From patchwork Wed Aug 26 08:06:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jakub Szczudlo (Nokia)" X-Patchwork-Id: 96396 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 15E15C61DBD for ; Wed, 26 Aug 2026 08:06:43 +0000 (UTC) Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.7]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7575.1787731594429831850 for ; Wed, 26 Aug 2026 01:06:34 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=hVCi5VAw; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 40.107.159.7, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=S3jnGKPRe+I4EYABfW+rRgNL2iuEAie6a6IAJjjO9EwLrTiofzH3vBPcQGtFwK9/PCks2R/b/hkdkI0po//R4f2EbZMLV61QM4QiQd7fzWhJ03a/RZgC2Md2UeR3oQZwcOntAmXF7jVPA03SRAXcUxNbWf6REV2eTlQwsV/91HPayK6Mna/RfF2uWRmxlFbw0gu9E4idmXLA4oeTMddeze6GSFpnyzvWMncOpj58HapdLJ9Gt9O8PiqAOGaeg++apEe7akPKSENJtq2L/fMVpVvow4a8GW7nogEq2gry4p9FgJOQDUUYnjkC2lEymkmYEoCyxNRaU/BjdjDF3S+uFw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=rCOjUJOsOJzhH0omHFXBmLsFdzDWhFXOKPwnnrtEI2I=; b=ccUs1BGjXjqmlZ7Q8kb56G/V+uJPiB4La4zrvA63pNbYeifRUB/gdUG3uT4KqpvZjPiM6iOJLUVaNp4TbejCJTQ14SDKp8V3nW7SMJCFrca7iltfnUB5RotIwy59+ecRZBmnJ800kvPGLwExy3FJH81/qbXUxTRGb+tVp77fqCYC8D7e200OccJ4uVk7CfjN56EUr+5D8wRSW37pkywssKg8/wCi4b1TA5sxZoiLUIKq6E7nWROmg6hxfC+0/0G5T6c/j2bAcVrVM+ImxvUd6lxd/Na0N4PlFGE3C/E17usc8R8Nbyk4q+07FSDYs5WaXxkMtvvHXwt2gTaDWR8m7g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rCOjUJOsOJzhH0omHFXBmLsFdzDWhFXOKPwnnrtEI2I=; b=hVCi5VAwEhkEJ0PhiMrdMJqMNe5EErDJ8yihDsatG/hYwOf0k3DV3nX+ib9txUhUh6sZmBUBfDJ13JUeA0cBxwHL4+bn4jUtwVCBxSRPKbZQe7hGvXgoVTer9NxekOqTUIjP+gzajpiTGLXh/QGWTaLloqQAfKViDZs/I5CraaNX2KJ0C/oWAT1l5m3odXi6kVuCmXCW2vnNF1gfvbI/EmdSJEnlxi2vzqanNHurnJ+E72zV4kmFF6rIZSqY0nGFiHW9ymRzu8bNY1aD91aycs1efOI7mMWCJdDeT5d3wt0ZlzX39pC+ahSpQvSgjBvkw6CkVOH4Kc0JHGdoRjwpWw== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by DBAPR07MB6662.eurprd07.prod.outlook.com (2603:10a6:10:180::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.6; Wed, 26 Aug 2026 08:06:30 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0360.005; Wed, 26 Aug 2026 08:06:30 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [scarthgap][PATCH 1/2] gnutls: fix CVE-2026-42010 Thread-Topic: [scarthgap][PATCH 1/2] gnutls: fix CVE-2026-42010 Thread-Index: AQHdNTHNiCLsjsiyzEa/V6VwOnDrEQ== Date: Wed, 26 Aug 2026 08:06:30 +0000 Message-ID: <20260826080602.17100-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|DBAPR07MB6662:EE_ x-ms-office365-filtering-correlation-id: a5847f06-9a94-44a4-b09c-08df0348ef8d x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|366016|23010399003|376014|13003099007|38070700021|10067099003|11063799006|56012099006|25016099003|29003799003|12006099003|18002099003; x-microsoft-antispam-message-info: 4CRrQTjHuv5BKpGMG15cPNRTL3spwZ1q0UFvEO3J4gHLWw8cFyEbz/RKCFkt+e8C5vmhG+hyjuoiJkXFWH/UydsNjVTSrz82c32rj1Xxr3wWgE0eyW/mjGEWpVFomO6AuVLIWB2pTEi738KgesD+L/ARxeJ+Jx4/NtqV/jFCngp2sXrXjJ3J/abcNnfhTzLHOdQ96in5gYdcjBl0eTvUySz6GbP+1Voyo1FPo7uWGHS5lR2z13sQmDkNCQT9mNzlq2As+8ndf5vpuInhwXhOkxTcI11cFJ77Fj0FFlitvmd+YWe4ND1sr56J9TmmG/h8JYVU5My6qGJswcaAgKJiN/YO3HEOD1ZKOVWNxhrw/0w+iALo6W5Sv6HDVRBufrVZbAyjSCxMG0Z7z1FkEIJ9St83zlA7tFmSpbe3keJul1WAn0NuBp3Ovahv2jv7gJrdQPXKF/b1lrPVIQPHLsXLwJi8lHg5W8USGDnGkodtEt9s66pY6pS2dg8oCMSudDTrZ2yrTUJKQlCjxrVv6Hgqz8z/OeqcnojPZQ6j4UhJgzC50x6QVnvorSimPfEbul6CxP7jnS7dT6lzrrXQZd8rdz460T0ZvxKTJBST4QDR/BEHFYDPqqB0PfSBMT/kCrflhpNH72Z4B/dpL8E52RxKf6Y1Hve+MR+acYrhFmTocnKmhf5QxsW1Kwc51HY4Myy9EJbfoI9hrc05VdqJaoJSYD9BUH+FANF+fR5wNptg/Ss= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(23010399003)(376014)(13003099007)(38070700021)(10067099003)(11063799006)(56012099006)(25016099003)(29003799003)(12006099003)(18002099003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?q?KNzjJtuh/SWjbo/MxSl0Exv?= =?iso-8859-1?q?rjEuaLRAzMh+oWNhwlmulwBSCS83gw9UlM2OSg6cBfuQIcJUVWT7+VaiF1+Z?= =?iso-8859-1?q?79KzMdCCPgGwloZtXcc/7gNoisL4Bxux9Zjiqpe0aeoOA17MdMp4YNQNtgwb?= =?iso-8859-1?q?g4CMGjju8dQImQm7Q4okXOSnbSzfwELn6ZPujDv44ta6Scgucn2mEJnc52Zw?= =?iso-8859-1?q?e9Tg5YsunvH/w5ZkAu/2ehI4cIZWWZSyo4TR+oVzGwEJ/90+D1pxZtBa+t0g?= =?iso-8859-1?q?nZ1ziGNi/g+K+lLEa+ky7uAXsLtmIjlJCappc0JlV/izx/0hBwqW/ZdynJAj?= =?iso-8859-1?q?O+LATiAh9WVeL4evv/xgMjtJZYmkC5EIhUlhu1Tc0MeTzfIAPm8riRZd5Vle?= =?iso-8859-1?q?MMYq0dY5/iZr7QPUsCaSTnvgZtyOT4loGgMz/Z02TiuJoHOQaUVcDf4b8BnL?= =?iso-8859-1?q?hBC2x0beaGejaGqpZd1fEKPT4fn7TcGrt97iztJ8Jw4lurGq8//GRKDeM3JZ?= =?iso-8859-1?q?Bt+rukCedo9dyazjfzyYG+erEsnyLZMZCHFhcw20FZqoiFy++HIrwxoCKHXb?= =?iso-8859-1?q?+gWXRyfqilqz2mRbyDjtRHTyKlMtCWjKherzT7wSwgsfS/Pd7NcJoWD81VGV?= =?iso-8859-1?q?n9YEXvqO8dMXGXiKMoxZGPbZOlgWX4gSV4JtHoshPKGiIQTOjJTXBn0lEhNv?= =?iso-8859-1?q?skSstMhRDrkwMMzDOyKampnuW9YbOE3WRGCdcXNsLgBtviDkIVwt1K9yi7gz?= =?iso-8859-1?q?pRvwDHZzT3VgaeUdzG0G1iXiHVbnDF93mPaFpzrW5+tnSLWmbltWyJBy5yrq?= =?iso-8859-1?q?gzuTOOTDKPPehfVBITtYH2BJYj9z8WvxpBxuUwrL2tdQruY86fl2i6j+HG8I?= =?iso-8859-1?q?561SNqLrFD8MJa4iojWwkehO+FN0+08mwi5O/sevexXSQhNH3fCGt+q5PbrI?= =?iso-8859-1?q?WDcHwkg+UCIsmXQUceOHZpWNHdX5o/K3xBQNAyo0wBSSmXc6t/tGa4goptrX?= =?iso-8859-1?q?Q7Kg2ruUyTIUKDdxABHr635h4EK8eCpJxsU/RjsbyX+kT3zdpNS1WTvg2Ycw?= =?iso-8859-1?q?LdXFZH0s8nxtB0Mw1bh3DrPidS2mSpi9TswM2IeeVMsxRrftAt6nYPx5KWlb?= =?iso-8859-1?q?J8bapP9Pr7xnnYUAptE/3qkQwPZ3aRFCepYe/wzyKNXLYt/OF3QkttRexbCb?= =?iso-8859-1?q?MxBWbb4h6/7na8c6PHsOvqeZM+F8yVvcfqTGL5QmZYC/pa1taWu6NkCasoxx?= =?iso-8859-1?q?HWhK2sly+Uizqn0af+gBklcqnTxxdA2T/f4H3VR2gr2Jx2FYgG5Yclv9A79Z?= =?iso-8859-1?q?ouYHSD5rHTRA3Xnbmgi0bGG9oIqd+tEccUUEUwIWd+MyiMSVq90NxsztGTT8?= =?iso-8859-1?q?qpX/43TaQC6n1RaK35k62LIrJP0Ej+z5Qf0sd1ZHdbEsUN2C19PjAV41/YbL?= =?iso-8859-1?q?AVqdbFvjCBP0Fzd4y7roSx/gKoKJxivurpGyDQCp+umRXHhwfuc7L4RQRRCs?= =?iso-8859-1?q?38vZ7GYrus48wGgNjV0AEIKNFFOH14cz/XA0TNUgxB3jTBr4IfN4ihUW8tfd?= =?iso-8859-1?q?diKMeJrR8R1B312L3NNniGxODMMZ0rPBBVWGvS9xTCgvqUDC5a7ZBiEA4dYc?= =?iso-8859-1?q?q7tM35Mn05FPelRof1LirDVOqkVwlAoSyT3c5gMubPwHzkEejF96IfeQbouB?= =?iso-8859-1?q?N/IBNgcfE2eZLdPgHxnKq7DIHML1vLW8vH9iQx9W2tS5KRFxefJwGHqdV2fT?= =?iso-8859-1?q?MAdhQkhKlzhCfInD/dyNzlwQw0/8eMcrLB8Xlvsn9pwOdqw=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: a5847f06-9a94-44a4-b09c-08df0348ef8d X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Aug 2026 08:06:30.1082 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: eXaSE1jOhE1GugMbS7a+Qc28HPx+kiaoJBwZ0+qzgTKLdPOOCLnGZk8k502i2mtlkIVpxbpAr2FAsOkk0tvoWhEHk3EgFS9cBPlOOi4l+AA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBAPR07MB6662 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 26 Aug 2026 08:06:43 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244325 Backport patch to fix CVE-2026-42010. References: https://nvd.nist.gov/vuln/detail/CVE-2026-42010 Upstream fix: https://gitlab.com/gnutls/gnutls/-/commit/cb1833afd9b6309563211b1c0a7c291f52ca98d5 Tested with ptest Signed-off-by: Jakub Szczudlo --- .../gnutls/gnutls/CVE-2026-42010.patch | 41 +++++++++++++++++++ meta/recipes-support/gnutls/gnutls_3.8.4.bb | 1 + 2 files changed, 42 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42010.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42010.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42010.patch new file mode 100644 index 0000000000..b94a32afff --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42010.patch @@ -0,0 +1,41 @@ +From cb1833afd9b6309563211b1c0a7c291f52ca98d5 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Tue, 21 Apr 2026 19:26:10 +0200 +Subject: [PATCH] lib/auth/rsa_psk: fix binary PSK identity lookup + +A server looking up PSK username with a NUL-character in it +was wrongfully matching username truncated at a NUL-character. +Fix the check to compare up to the full username length. + +CVE: CVE-2026-42010 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/cb1833afd9b6309563211b1c0a7c291f52ca98d5] + +Reported-by: Joshua Rogers of AISLE Research Team +Fixes: #1850 +Fixes: CVE-2026-42010 +Fixes: GNUTLS-SA-2026-04-29-4 +CVSS: 7.1 High CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N +Signed-off-by: Alexander Sosedkin +Signed-off-by: Peter Marko +Signed-off-by: Jakub Szczudlo +--- + lib/auth/rsa_psk.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/lib/auth/rsa_psk.c b/lib/auth/rsa_psk.c +index cc92b4aa96..27caf18769 100644 +--- a/lib/auth/rsa_psk.c ++++ b/lib/auth/rsa_psk.c +@@ -321,8 +321,7 @@ static int _gnutls_proc_rsa_psk_client_kx(gnutls_session_t session, + * filled in if the key is not found. + */ + ret = _gnutls_psk_pwd_find_entry(session, info->username, +- strlen(info->username), &pwd_psk, +- NULL); ++ info->username_len, &pwd_psk, NULL); + if (ret < 0) + return gnutls_assert_val(ret); + +-- +GitLab + diff --git a/meta/recipes-support/gnutls/gnutls_3.8.4.bb b/meta/recipes-support/gnutls/gnutls_3.8.4.bb index 676c5c6f94..eb66bfd19d 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.4.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.4.bb @@ -46,6 +46,7 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://CVE-2026-42009_p1.patch \ file://CVE-2026-42009_p2.patch \ file://CVE-2026-3833.patch \ + file://CVE-2026-42010.patch \ " SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b" From patchwork Wed Aug 26 08:06:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jakub Szczudlo (Nokia)" X-Patchwork-Id: 96397 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id EE63FC61DC7 for ; Wed, 26 Aug 2026 08:06:52 +0000 (UTC) Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.41]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7578.1787731606841660291 for ; Wed, 26 Aug 2026 01:06:47 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=DYbDrZNd; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 40.107.159.41, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=JEUh4ijMacwj9AGOfjO4NJ5Wi+D/eYhifw09ClT7U7EPZbB5KOA0VFECFxUGqFknxN/26c/p2r3WjvsK46936lfEWDH/nAQtv0n1fLwD8eWX+jL7/AoSUelO9NiXoRAgyXByMqe6+qUAxUYE6RVP7CpErQWpkGf4d89BIbZOtL5o27hZYETfD82QUMh9NkdvN40KPfleBuAPcisf4fAcdfqIBauzyVNaj27oCaM5Ec5VLzbqf9AiAb2CUsWFfZ+uyhEBj28owzpLIz0tiGLkuetKIQehlDp3CNupvWKW65PIlxMBWpmw1I6MokJUXOCZcQ5IFLNFEKLcpmnbPYmvcw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=OOnfuBtYgNHSIsnQuQSzreRHYsy+x3f9Iub1tXHgmqw=; b=GvyiRBYnImobFsl96y7QVIenk7X23sGqIDXetm+HUVLkhyUe6AMyv/OmRpQtgAD8PakvrTl9IxNxwtBNMWEf31CX1WqbhNNNf1pIb7DiybRLklZomlYxeZaBDXzky1rqTgBBiSzSNo7VRqq3e1pRzraXQxPfKVis6VaOZ+KpXC9EWPxs/uBRTqH/4twCMx0OA/95OIelpj9hQxPrmWWPwow7aKWiDmxGBGQDKy2FyiZNhfvKrDp7kAGMhxGXhAEQc/vx394OdAQsvG9ADQEGYeY6hEh6xDRPpam79FeTwNlqwdw7ykfDn1/+wYG+gHSllR69SBy8ChgF1c2rm6t9pg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OOnfuBtYgNHSIsnQuQSzreRHYsy+x3f9Iub1tXHgmqw=; b=DYbDrZNdOSaXmTq7LrXkUjNoXz5uo5qjihOhpj7xhgLX8s5bsmJKVhDf50JNSNmV8Gm6V8JI51zuS1H7isywjVhYFGMI/zTrBpiEB+d+aBz/PBkBLs6ZTY9VfJ/eZdSkv4frdlNTcmZBm10mQ5qAC7uReUx5aTDnEuq45nS9G8Md9zR7lj+T1xaNc+yGunFhxjCx0UzzDa44FdJxnfCiU4r1EO0KQmBMUKWPMaygJfK+QVFlAeM/fMAKNXk5CA4vsA7gr6BD3froNV/DmECvOeFRVaYpOXZy5xR6KeRF2kFMv/+KSLCBOy48YI4sw2NExKhMpN4dx2pd6+d+txOGlQ== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by DBAPR07MB6662.eurprd07.prod.outlook.com (2603:10a6:10:180::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.6; Wed, 26 Aug 2026 08:06:42 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0360.005; Wed, 26 Aug 2026 08:06:42 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [scarthgap][PATCH 2/2] gnutls: fix for CVE-2026-42011 Thread-Topic: [scarthgap][PATCH 2/2] gnutls: fix for CVE-2026-42011 Thread-Index: AQHdNTHUDs5v+Dfbe0yqacTN5D+pTA== Date: Wed, 26 Aug 2026 08:06:42 +0000 Message-ID: <20260826080602.17100-2-jakub.szczudlo@nokia.com> References: <20260826080602.17100-1-jakub.szczudlo@nokia.com> In-Reply-To: <20260826080602.17100-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|DBAPR07MB6662:EE_ x-ms-office365-filtering-correlation-id: 4912cc8e-3d04-4ecb-f00d-08df0348f6dc x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|366016|23010399003|376014|13003099007|38070700021|10067099003|11063799006|56012099006|22082099003|12006099003|3023799007|18002099003; x-microsoft-antispam-message-info: AQXa7gkDPgu2tkxi6lSw/wWomwmmE85hC+uvbfe60VBSceUIJO0KYiczpC7Bqvdk3Dm2toRP0q8ZZRLTy0mrcNr4/6XFaCGJhaNoIL8gGbr7dUQvAp4ccjczAQqWSo4jwuBBlCV1fBFZe6nSFW3GIy0CcBMUNWca8vEikcn0jAOUhYSpT0d4SCuzNvnxTIJMYBqvCxKDL461ctJkrO1nvJR+lCcjz+uOIGCaVGdhePqvRHccTB0xz47BuhWkg4VN1t2vEVN0cs4osfkTmQW41w5n2+ACe1VGzJSWPoPqemHjK/gCSbOYr0hYxGr7Cfsw1DEVBi52CuyM91Vwd/P1rsKJ5LVdSWVQKwaIuXSZoF3rpU/ziGSFdDpaF1KGWFZRDkoSE58tUgUO2QHpfqTBqRa/ImpkAzOaszFYhAAmAL65vxewZg7O0Gu59Os/+GIm4TOlaaJh8+PnXa6iUSqbqEIleU8DFQXqC4zbKAUQ6HJII99LA6HBJnrSGsjN+PZcTu5q5ta/stBHLciHnOKd5X4EoVBZKipyytQAfdCuLRAEpl4SafA9EF8Dvn9A4mDPbsopt/5R99MKgZatP6M9Urez/FRd6kMCTFTTlQK/BIkwovbwQDS04/xsEvc0Ynogz1LOMKhQB7qwxof8v1YaDR9m+X8CRq8xG+eQouN2DTaQIncSaH4moYsSl0T8O3Ra53VPkIa/40iwalD8CUMKHVqALsyKnr/Ve0hUMQ8nL/0= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(23010399003)(376014)(13003099007)(38070700021)(10067099003)(11063799006)(56012099006)(22082099003)(12006099003)(3023799007)(18002099003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?q?U70y7p8jrdGGl8DSdZkcIVk?= =?iso-8859-1?q?CnK3HxgMS5eutPUGV0Qa6UC+dI3w+haFrTkENlRCU06IyM1xRR6au+++5cr2?= =?iso-8859-1?q?vmG/P7BUzf5CDRWYuD4pqYBJg7IYSYwRxw/lHQLqgSvLcP0UKSIl53Jco8Z4?= =?iso-8859-1?q?pj/hRS3g5J4NxigSp4QzBbjCzUEy0K/skHFmC4cE9gayyRbRurFQoSIGPMU2?= =?iso-8859-1?q?nvNIhx2PT60mxZyPCnuPxI2EC3eo3f/p7Jo8NoemdzuR0FbzhGoSJvQReGEQ?= =?iso-8859-1?q?Kip4V/3RueIKO/jq+DFidw1EofLTjWqpk8BCvGHlkExd10r7puCJRiGEWZjW?= =?iso-8859-1?q?vhDIzL3nEFa4M/HleI0h9K73RNJCPcjWdG+hrupHASV5NFvSzovzhsLAvoqS?= =?iso-8859-1?q?IC2coFCCWcllw8xhCSYREGUavW8vD5yW4VEvwoITRnc4L9jbji+SZ0oQ7UPX?= =?iso-8859-1?q?PD8ka8EcnxwpmEFZf7X9x9ymp8BAvMg1RurSyqhPOqpgNqhgtCMCg8fYpaoQ?= =?iso-8859-1?q?UyhMuEPR5aPWLnwk8XCN2Hkp/88FAA9qLIEHwXUxG5lLSUqGWR/HDMonVxBm?= =?iso-8859-1?q?mIiWmb/xAYyHUScWZq0YxdL4YfMMIAU8ZKCb7+SJbjgZwbUPVOfhaTtTs43R?= =?iso-8859-1?q?w9ZEB6dQHG+EcOF97eJNFyMzMo3hyr5BDcNBAkHgbNgmRbrsrE7DJN1R/BqJ?= =?iso-8859-1?q?ZjQfoAZEUGz+0G5E9b1imtHC4JjumYK1Ah7lHNeNQXo729SAg5o2D3xq5ucy?= =?iso-8859-1?q?reNPctP+Q/kn+E68/fswx9//CuO7eTrY30ia08DBhKqGUMH7ITlYHP8evUZp?= =?iso-8859-1?q?yDLF3b8veAgVOd0pJ4hzcXdfFkvx2NthIpbR0bRyuXT/9tH8hDd8k+WI7uxa?= =?iso-8859-1?q?e5h223UQQQC2ajHmUJMVezUdF1AUCheQ83DHXi63OQ2sdo62f5bDQ69YGLVN?= =?iso-8859-1?q?69LE3+DkxGvA+7GI9RlnsiXkeKeDr2rZD9TN0ZS1Ld5l77N/lEu54Slxid4N?= =?iso-8859-1?q?PK3Un85It6adfgHxdRL5VdGKat8g+JH7BLeB5QFWcEgbnwV57sy0zg1/mvqh?= =?iso-8859-1?q?q7BkjrbjekSuKvjYYJUMQqH96aTcYk1i41wTwvZDsrRILBkz2HehsI6Le/w+?= =?iso-8859-1?q?eqY/SKDbaoLaZPrqP2cZjQ1F/2DSSe5eJDR7qCqQBtahEQqiaQWJMcbmAMPF?= =?iso-8859-1?q?xY96wEQrq725/mcTQo3waaN+xPCB7D5+rHlZOwTHXEsMP9yLIE5KXAj3uV7h?= =?iso-8859-1?q?wVaduE6Zm26Ki7qMxpDEOGcWPWAoaTYuxi4HH47Z4cdc2Vc6aeGIuF8IJVd1?= =?iso-8859-1?q?nBPOyjuaQcD9wRa/1vExM6cnhHOloykkPVOMSwKlJm3WX8oDPdBN8NOnXB2M?= =?iso-8859-1?q?aySX8ggk5zG4v+0wKh8qHxPQpc7oa8/2dNmlaUvtEvowEEORQ9x8R47H1sJ1?= =?iso-8859-1?q?hqx9mPYsLCyCnCUrNygyPxAaqq4HhU60VkAdIMnHh8/JQytvYEfV6FCeP2vk?= =?iso-8859-1?q?Z3nUzZ/OAT5W8GC2LKD22JXRmGbmS9nCOj/WNA3jHD2s5eZ+CaiEDpC/4J3o?= =?iso-8859-1?q?RWjUhL9eKREoo1i59W/EfCVcbX3iL0mOMwDCKg4h9DbDquTcmXgyAluRDRii?= =?iso-8859-1?q?uNcUVy0lNXASG3IK2H/rqrc4XHJKQ/1mKG8kjG+GoV9B+0ndAgujgL1RDr9d?= =?iso-8859-1?q?/lWQ+7C5M2cZSzlQYfwsyh4WdU6DvDKdQb2Bx8q8FntAKr8/sISc9NpTzqhC?= =?iso-8859-1?q?ei1/eJvm1gStAwXLqJZCq1+h5eIOcQG6DGh9oyV/Giu1JWw=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4912cc8e-3d04-4ecb-f00d-08df0348f6dc X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Aug 2026 08:06:42.4069 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: vFdAPMq2/2fffTLVaZwBsyKMb1pnwXWlmgVLeItywuuC1WWATUWiBnXe+wGZdm6jMsKFEQKgBYFfWPDBbp1HeK7nMmbskOJvC+uMMcO/gmY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBAPR07MB6662 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 26 Aug 2026 08:06:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244326 Backport patches to fix CVE-2026-42011 and extend test for it References: https://nvd.nist.gov/vuln/detail/CVE-2026-42011 Upstream fix: https://gitlab.com/gnutls/gnutls/-/commit/1dead2faec6320aaba321eb56f20d442df192b83 https://gitlab.com/gnutls/gnutls/-/commit/24713b8c63137ce0665b495d22ccce4f5ce05c84 Tested with ptest Signed-off-by: Jakub Szczudlo --- .../gnutls/gnutls/CVE-2026-42011_p1.patch | 43 ++++++ .../gnutls/gnutls/CVE-2026-42011_p2.patch | 141 ++++++++++++++++++ meta/recipes-support/gnutls/gnutls_3.8.4.bb | 2 + 3 files changed, 186 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42011_p1.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42011_p2.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42011_p1.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42011_p1.patch new file mode 100644 index 0000000000..62a9714c6c --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42011_p1.patch @@ -0,0 +1,43 @@ +From 1dead2faec6320aaba321eb56f20d442df192b83 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Tue, 14 Apr 2026 17:41:30 +0200 +Subject: [PATCH 1/2] x509/name_constraints: fix intersecting empty constraints + +Permitted name constraints were wrongfully ignored +when prior CAs only had excluded name constraints, +resulting in a name constraint bypass. + +With this change, they are taken into account and propagate. + +CVE: CVE-2026-42011 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/1dead2faec6320aaba321eb56f20d442df192b83] + +Reported-by: Haruto Kimura (Stella) +Fixes: #1824 +Fixes: CVE-2026-42011 +Fixes: GNUTLS-SA-2026-04-29-6 +CVSS: 4.8 Medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N + +Signed-off-by: Alexander Sosedkin +Signed-off-by: Jakub Szczudlo +--- + lib/x509/name_constraints.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/lib/x509/name_constraints.c b/lib/x509/name_constraints.c +index 04722bdf4..232d466c4 100644 +--- a/lib/x509/name_constraints.c ++++ b/lib/x509/name_constraints.c +@@ -723,9 +723,6 @@ static int name_constraints_node_list_intersect( + type_bitmask_t types_in_p1 = 0, types_in_p2 = 0; + static const unsigned char universal_ip[32] = { 0 }; + +- if (permitted->size == 0 || permitted2->size == 0) +- return GNUTLS_E_SUCCESS; +- + /* make sorted views of the arrays */ + ret = ensure_sorted(permitted); + if (ret < 0) { +-- +2.53.0 + diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42011_p2.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42011_p2.patch new file mode 100644 index 0000000000..29eb6bda43 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42011_p2.patch @@ -0,0 +1,141 @@ +From 24713b8c63137ce0665b495d22ccce4f5ce05c84 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Tue, 14 Apr 2026 17:49:50 +0200 +Subject: [PATCH 2/2] tests/name-constraints-merge: extend to cover #1824 + +CVE: CVE-2026-42011 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/24713b8c63137ce0665b495d22ccce4f5ce05c84] + +Signed-off-by: Alexander Sosedkin +Signed-off-by: Jakub Szczudlo +--- + tests/name-constraints-merge.c | 113 +++++++++++++++++++++++++++++++++ + 1 file changed, 113 insertions(+) + +diff --git a/tests/name-constraints-merge.c b/tests/name-constraints-merge.c +index 70376aaa7..3ff8d6c60 100644 +--- a/tests/name-constraints-merge.c ++++ b/tests/name-constraints-merge.c +@@ -473,6 +473,119 @@ void doit(void) + gnutls_x509_name_constraints_deinit(nc1); + gnutls_x509_name_constraints_deinit(nc2); + ++ /* 6: test intersecting empty permitted with non-empty permitted ++ * NC1: excluded DNS excluded.example.org (empty permitted) ++ * NC2: permitted DNS permitted.example.org ++ * Expected result: ++ * permitted=[permitted.example.org], excluded=[excluded.example.org] ++ * unrelated.example.com is rejected ++ */ ++ suite = 6; ++ ++ ret = gnutls_x509_name_constraints_init(&nc1); ++ check_for_error(ret); ++ ++ ret = gnutls_x509_name_constraints_init(&nc2); ++ check_for_error(ret); ++ ++ set_name("excluded.example.org", &name); ++ ret = gnutls_x509_name_constraints_add_excluded(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_for_error(ret); ++ ++ set_name("permitted.example.org", &name); ++ ret = gnutls_x509_name_constraints_add_permitted( ++ nc2, GNUTLS_SAN_DNSNAME, &name); ++ check_for_error(ret); ++ ++ ret = _gnutls_x509_name_constraints_merge(nc1, nc2); ++ check_for_error(ret); ++ ++ set_name("unrelated.example.com", &name); /* entirely unrelated */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_REJECTED, &name); /* #1814 */ ++ ++ set_name("permitted.example.org", &name); /* permitted, direct */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_ACCEPTED, &name); /* sanity */ ++ ++ set_name("sub.permitted.example.org", &name); /* permitted, subdomain */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_ACCEPTED, &name); /* sanity */ ++ ++ set_name("excluded.example.org", &name); /* excluded, direct */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_REJECTED, &name); /* sanity */ ++ ++ set_name("sub.excluded.example.org", &name); /* excluded, subdomain */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_REJECTED, &name); /* sanity */ ++ ++ gnutls_x509_name_constraints_deinit(nc1); ++ gnutls_x509_name_constraints_deinit(nc2); ++ ++ /* 7: test intersecting non-empty permitted with empty permitted ++ * (same as 6, but swapped to ensure order doesn't matter) ++ * NC1: permitted DNS permitted.example.org ++ * NC2: excluded DNS excluded.example.org (empty permitted) ++ * Expected result: ++ * permitted=[permitted.example.org], excluded=[excluded.example.org] ++ * unrelated.example.com is rejected ++ */ ++ suite = 7; ++ ++ ret = gnutls_x509_name_constraints_init(&nc1); ++ check_for_error(ret); ++ ++ ret = gnutls_x509_name_constraints_init(&nc2); ++ check_for_error(ret); ++ ++ set_name("permitted.example.org", &name); ++ ret = gnutls_x509_name_constraints_add_permitted( ++ nc1, GNUTLS_SAN_DNSNAME, &name); ++ check_for_error(ret); ++ ++ set_name("excluded.example.org", &name); ++ ret = gnutls_x509_name_constraints_add_excluded(nc2, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_for_error(ret); ++ ++ ret = _gnutls_x509_name_constraints_merge(nc1, nc2); ++ check_for_error(ret); ++ ++ set_name("unrelated.example.com", &name); /* entirely unrelated */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_REJECTED, &name); /* #1814 */ ++ ++ set_name("permitted.example.org", &name); /* permitted, direct */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_ACCEPTED, &name); /* sanity */ ++ ++ set_name("sub.permitted.example.org", &name); /* permitted, subdomain */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_ACCEPTED, &name); /* sanity */ ++ ++ set_name("excluded.example.org", &name); /* excluded, direct */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_REJECTED, &name); /* sanity */ ++ ++ set_name("sub.excluded.example.org", &name); /* excluded, subdomain */ ++ ret = gnutls_x509_name_constraints_check(nc1, GNUTLS_SAN_DNSNAME, ++ &name); ++ check_test_result(suite, ret, NAME_REJECTED, &name); /* sanity */ ++ ++ gnutls_x509_name_constraints_deinit(nc1); ++ gnutls_x509_name_constraints_deinit(nc2); ++ + /* Test footer */ + + if (debug) +-- +2.53.0 + diff --git a/meta/recipes-support/gnutls/gnutls_3.8.4.bb b/meta/recipes-support/gnutls/gnutls_3.8.4.bb index eb66bfd19d..6e602ec8cb 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.4.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.4.bb @@ -47,6 +47,8 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://CVE-2026-42009_p2.patch \ file://CVE-2026-3833.patch \ file://CVE-2026-42010.patch \ + file://CVE-2026-42011_p1.patch \ + file://CVE-2026-42011_p2.patch \ " SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b"