfrom: adarsh.jagadish.kamini@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=uAPcuAcaavO1yeJa+D7XyAsYwm+pKCdmmcngfklk4aU6x6LgqoDs4bFvAduIfy+VNTaXawL5m6R3WAwkErgkdF+OOeFqaBrXQGquQ08kGdH+zg5bEY0x4pcv9W/JdP/71BbZTF05SCRTF2+wilzERbHz0NuQLiaRP5OIF1TxXoOj6QwdkTLL/Oq84UGa8tSogz6M/JXi5B6B/TXuUny5n/wfPzzs+dS8BlxW1/fp+s1wPs0GXmlbz3YP3Cakdxn0sxgbEz/srnAcURHZtXlpX2eJ2yziCJchgpomoQXUukRJLUY7AKXe9l5/AJd6h0ncBB/DojLvKZxARegVj0QNtQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=EtJ5tEP2twYceOZ/iikDOSWOo+hi98SSGUm7T8XLyMQ=; b=kk/6iqwinMconRX4GL7LvcDht8ivnnbGSeuh9Dr4MU0kzVknA4uvXDUdfk+wg7oKf7DpIa2aNlDw+kThVo1iZIBvaa7QhY/xGqDE8byeOIvtc5sDhHuqcDzeBqbu0HSOVxSrvtsfymqPvYjSkbO3kUCVwf/U2pStS0pmWR4sGniS7RKEaDNKkZR1wgqKGRYLGvDcaXe8rquGoCJ1JzVfV2sfMsHV4QuE5TcZuNIHtK0/mXfZkb+lZSUS4lv4CKDgBui3TgOsu+kCJnP8kucBg1/GuhHu1xl4ojJuajsYCDW3PKSiGjIT6PRnm5vlqFMStF52s+ARnLtKBXUpf5I0gw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EtJ5tEP2twYceOZ/iikDOSWOo+hi98SSGUm7T8XLyMQ=; b=CH6IiGy4KeAx2CxoGgJqHC87xkByx0CEj1KuEnxOTH/1siUsgclzkhKou7TkXRO4TwWYHVLA40XUgDxV2I6R4Dxhsqa6BdJDdaukgrOYpjY3bYp6OMi0/IGzkFHTNb8mLuMGuF1r46EEF2b+ds1UeuVmxaZz2xqOoZoiPFwTtWmpcLC7SDXib7XU5ld94pV+Jkop8ga+ZXt+jtGYljAgUNJ9UuZmWZ2sesLQI1UqaJ2vFqsg5Z4tHucHkeCyPK5yOMp2WSfNb4Fthiyd77nxPBkCPTVdLvoZMnVn1tk50r9yJ34ykp0GYWwaWx8XNHNrm1npC3WdeMzuPZXoCHiI5Q== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AS8P189MB1672.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:396::9) by DB9P189MB2050.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:392::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.13; Mon, 3 Aug 2026 12:59:40 +0000 Received: from AS8P189MB1672.EURP189.PROD.OUTLOOK.COM ([fe80::f147:85e5:34de:eeff]) by AS8P189MB1672.EURP189.PROD.OUTLOOK.COM ([fe80::f147:85e5:34de:eeff%4]) with mapi id 15.21.0292.012; Mon, 3 Aug 2026 12:59:39 +0000 From: "Adarsh Jagadish Kamini" To: openembedded-devel@lists.openembedded.org Subject: [meta-oe][wrynose][PATCH 2/4] thrift: fix CVE-2026-58023 Date: Mon, 3 Aug 2026 14:59:20 +0200 Message-ID: <20260803125927.831690-3-adarsh.jagadish.kamini@est.tech> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260803125927.831690-1-adarsh.jagadish.kamini@est.tech> References: <20260803125927.831690-1-adarsh.jagadish.kamini@est.tech> X-ClientProxiedBy: DU2PR04CA0156.eurprd04.prod.outlook.com (2603:10a6:10:2b0::11) To AS8P189MB1672.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:396::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AS8P189MB1672:EE_|DB9P189MB2050:EE_ X-MS-Office365-Filtering-Correlation-Id: 4aa10ba5-729d-402f-3051-08def15f13c5 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|23010399003|1800799024|376014|12006099003|22082099003|18002099003|11063799006|13003099007|6133799003|10067099003|56012099006; X-Microsoft-Antispam-Message-Info: lzSMukF0s089PbmRBt2HZpXUxIeCZmwLK65vyYPJ9sMN2L8zizh7m+K9Bl2CcG6MwddiUGKK3AdHiI71b7ps4dzsR0YB+vCusYukytHf2XFFCT0rnJJLhfNIReGoePeb2boC5muJF1d9NrvkRtsFv6xQ2sSCfvErVBykTbjH+N7+MZq3lXeJsOt4nxdEFjWJUqS7dyFsvVgWiyYXM/h1xgixmWwmw+UOp5438iRoVnUI6WtElZj9wfXILCxkZUVtu/ablEr4o5QbzkaFm4l4Kog5vjLWRDjIi9uLVBaashG5XDwCpFcP/kuA5Y2ijROClIa/8cptdrzpuHxhkcRRjhe7J/OUFc7om8YxOxXIy2R/2MrY36OVWUTykZh7RT+4Z4LWvefpt53QWiLoB5BLW7S/v92zp1Mkm/y5YXfHDDupFVqw4Rbk6uPyfbg24zGMl6tlfJFYppi0KW9hUZbiyQsSrjDo+KIM2acLrtSyH2hBgMdTJuLo+GWcbf9Dz/KtYuThBBuGgICe3KpNdsRUYMXyiMBGoZ+fZWWohti0kx4Dtso1d2nUrhH3ZiAok7aujmrRxKNbl70Jn/FJZVWk6WdLK3WRrkZ84hfqD5kPkzjMhZTjei5jQeRviyQ7WnpGZpuK7NfvhEtSLS9/eTfmQ1nroImQzto8hvfpodLEXEw= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AS8P189MB1672.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(1800799024)(376014)(12006099003)(22082099003)(18002099003)(11063799006)(13003099007)(6133799003)(10067099003)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: qMZHvQ1uExDtaJi5TuAz+dWQDVHvtDS3mh9zRpadlD19uCE2majN5G6yttuUcraryqb1PogZ2q/JSf/2X4InzEMtUYDJ+Y/ukpNiX/UhqwqjsfHAeoaTd061GcW0eNBz2dx5TORv8fl67qHgCjoz3rXyYOd5OFmGDxftolE0f5Hh5EwRypza8zhDoI+kYN9WyTOEDzE9UUx22MvwAOIt07IOIE5Bn96Kz0TuHxBGCqJ0TE7M3eu0nKxlQZ+wsRovEQVK8r/9TEEjd9vglMegs35AUdQsaND5kFPGC8XMxp3gT78y84jLDnrnvL6w2C64cnmk2UDIfBqsMfeTDkvoER8lt5n4GUs9T1oK3KWoEQSAkKtX6NWPOwM7fwvVenHi/XuVj1UHUrbYE6GJfQn6XDPEZLo+5lJqRhfhvCl3f/4w5zWYZvXRvJZ0c1Tfmd9mJnSXgiUIwmGZ2KUnK0CyypY0NTD7jSRlA09HDn0KEwxDRwET7VH5bQ3y3QSymzUEhjFWSJSosraNM+oa57zESK5Zsc0j9r9ZbofQmtKRovAtMzqax/3TH4l/N8KfGV2qm931ZVs0qO+2v7nAsspVDzzyPpUvL0CeEND5k6A1GG+N67DU8oEe4tssAmYNVHAfbAijlKW7ymC417ake8dkbDiYHjNfT5OCqkByAZ1SCbSwhm/NOoxAW5FQah64C3ZxTBPQn8sGAR2dQNRm+JkvY/M+3oFcMnvCmBBkK4p3ets0fssPGOl5dFJDIM0DCiUk6E1ZHzmpOUxppoz/YkXxtjbe/Ks19Ngiiu0j1eqNPswLZrL+bu7hOF9aUwSO0F6AMiLR8a/H9qWuu71qicmuuhxv2/OFcNkwcsa2uZBQmqKcayKOAjV+bL1xqGDh3XQ+Q2jlQlakGMbOw1b8RD7zXErMdjQafqgB9LYZhTe4+FOtY62aufxBfEf0baun8hMKevm4WQOLiInmeVC329FvNCQCxAu9ZZk5zFgxqABSVKyaI564fchvbrZveOJnboUfKeW+V3XHXrYrEPKpMJ4ETTWeXxG/IB3iM34rKRahLLjlDsdUXvO86KNSJ8HOexaBmA3i12HUALD7wyCdBR4BWXa+I82JY3k3XHrZhjwxj7FXMStbPDnfnvpVyep+hhcvZ76MhZqLrEBDZDNYWuODgQOEgs5k/w4hV3Wo8YABtjzKWkn26/VHxKXfXOhHA2RNe6634qTxidvGb8AowR6+LuOBFYjKvXcr6CFWJ0NPxf2jurjacAxusTJlDJf7vONvrJ9r6jcNe+qKmPVqXkk6OXSFpdr7ru2eIXnrDY8u8girttQcTpGTM5y0pNPqZn+l5B7rOmAelVQ4Q2Tw5vWDqjyIS/ZI7X4jsc9Ltnz1KnQE9Xf9i2InPphYN+GLFjcBP6mga3xQmIe+xJR0P3nrGoOhPIyuXRyI0BAAE/V5630JuBpTdCb8JQb8c/haGkZdnErUNLLFuE9Pf4oBs4AskCG27N+mNYJTvozGN5PRD5Rc/hCExy3mR/Fns35GJsrkZw6Ak3N4aBf6vNYEHb/wYeKVnEMit/ORt1bThj5+VPUUxIz1byQFnfCiuVtLkX/nxJfWZcq7e99YXnnIBrl5O0T3/A+Z3hOc0Tu7JsUzFq7fl9nirIT62L9WZjCrGfkV0rDKSdoK4CJ2mMNDdcs7LsZMn0VGlhh6cxq8klG4F1PgBgyd4IprQ5fNtimgd4dLrYXbbZbgcyMDcY8E3l46ZUXhgEtvZho4pqWlOriLdZzT0Fu8kzhgmpjAJ6f1BGMA X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 4aa10ba5-729d-402f-3051-08def15f13c5 X-MS-Exchange-CrossTenant-AuthSource: AS8P189MB1672.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Aug 2026 12:59:39.1504 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: gMTRBrbbUmhxFWZP2EbQZivfB3BnYDrQcwQETP5ICpeIjRYIqtoR7QEBMFKvojCLYdxIZMQV4uDH0BSgdMUf8EKyRm5qz2O1gBCZUVbUCJg= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9P189MB2050 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 03 Aug 2026 13:06:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/128686 From: Adarsh Jagadish Kamini Backport patch to fix CVE-2026-58023. References: https://nvd.nist.gov/vuln/detail/CVE-2026-58023 Upstream fix: https://github.com/apache/thrift/commit/d68305a7308a11df2c1daef16f55dbc19dfa6ff0 Signed-off-by: Adarsh Jagadish Kamini --- .../thrift/thrift/CVE-2026-58023.patch | 231 ++++++++++++++++++ .../thrift/thrift_0.22.0.bb | 1 + 2 files changed, 232 insertions(+) create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-58023.patch diff --git a/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-58023.patch b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-58023.patch new file mode 100644 index 0000000000..e3535fb108 --- /dev/null +++ b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-58023.patch @@ -0,0 +1,231 @@ +From 2f77969e8f841b225bd74bcfa4eeb341e78c06f7 Mon Sep 17 00:00:00 2001 +From: Javid Khan +Date: Fri, 26 Jun 2026 21:35:32 +0200 +Subject: [PATCH] copy buffered data not the GByteArray struct in c_glib + read_slow Client: c_glib + +thrift_framed_transport_read_slow copies leftover bytes from the previous frame with memcpy(buf, t->r_buf, t->r_buf->len), passing the GByteArray struct pointer as the source instead of t->r_buf->data. The correct source is the buffer's data member, as used by the other memcpy calls in the same file. thrift_buffered_transport_read_slow contains the same mistake in its leftover path. Both are updated to read from t->r_buf->data, and a regression test using a memory buffer exercises the cross-boundary read path in each transport. + +This closes #3607 + +CVE: CVE-2026-58023 +Upstream-Status: Backport [https://github.com/apache/thrift/commit/d68305a7308a11df2c1daef16f55dbc19dfa6ff0] + +Signed-off-by: Adarsh Jagadish Kamini +--- + .../transport/thrift_buffered_transport.c | 2 +- + .../transport/thrift_framed_transport.c | 2 +- + lib/c_glib/test/Makefile.am | 6 +- + lib/c_glib/test/testbufferedtransport.c | 47 ++++++++++++++ + lib/c_glib/test/testframedtransport.c | 62 +++++++++++++++++++ + 5 files changed, 115 insertions(+), 4 deletions(-) + +diff --git a/lib/c_glib/src/thrift/c_glib/transport/thrift_buffered_transport.c b/lib/c_glib/src/thrift/c_glib/transport/thrift_buffered_transport.c +index 30aa95caf..21e3e42d4 100644 +--- a/lib/c_glib/src/thrift/c_glib/transport/thrift_buffered_transport.c ++++ b/lib/c_glib/src/thrift/c_glib/transport/thrift_buffered_transport.c +@@ -93,7 +93,7 @@ thrift_buffered_transport_read_slow (ThriftTransport *transport, gpointer buf, + /* first copy what we have in our buffer. */ + if (have > 0) + { +- memcpy (buf, t->r_buf, t->r_buf->len); ++ memcpy (buf, t->r_buf->data, t->r_buf->len); + want -= t->r_buf->len; + t->r_buf = g_byte_array_remove_range (t->r_buf, 0, t->r_buf->len); + } +diff --git a/lib/c_glib/src/thrift/c_glib/transport/thrift_framed_transport.c b/lib/c_glib/src/thrift/c_glib/transport/thrift_framed_transport.c +index 3cbb245e0..8deed4119 100644 +--- a/lib/c_glib/src/thrift/c_glib/transport/thrift_framed_transport.c ++++ b/lib/c_glib/src/thrift/c_glib/transport/thrift_framed_transport.c +@@ -138,7 +138,7 @@ thrift_framed_transport_read_slow (ThriftTransport *transport, gpointer buf, + /* first copy what we have in our buffer, if there is anything left */ + if (have > 0) + { +- memcpy (buf, t->r_buf, t->r_buf->len); ++ memcpy (buf, t->r_buf->data, t->r_buf->len); + want -= t->r_buf->len; + t->r_buf = g_byte_array_remove_range (t->r_buf, 0, t->r_buf->len); + } +diff --git a/lib/c_glib/test/Makefile.am b/lib/c_glib/test/Makefile.am +index 0a5f220ac..a879d9881 100644 +--- a/lib/c_glib/test/Makefile.am ++++ b/lib/c_glib/test/Makefile.am +@@ -150,7 +150,8 @@ testbufferedtransport_LDADD = \ + $(top_builddir)/lib/c_glib/src/thrift/c_glib/transport/libthrift_c_glib_la-thrift_socket.o \ + $(top_builddir)/lib/c_glib/src/thrift/c_glib/transport/libthrift_c_glib_la-thrift_server_transport.o \ + $(top_builddir)/lib/c_glib/src/thrift/c_glib/transport/libthrift_c_glib_la-thrift_server_socket.o \ +- $(top_builddir)/lib/c_glib/src/thrift/c_glib/libthrift_c_glib_la-thrift_configuration.o ++ $(top_builddir)/lib/c_glib/src/thrift/c_glib/transport/libthrift_c_glib_la-thrift_memory_buffer.o \ ++ $(top_builddir)/lib/c_glib/src/thrift/c_glib/libthrift_c_glib_la-thrift_configuration.o + + testframedtransport_SOURCES = testframedtransport.c + testframedtransport_LDADD = \ +@@ -158,7 +159,8 @@ testframedtransport_LDADD = \ + $(top_builddir)/lib/c_glib/src/thrift/c_glib/transport/libthrift_c_glib_la-thrift_socket.o \ + $(top_builddir)/lib/c_glib/src/thrift/c_glib/transport/libthrift_c_glib_la-thrift_server_transport.o \ + $(top_builddir)/lib/c_glib/src/thrift/c_glib/transport/libthrift_c_glib_la-thrift_server_socket.o \ +- $(top_builddir)/lib/c_glib/src/thrift/c_glib/libthrift_c_glib_la-thrift_configuration.o ++ $(top_builddir)/lib/c_glib/src/thrift/c_glib/transport/libthrift_c_glib_la-thrift_memory_buffer.o \ ++ $(top_builddir)/lib/c_glib/src/thrift/c_glib/libthrift_c_glib_la-thrift_configuration.o + + testzlibtransport_SOURCES = testzlibtransport.c + testzlibtransport_LDADD = \ +diff --git a/lib/c_glib/test/testbufferedtransport.c b/lib/c_glib/test/testbufferedtransport.c +index d01806d61..7493b7222 100644 +--- a/lib/c_glib/test/testbufferedtransport.c ++++ b/lib/c_glib/test/testbufferedtransport.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + #define TEST_DATA { 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j' } + +@@ -306,6 +307,51 @@ test_write_fail(void) + } + } + ++/* A read larger than the bytes already sitting in the read buffer takes the ++ read_slow() path with have > 0. That leftover used to be copied from the ++ GByteArray structure itself rather than its data member, which corrupted the ++ result and over-read the small struct allocation once more than a handful of ++ bytes were buffered. Pre-load the buffer and drive the read through a memory ++ buffer so the path is exercised without a socket peer. */ ++static void ++test_read_across_buffer (void) ++{ ++ ThriftBufferedTransport *bt; ++ ThriftTransport *transport; ++ ThriftMemoryBuffer *membuf; ++ guchar leftover[96]; ++ guchar tail[4]; ++ guchar buf[100]; ++ gint32 got; ++ guint i; ++ ++ for (i = 0; i < sizeof (leftover); i++) ++ leftover[i] = (guchar) (0x10 + i); ++ for (i = 0; i < sizeof (tail); i++) ++ tail[i] = (guchar) (0xc0 + i); ++ ++ membuf = g_object_new (THRIFT_TYPE_MEMORY_BUFFER, "buf_size", 1024, NULL); ++ thrift_transport_write (THRIFT_TRANSPORT (membuf), tail, sizeof (tail), NULL); ++ ++ transport = g_object_new (THRIFT_TYPE_BUFFERED_TRANSPORT, ++ "transport", THRIFT_TRANSPORT (membuf), NULL); ++ ++ /* leave 96 bytes already buffered, more than sizeof(GByteArray) */ ++ bt = THRIFT_BUFFERED_TRANSPORT (transport); ++ g_byte_array_append (bt->r_buf, leftover, sizeof (leftover)); ++ ++ /* this read exceeds the buffered bytes and must return the real buffered ++ data followed by the freshly read tail, not the GByteArray structure */ ++ got = thrift_transport_read (transport, buf, 100, NULL); ++ g_assert (got == 100); ++ g_assert (memcmp (buf, leftover, 96) == 0); ++ g_assert (memcmp (buf + 96, tail, 4) == 0); ++ ++ thrift_transport_read_end (transport, NULL); ++ g_object_unref (transport); ++ g_object_unref (membuf); ++} ++ + int + main(int argc, char *argv[]) + { +@@ -319,6 +365,7 @@ main(int argc, char *argv[]) + g_test_add_func ("/testbufferedtransport/OpenAndClose", test_open_and_close); + g_test_add_func ("/testbufferedtransport/ReadAndWrite", test_read_and_write); + g_test_add_func ("/testbufferedtransport/WriteFail", test_write_fail); ++ g_test_add_func ("/testbufferedtransport/ReadAcrossBuffer", test_read_across_buffer); + + return g_test_run (); + } +diff --git a/lib/c_glib/test/testframedtransport.c b/lib/c_glib/test/testframedtransport.c +index 008e61e40..581b71067 100644 +--- a/lib/c_glib/test/testframedtransport.c ++++ b/lib/c_glib/test/testframedtransport.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + + #define TEST_DATA { 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j' } + +@@ -305,6 +306,66 @@ thrift_server (const int port) + g_object_unref (tsocket); + } + ++/* append a framed message (4-byte big-endian size header + body) */ ++static void ++append_frame (GByteArray *wire, const guchar *data, guint32 len) ++{ ++ guint32 netlen = htonl (len); ++ g_byte_array_append (wire, (const guchar *) &netlen, 4); ++ g_byte_array_append (wire, data, len); ++} ++ ++/* A read whose length crosses a frame boundary takes the read_slow() path ++ while bytes are still buffered from the previous frame. That leftover used ++ to be copied from the GByteArray structure itself rather than its data ++ member, corrupting the result and over-reading the heap once more than a ++ handful of bytes remained. Drive it through a memory buffer so the path is ++ exercised without a socket peer. */ ++static void ++test_read_across_frames (void) ++{ ++ guchar f1[100]; ++ guchar f2[100]; ++ guchar buf[100]; ++ gint32 got; ++ guint i; ++ ++ for (i = 0; i < sizeof (f1); i++) ++ { ++ f1[i] = (guchar) (0x10 + i); ++ f2[i] = (guchar) (0xc0 + i); ++ } ++ ++ GByteArray *wire = g_byte_array_new (); ++ append_frame (wire, f1, sizeof (f1)); ++ append_frame (wire, f2, sizeof (f2)); ++ ++ ThriftMemoryBuffer *membuf = g_object_new (THRIFT_TYPE_MEMORY_BUFFER, ++ "buf", wire, ++ "buf_size", (guint32) 0, ++ NULL); ++ ThriftTransport *transport = g_object_new (THRIFT_TYPE_FRAMED_TRANSPORT, ++ "transport", ++ THRIFT_TRANSPORT (membuf), ++ NULL); ++ ++ /* consume part of the first frame so 96 bytes stay buffered */ ++ got = thrift_transport_read (transport, buf, 4, NULL); ++ g_assert (got == 4); ++ g_assert (memcmp (buf, f1, 4) == 0); ++ ++ /* this read spans into the second frame and must return the real buffered ++ bytes, not the bytes of the GByteArray structure */ ++ got = thrift_transport_read (transport, buf, 100, NULL); ++ g_assert (got == 100); ++ g_assert (memcmp (buf, f1 + 4, 96) == 0); ++ g_assert (memcmp (buf + 96, f2, 4) == 0); ++ ++ thrift_transport_read_end (transport, NULL); ++ g_object_unref (transport); ++ g_object_unref (membuf); ++} ++ + int + main(int argc, char *argv[]) + { +@@ -318,6 +379,7 @@ main(int argc, char *argv[]) + g_test_add_func ("/testframedtransport/OpenAndClose", test_open_and_close); + g_test_add_func ("/testframedtransport/ReadAndWrite", test_read_and_write); + g_test_add_func ("/testframedtransport/ReadAfterPeerClose", test_read_after_peer_close); ++ g_test_add_func ("/testframedtransport/ReadAcrossFrames", test_read_across_frames); + + return g_test_run (); + } diff --git a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb index 26849da0c8..b3f420bfe3 100644 --- a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb +++ b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb @@ -14,6 +14,7 @@ SRC_URI = "https://downloads.apache.org/${BPN}/${PV}/${BP}.tar.gz \ file://CVE-2026-43868.patch \ file://CVE-2026-43870.patch \ file://CVE-2026-55971.patch \ + file://CVE-2026-58023.patch \ " SRC_URI[sha256sum] = "794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5" From patchwork Mon Aug 3 12:59:21 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adarsh Jagadish Kamini X-Patchwork-Id: 94321 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 04C31C55179 for ; Mon, 3 Aug 2026 13:07:05 +0000 (UTC) Received: from PA4PR04CU001.outbound.protection.outlook.com (PA4PR04CU001.outbound.protection.outlook.com [40.107.162.53]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.42531.1785761983669860443 for ; Mon, 03 Aug 2026 05:59:44 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=zDFzeGDC; spf=pass (domain: est.tech, ip: 40.107.162.53, mailfrom: adarsh.jagadish.kamini@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=P/m2U620zcJKerMt+d5r9lwV7YYG4Cdh0L7iKxXKC1RfE2wb1cQnq4CoXBxtUeJqZmrQK7rdGHKeVw+Did6jop6pJm8fTKkWzBDVvjTGwqXlr7cpazjpwzEeoRrPN9VMs1Ly9IFYcDFR3gBs9W+SK1FeuvnIBc3q4e2/S2qKmPSLV02BJ9cGb3+pPemwimEXIz8HVbzczeCSndJMmaxOsGsjNuUNzZdmgj+Q9CilFpENQRUHaGBzktD3tGqrCVTx9GS20XNluGKwD88wqbEyR5VAnMxA4pNDTYG+4C3I/rrefTdpFY32iYPcIhaW8793zNeAyo70SHC/VePfAncdrg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=X+jpKhEFcM0HxSJ56NaO62OhI25/ppEuil+zapdsloc=; b=liD3MTqgxNwd9CbXFQd8/ju9UI7iW36pOldi+d7bSmR3ChtOLHkcaI4TXqc2zC9MiTbnLUnKgN25Zn92m0wxkTenq/aReHZGOGljZcgkc4kLNxOYj5NdyJLVkteoBNlCYuF1t8TR9IL2tWARRxu56Pz2V6XYgzXQHKUEPmCCb3osgHQ2MoBZd4noTxdsxYqB0SIUg+CEq8cqVz8kH2cXSU31OL5lD4Nq2xIaPronBWLZgOYcBp32MqeYhv1O0GBLyky/xtAFte++cVFCyqVueu61b9Etw1q7agqrQr5H8MA7Wti7Yd3N0m4f7OUWb47N71y/pdcJm5IuZwxeF2xElQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=X+jpKhEFcM0HxSJ56NaO62OhI25/ppEuil+zapdsloc=; b=zDFzeGDCZ8QatMre+V5tAr1GKB4kgVNgTo7VHJez7SKh3JsjgOK9vTnqcn+qOfKH2gS+uNNqbLzw/sCgB/GHqyRMIpYKrWKxWbBYUzTpDCXIeRSWn18PseBxgrmfGKmRKsmXL0KU9gisCfEHbznGXAMv6zK3y0/sWQhXQjdz3fAwCwbnG55AMDXKEhp9NuW5o/yQA2gQBLOO26OVSorxlQzMuFyEtu1VtL5ISkEgZEHcXSKGGsH24EOCsf5A9uboXf9gk37ZIPNWMroVvD82xV2RW41cuJPb4zsBI8+Gks7Iz1hpa/wBtEZQWR9nww54CIZ8xEpk2JhcpyHv2naIag== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AS8P189MB1672.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:396::9) by DB9P189MB2050.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:392::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.13; Mon, 3 Aug 2026 12:59:40 +0000 Received: from AS8P189MB1672.EURP189.PROD.OUTLOOK.COM ([fe80::f147:85e5:34de:eeff]) by AS8P189MB1672.EURP189.PROD.OUTLOOK.COM ([fe80::f147:85e5:34de:eeff%4]) with mapi id 15.21.0292.012; Mon, 3 Aug 2026 12:59:40 +0000 From: "Adarsh Jagadish Kamini" To: openembedded-devel@lists.openembedded.org Subject: [meta-oe][wrynose][PATCH 3/4] thrift: fix CVE-2026-48144 Date: Mon, 3 Aug 2026 14:59:21 +0200 Message-ID: <20260803125927.831690-4-adarsh.jagadish.kamini@est.tech> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260803125927.831690-1-adarsh.jagadish.kamini@est.tech> References: <20260803125927.831690-1-adarsh.jagadish.kamini@est.tech> X-ClientProxiedBy: DU7P250CA0019.EURP250.PROD.OUTLOOK.COM (2603:10a6:10:54f::12) To AS8P189MB1672.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:396::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AS8P189MB1672:EE_|DB9P189MB2050:EE_ X-MS-Office365-Filtering-Correlation-Id: 1da5d0c0-5113-419a-cd05-08def15f14bb X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|23010399003|1800799024|376014|12006099003|22082099003|18002099003|11063799006|13003099007|10067099003|56012099006; X-Microsoft-Antispam-Message-Info: g8yVVfZZZ63iJUMFMvI0m03QIyTMkZd7gou+C8gnZA21cmzftGnuKee8Q6/0ulnoFNDIfGdfBeOQ7To8T5Cm33x0y8/9Or1hpqbjyJby763/XsEUvqYPCauBF6P5FI0DjdpswdS0pUzZLKzvhj0TbWMKGSArtBIdRvk/N6jOyvwCXeTi4YbQy6NvX3xAAHzdeh7tm9gMUlVFRyxHwQwwySArMRYbN1Oau0DH6b2HrQmNn98s605eufBUwBkT2dsrk/NHuWtUamnkVRdfOklqnuCzB+zBL3pF2RnNFpYh5xhVbWpTBxHftsKouxzXCCLWWZdgSrTdCT0Z7V6Hj0pQdkZ5q9j1kBMR+3MVk6QogaFzbnHvltut/GO5DTxPJkS5R+jikZxjsKL3u3wV/EvgpjBTc6MrOV2KIHJvXSOgrqfrzfXQMmgNcHyOE3qnQRzgSPvRHNbEbz5j+Ux/IuCSTrtyO/Ef6jCtJEUSp9lyvKA6xLtTlANYf9dXkR8ySNl2VrJ1wq6aU7dC96ctJwiqpxYbqsN5s+39su6QgIrVf3WWfRbrYV260LFcbtu4igLNIYjvEKzpgoba9SIcBVWrwC6zKVFV5ylhSECiM51tXRsjK9OkHKqAqVX37ugYnsMFP0pASXG7xp4Z7b9CGGN1c9g9cOU/5lpNANLBMwM3dj8= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AS8P189MB1672.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(1800799024)(376014)(12006099003)(22082099003)(18002099003)(11063799006)(13003099007)(10067099003)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: vaUEVLTz/8UQFH3llNhcXH3eKUTZYc0rL48KR86Wgtg43WZcWdUe5r7k/8fMMQVCYUSeYofUqLwN+FzRspu5/LhXW/adLnUpgENQ412/d1BYkJXEOkR6su+BC/C9nRD+3v/He8Io/2vE6c06vxbBT+AwV4Ltizj1fow1rniCicqNdMuVpJoXrYoKebJFQ9JeUS5lXFnBNwvPVbf2c+mPyQBJtDnrX8EggF2TYaOjfNWMWRl5SC3KxKEpKKw+vemlGFiKQ+o5gxWHjAD3oSRobhnubXN/DOyArnY7CzoTR67mg8BdmBAcoEtgCjKNttQgRQcHtkjVmNS4vuI+Q6/OswUuNp6CYqbmYosg6tlQl/kSI/n8E9a18LoB7i/X2/nHlFp6FVbMiPoqOSQXs80G5c4USqsEzZTNPGLA20CtbZ0rN81sd5ps8kruvLvRPyTRuC4SfvY72VhN4XPWLa9RZseH/M1z4y4IT0XVP43Vdq1MKiHb9OpzN8QGF14J4ekB81YoCm5Ez5Ovq06gRKEo3+uSoWiMnH2tNggbYIY6czKuZCH3UJW4z/5pJneW7ne6iyqmDlrL81LN4ltHM5vKenZaXMhtookN+W5K9IH/2SEGVlXK56gYCV5VHv52XspEamXAAIhY0U/FCHzEg96aOofjjwAMVF00i3KGdEQ4DI/os0e+nRlyc3HCl/qbeNC6dmuBEzhJsQfT+5vFwW68LNReTJ636whEuFVQbWy9avUYV6Ziebn14IYRNLu1wkm4LYgDBnfmWNJuUYHkblLXIsglQO+Yywo+TknIdXJAFhsZNUZcl0pSzbfd8VRUihMBMIvkscyDm9Lla2THrf4D6h/9z/eBhg9m/3W6Ubo93mLtaHk2O8ZQ8f7YSYGjMiUQjeJVGR/haoRYCk2qsm2qiJLQhisHaXORoSPFTBp27BRf/za1PfBEdZrYPRdNKdAe0jkk2lZwaCaa7yPT2DMXPm/Gbmm3N1ym+jc0oZgCGRh1czid6y/yonfaL6dS3fLV0Qgl+zcgFqNupIpMgiFV8zD2SrCwnw9RzG5CqB+jW5uLO1vQA/nhNxIv2MSVfIJBJPqLSkMb5hjeD21gYEpw0Zu2CzikFcz+sNczGOfN8cRXBDBYxbvne9GpzS9KihC65KrF2Oslu5qHviNDst0661Z/P9mRXxbnHh1mVKNuhWRUCeXNzwvmxfEVezm87BnxfJGvNPvfC0kSYsiXpCi39BZd6W56i+eLr3XLbAdYOv/yrSFpffG/Ucn0524AmToC7W23CdAhk0UgeFjGIfdJ9meSQVjXyAgake+09F67cNi+S6FsZrpaMHkViT+JbakB85H0m64QtoGcae4PpDwOuycqPFUTursaJ5xsQPei6rbHnUZNnCfijFG00AXi/e+Mf2SrxxBQtsmfb11VJEeqaRW85P1Wsv1xQIH55k9uBdP3hdFfABzzev/t6q9ZKVfX+tVCVcQjBqnM6eDunm34lcKW5FNv8sIcnwmzdpxMwXmSQn6yOc/HxDp+MAM6RJi0mhp9rCPrKOiPjVPewscLyddDTCksK6ueGzoxCaIVAuKhteH7msku5jkMmmxq4mGdarPHOiU6FsVxcX4bun/oY0m9Rq+ohzKHPM/C8coMj6ReOeSfvHCUDMXvUaoINXLxJw0mOLBonYgPpc+/9dwSrLI6x/bykYne3J0hjD45cvm5+XSJPMrSnz6fAfmM2kXgEUNKrfo98DqAeU5K/NlbDPyBGFob4qagfC7O4PifVPNu+Qctw3dFj5/BufdjvqqT X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 1da5d0c0-5113-419a-cd05-08def15f14bb X-MS-Exchange-CrossTenant-AuthSource: AS8P189MB1672.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Aug 2026 12:59:40.6794 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: c7kZVvG/qQ0/qE/iX0HlDm7fw73uTJqyxro2mh+Yp/U1x2MRsW8tBrKnj3+mCm92aJZTdvs1oZPNr8MWw7a9d2wglKKz/2PVSJb7LBrzjMk= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9P189MB2050 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 03 Aug 2026 13:07:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/128688 From: Adarsh Jagadish Kamini Backport patch to fix CVE-2026-48144. References: https://nvd.nist.gov/vuln/detail/CVE-2026-48144 Upstream fix: https://github.com/apache/thrift/commit/2b8baabc9be52807b08825e825bc0cd26568a193 Signed-off-by: Adarsh Jagadish Kamini --- .../thrift/thrift/CVE-2026-48144.patch | 36 +++++++++++++++++++ .../thrift/thrift_0.22.0.bb | 1 + 2 files changed, 37 insertions(+) create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48144.patch diff --git a/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48144.patch b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48144.patch new file mode 100644 index 0000000000..680cf4481b --- /dev/null +++ b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48144.patch @@ -0,0 +1,36 @@ +From 4110973e59758dbeab5f527daae02f3b6a508bb0 Mon Sep 17 00:00:00 2001 +From: Jens Geyer +Date: Thu, 21 May 2026 03:05:53 +0200 +Subject: [PATCH] Add peer hostname validation to c_glib TLS client Client: + c_glib + +Sets SSL_set1_host() before SSL_connect() so the peer certificate CN/SAN +is validated against the hostname. Guarded with OPENSSL_VERSION_NUMBER +>= 0x10100000L since SSL_set1_host() was introduced in OpenSSL 1.1.0. + +Co-Authored-By: Claude Sonnet 4.6 + +CVE: CVE-2026-48144 +Upstream-Status: Backport [https://github.com/apache/thrift/commit/2b8baabc9be52807b08825e825bc0cd26568a193] + +Signed-off-by: Adarsh Jagadish Kamini +--- + lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c +index 0afcb1b8f..4423a781c 100644 +--- a/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c ++++ b/lib/c_glib/src/thrift/c_glib/transport/thrift_ssl_socket.c +@@ -422,6 +422,11 @@ thrift_ssl_socket_handle_handshake(ThriftTransport * transport, GError **error) + if(ssl_socket->server){ + rc = SSL_accept(ssl_socket->ssl); + }else{ ++#if OPENSSL_VERSION_NUMBER >= 0x10100000L ++ if (socket->hostname != NULL) { ++ SSL_set1_host(ssl_socket->ssl, socket->hostname); ++ } ++#endif + rc = SSL_connect(ssl_socket->ssl); + } + if (rc <= 0) { diff --git a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb index b3f420bfe3..882e72442a 100644 --- a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb +++ b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb @@ -15,6 +15,7 @@ SRC_URI = "https://downloads.apache.org/${BPN}/${PV}/${BP}.tar.gz \ file://CVE-2026-43870.patch \ file://CVE-2026-55971.patch \ file://CVE-2026-58023.patch \ + file://CVE-2026-48144.patch \ " SRC_URI[sha256sum] = "794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5" From patchwork Mon Aug 3 12:59:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adarsh Jagadish Kamini X-Patchwork-Id: 94319 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0A63C55179 for ; Mon, 3 Aug 2026 13:06:44 +0000 (UTC) Received: from PA4PR04CU001.outbound.protection.outlook.com (PA4PR04CU001.outbound.protection.outlook.com [40.107.162.53]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.42531.1785761983669860443 for ; Mon, 03 Aug 2026 05:59:45 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=bRe6Tk02; spf=pass (domain: est.tech, ip: 40.107.162.53, mailfrom: adarsh.jagadish.kamini@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=OJvNBpJsXiYcuWFTGEBYDLo/hBq2yiNV2hLEr9WiKXZBgHzKn9cu2pnMbSopJDLbyIxrvEkeMryVvWiJy42WRuzTYOexOD5MPFOXZV+PFwISLbdq46AXY6i3inpK6mD2Wm7GKs1C850CpmpAS8Tdyg8WcSxxV0jsG0vJBYPaxAqFEHRFGOE6XhXXN8BKfXDS4oBIxeCMl8sFP/To9oTw7Xxx0t0IFAanbSxd4uX7C8Zrz4DrYEdI5HtX449WEF+IIrxmbD7+BU8YQGDz2HIm9PEFIU8iYEWOjgRMF3W1V86fasCgLtr2RB5MjztBDWnCoNfbY5WlZAc0Gir488XCRw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=4+5BsXcnUqL9XlvXRHSaVa9UZZEDcZom+wPDIp8MfUc=; b=VJ59cJmfOseDibflbLxq0xOPVaMbQDBeOxklykjCDKZHrUaycT4PeARCuqyXfMJifhLka/fA7g1aKWRxq5UpMwra7AqyvBhv7UQ0eL67uASh4Gmd4PqZEKxbgfArAVxPWbBZe3jaL08taxmJv4RMWdKrAAqYBSNuwjJQ9mnNk4zjuTn6e/YKqYhD+pmhP5FBCWKrfLaf1mzuqajxAseINssyvdvBitQh/xm7dKrbVBF4papz2rdB7w/w19njMPjqACfBDrCF29wwnfAN3jnXOhypkZHy5ZAfVB1MG92y1UzlDnF0ttm/SwKIEal1XbGuvfxPpznH0YuCVq0Sx4xwAw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4+5BsXcnUqL9XlvXRHSaVa9UZZEDcZom+wPDIp8MfUc=; b=bRe6Tk02KlNlCeD/Iox4SkAYyuI6G2SAetVqHNud9+ASYwOTRq6ZfWUpGUll75rvc2kt8oIdU2XwY8DBccmG9mUN75gxsEbEwf8tcDzGASn8w86bxTlEfDL0H654fGrfR51/obra8c2zK/+mvN/vnD45/hJclE2y02MSI6P7jZ/ZFetODHcNKmy+HOvUNrCUxo0Tg2/o0lkom+/+A3sSArL4SSAjj4Yz+PhFuR5IN1LQ7Db8lQe/+a7UpnvCmSv3p83+V0yqltApaIAYBRYhaY0hOUhRvuVpHZFCZvzxSWfw5O9E0RQESx/SnXfjV3JsdwodrpqifzWbXwds0/z/EQ== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AS8P189MB1672.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:396::9) by DB9P189MB2050.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:392::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.13; Mon, 3 Aug 2026 12:59:42 +0000 Received: from AS8P189MB1672.EURP189.PROD.OUTLOOK.COM ([fe80::f147:85e5:34de:eeff]) by AS8P189MB1672.EURP189.PROD.OUTLOOK.COM ([fe80::f147:85e5:34de:eeff%4]) with mapi id 15.21.0292.012; Mon, 3 Aug 2026 12:59:42 +0000 From: "Adarsh Jagadish Kamini" To: openembedded-devel@lists.openembedded.org Subject: [meta-oe][wrynose][PATCH 4/4] thrift: fix CVE-2026-58389 Date: Mon, 3 Aug 2026 14:59:22 +0200 Message-ID: <20260803125927.831690-5-adarsh.jagadish.kamini@est.tech> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260803125927.831690-1-adarsh.jagadish.kamini@est.tech> References: <20260803125927.831690-1-adarsh.jagadish.kamini@est.tech> X-ClientProxiedBy: DU7PR01CA0047.eurprd01.prod.exchangelabs.com (2603:10a6:10:50e::24) To AS8P189MB1672.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:396::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AS8P189MB1672:EE_|DB9P189MB2050:EE_ X-MS-Office365-Filtering-Correlation-Id: 1b1ead74-9e4c-4cd2-1009-08def15f15af X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|23010399003|1800799024|376014|12006099003|22082099003|18002099003|11063799006|3023799007|13003099007|6133799003|10067099003|56012099006; X-Microsoft-Antispam-Message-Info: lG6farCqWr8XuVognUJOcz4Kadl6KNOQM0rdDsSYpneVSPWmQhMFWo06RBbvJX1BWuWf8b9KfXEi8zP9o/6sHsUigPjjsYpheuIqZyvTTXeaKtC0PgalG4hUpm87wTPos9huu4X/wWdxDwB3Na/6FVOeKHGf4Gzdx7vUZlxUmeMWK/L5i9bbmXEtZWErFiHFVmoB2v65cguV/ZYsJHypgtdZxbSlvLjhnf1JlFfIsVqkPaCwDaL4r49lX65n0PQIxi4EgZkTABJlrfCYUyOXD4QL52SNtLiLjPtO6YRRvaluMiaQzKPgb9pMzBk/hGki+DvQSMC6qgxHckrtQTdeW12i1edlkLHhADT5qyKhvhonMumFpZwtFzW6eo/TCONWxmT5fQgvhsw8CrbIV449d8qDmFgkY+vfghRdpnkXLdxZtYCNDqVAw1LTireoLG/JEkMXxYljnsrIcyJsK+QnkXWPAlhWAFCim9shLa6dH+fDtI7AV3U69UrNIbmgXWSq02SK6latDH7RF6VUWGThwzgk6vyPb2GOubgmQn7nXxbuELRaz8jXSSRCjbrQn5e0Aki3IL/2TExFyCxtUgr789oZNbd2kaQlHBD9K/Z3PPFaSLME3MVguR0FdtNuLvz20w81s6nSag5M+10P0U7Z1umbc/LpDCdf2EV0OfRtteI= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AS8P189MB1672.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(1800799024)(376014)(12006099003)(22082099003)(18002099003)(11063799006)(3023799007)(13003099007)(6133799003)(10067099003)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: XkaB9qQLRqyj6muLxeilqBM9bnRrzLsLKXRod48GlLalaJih31Ott40oEZgBMSJroU1k6ZaorWK7YU/PZiY9F2k91JGF442f+4Un7AB+RrSnJlYRR5cT4wpffGP4iH3FPceZfdC/E6ilWr+nmB4sVmTDqXAFckpFrgTGkUm/VpyQS52ebOk57woFIMrNVdAHx0dtYcwNix0h56lXM0ea8157Sm8xKaow1NNGL3oqTafAGOWeZ4o2mj8lLUpIsUachSkML86iX13EsJYQuyRAoUuapjatiNMsYCFJj4siYBmxiPrZ8LfcM1uSELqrpjXv/JzoYiabsiXwFBkDnaDIZKewmSyVe8KkBiNg9aWrOGwoO4Eh2oBfMHgLOIL9f5BTzdzKRtuLImnX8BtP7wxUpzSFYwdSy5hsMHDg4r6f48qH44Pqe76VSPbQMb1hAd2OepjsUyVqAVIY2oqc4iHuR9jO8P8MgLW81GvPAHjKykqYrWwvQ9O0yxAKMQyrmMkJlROLPOCGEblhzpjgvyZm3/9viOsqC3eZQd5ipwBOgpWMeR773fLIyGK0pkFNngBP/o/xp8xPwzraT4tCmy862IJAx1pUllvaSLHSvOFlfi/yY414zh/y97lle2i1T/f3NgUVTib9vn9SttB2ZTH9VDPN3xO0N9JZk++jbR88cMlYBeJoD48byM1k4emxd9Xjza8G8nIxsa1C+uPJkIR6yi+NsxOr+ZjhVBNqHwc4toR6d4Ppi0MVAwUu7/bohUKqI2VMRYM5JDL63a+kiGzUf2YZit6g2j17XcwJQjpKdMT3/KvtRH41n++LuIbtf6BKgfTwB0vIUA47OuCLOwYBBR5BsDi2iUwy657dmWXD6+3vAVIx2NvvfTXd7JvWoIxtijR7th01ePbWUtlSbUSwzM1YHXn1wvtMuzlQ+r8ha120GVewq8O5NBcYV46GPmmjFKWv2/2EJheLXj8FJMElx/qdTilyjL6WavTzWMPPOCi9QmCR8MLmJkMxfyN0llXLShvhQbdJ+Pekhe+udFwKOPjfz8oPScyLs9u3pAtkWxfz+lGNIb3hVZ+6y3LD1Ts1j3KQYte1oCtTA13GiU0M15smuzN97p3dmv8M/DihlokNrS4pzub6TiW/kavtWgM/RpRSGndAM5mshoa6pTCiQ/k4ftyPe2g7ZUChP9KUjlqxQ92PFrkn4BCYMZOqxb37o4ri/pLi9Gl0JFXx1bKaaTpLZsD59Bq4YfLiqVVdcNOuZt2KcOpT3ja9UqBnoyBVcCYkaFbz8IdhmUqsnzDsKgwVPhxlxodJc/E1oKO9rF55B/Ha5j4oBugnJJI0dv/bv6OxeY8LyWIx3Ve0EsukzBG7dMLqdNV9Zr98P+LMI+osXXcNMhF1vMNgepk5LUZyuIkkjVwAPlIJmLHWEXbxZtOnOOpUa9Ut0ZjHElBf0kxII60OYjVV2w0VgZO3MM5OGTdIPLmXXbupDEJaGiOehIzH9girFvJsqA54a5Pq0JwwVL6+tDaoQ5F8Rq/PVXXnvm0BzEl2dRfUu2xzIjYOgQKniKzJXlfS7Th+e9Det5/rrAy6pBTEdSx/yQMiJrHlLv74V32O7+hf2Znp5+tc86Lq7o4FkuA/3FBGlI4WJMl5eD+gh4pT9LeAUvqHnf7dtBMUVvUVHVHB9tkjFYADoKfyEZzEa9wcAVlGG+DREpThq+YpRmVv1o4NZpp6DWdng1BFsZjsfNr4xFxXR/+EmIPLDEw2Llpml/OLf/ETrwUZ044fbeKK2UJpcg3j6dt3 X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 1b1ead74-9e4c-4cd2-1009-08def15f15af X-MS-Exchange-CrossTenant-AuthSource: AS8P189MB1672.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Aug 2026 12:59:42.2148 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: E5gZkoul+v0VRzi5VNBXX5XHAceFGtezsK/s2jJAnkxOZm5BYcr09pDS0POBoPVPWAuD3IACv2s2NxeHUMmbOubZAiylRtnSMPvdzQqF/9g= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9P189MB2050 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 03 Aug 2026 13:06:44 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/128687 From: Adarsh Jagadish Kamini Backport patch to fix CVE-2026-58389. References: https://nvd.nist.gov/vuln/detail/CVE-2026-58389 Upstream fix: https://github.com/apache/thrift/commit/0ab16e3a83637711f4e0f788c205f66576fd0a55 Signed-off-by: Adarsh Jagadish Kamini --- .../thrift/thrift/CVE-2026-58389.patch | 93 +++++++++++++++++++ .../thrift/thrift_0.22.0.bb | 1 + 2 files changed, 94 insertions(+) create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-58389.patch diff --git a/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-58389.patch b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-58389.patch new file mode 100644 index 0000000000..964a20b793 --- /dev/null +++ b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-58389.patch @@ -0,0 +1,93 @@ +From 44c46c076527db5a4b97c55f09a6f73ab9443cee Mon Sep 17 00:00:00 2001 +From: Javid Khan +Date: Mon, 29 Jun 2026 19:51:49 +0530 +Subject: [PATCH] enforce max_string_size on non-strict binary message name + + +CVE: CVE-2026-58389 +Upstream-Status: Backport [https://github.com/apache/thrift/commit/0ab16e3a83637711f4e0f788c205f66576fd0a55] + +Signed-off-by: Adarsh Jagadish Kamini +--- + lib/rs/src/protocol/binary.rs | 61 +++++++++++++++++++++++++++++++++++ + 1 file changed, 61 insertions(+) + +diff --git a/lib/rs/src/protocol/binary.rs b/lib/rs/src/protocol/binary.rs +index 596285fb9..38f528571 100644 +--- a/lib/rs/src/protocol/binary.rs ++++ b/lib/rs/src/protocol/binary.rs +@@ -137,6 +137,17 @@ where + // is the message name. strings (byte arrays) are length-prefixed, + // so we've just read the length in the first 4 bytes + let name_size = BigEndian::read_i32(&first_bytes) as usize; ++ if let Some(max_size) = self.config.max_string_size() { ++ if name_size > max_size { ++ return Err(crate::Error::Protocol(ProtocolError::new( ++ ProtocolErrorKind::SizeLimit, ++ format!( ++ "Message name size {} exceeds maximum allowed size of {}", ++ name_size, max_size ++ ), ++ ))); ++ } ++ } + let mut name_buf: Vec = vec![0; name_size]; + self.transport.read_exact(&mut name_buf)?; + let name = String::from_utf8(name_buf)?; +@@ -1227,6 +1238,56 @@ mod tests { + } + } + ++ #[test] ++ fn must_enforce_string_size_limit_on_non_strict_message_name() { ++ let mem = TBufferChannel::with_capacity(100, 100); ++ let (r_mem, mut w_mem) = mem.split().unwrap(); ++ ++ let config = TConfiguration::builder() ++ .max_string_size(Some(1000)) ++ .build() ++ .unwrap(); ++ // non-strict: the first 4 bytes are the (positive) message-name length ++ let mut i_prot = TBinaryInputProtocol::with_config(r_mem, false, config); ++ ++ w_mem.set_readable_bytes(&[0x00, 0x00, 0x07, 0xD0]); ++ ++ let result = i_prot.read_message_begin(); ++ assert!(result.is_err()); ++ match result { ++ Err(crate::Error::Protocol(e)) => { ++ assert_eq!(e.kind, ProtocolErrorKind::SizeLimit); ++ assert!(e ++ .message ++ .contains("Message name size 2000 exceeds maximum allowed size of 1000")); ++ } ++ _ => panic!("Expected protocol error with SizeLimit"), ++ } ++ } ++ ++ #[test] ++ fn must_allow_non_strict_message_name_at_limit() { ++ let mem = TBufferChannel::with_capacity(100, 100); ++ let (r_mem, mut w_mem) = mem.split().unwrap(); ++ ++ let config = TConfiguration::builder() ++ .max_string_size(Some(5)) ++ .build() ++ .unwrap(); ++ // non-strict: the first 4 bytes are the (positive) message-name length ++ let mut i_prot = TBinaryInputProtocol::with_config(r_mem, false, config); ++ ++ // name length 5 (== limit), name "hello", message type Call, sequence 0 ++ w_mem.set_readable_bytes(&[ ++ 0x00, 0x00, 0x00, 0x05, b'h', b'e', b'l', b'l', b'o', 0x01, 0x00, 0x00, 0x00, 0x00, ++ ]); ++ ++ let ident = i_prot.read_message_begin().unwrap(); ++ assert_eq!(ident.name, "hello"); ++ assert_eq!(ident.message_type, TMessageType::Call); ++ assert_eq!(ident.sequence_number, 0); ++ } ++ + #[test] + fn must_allow_strings_within_limit() { + let mem = TBufferChannel::with_capacity(100, 100); diff --git a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb index 882e72442a..0128de8519 100644 --- a/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb +++ b/meta-oe/recipes-connectivity/thrift/thrift_0.22.0.bb @@ -16,6 +16,7 @@ SRC_URI = "https://downloads.apache.org/${BPN}/${PV}/${BP}.tar.gz \ file://CVE-2026-55971.patch \ file://CVE-2026-58023.patch \ file://CVE-2026-48144.patch \ + file://CVE-2026-58389.patch \ " SRC_URI[sha256sum] = "794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5"