From patchwork Thu Oct 1 12:04:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Abhishek Bachiphale X-Patchwork-Id: 99814 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84554CA5FB3 for ; Thu, 1 Oct 2026 12:04:58 +0000 (UTC) Received: from mx0b-0064b401.pphosted.com (mx0b-0064b401.pphosted.com [205.220.178.238]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9552.1790856292960609940 for ; Thu, 01 Oct 2026 05:04:53 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@windriver.com header.s=PPS06212021 header.b=bniOvbUy; spf=permerror, err=parse error for token &{10 18 %{ir}.%{v}.%{d}.spf.has.pphosted.com}: invalid domain name (domain: windriver.com, ip: 205.220.178.238, mailfrom: prvs=473490b304=abhishek.bachiphale@windriver.com) Received: from pps.filterd (m0250812.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 691BkcTA2606406 for ; Thu, 1 Oct 2026 12:04:51 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriver.com; h=cc:content-transfer-encoding:content-type:date:from :in-reply-to:message-id:mime-version:references:subject:to; s= PPS06212021; bh=7S/mV5MXvQsw7pgc3MDDA2w9ZREZvifGcvMBlaX8JRU=; b= bniOvbUyhu02hIPqt1cWv1RNzpfDapbB3XQ1V8ugCJohyVuWyAA/ZE09bAclMmt7 g1xLsYJH4ge7jB8ayHIlz5FEr/SdmHQrorTR4fU9OYmL0XEK160asdjmCC43YQtR Zi8aNFM74klOE/Riq8FTuflcFRj34MI1cM0PJchVtEg0oro7kIA7QDnf+XcuXeOs /qyLMj0Iqn6dNl7r3tspU3TPHmXo/g95ti744y7byAJVPBub3rbPP1MIDZjro/Ci DWPXiuBAOun0DfX0ptM29io/oabdwIWrmZ+LtTrsFmONejNTiLQzt12XvftH/ZY9 ytzBGzwkJvN8Oyd+6ncmQQ== Received: from sj2pr03cu001.outbound.protection.outlook.com (mail-westusazon11022094.outbound.protection.outlook.com [52.101.43.94]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 4gx515gx5x-2 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Thu, 01 Oct 2026 12:04:51 +0000 (GMT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=JYWK+O4YCoOtgDigfGV6nkb99A8NRHSlhHQwmvZ5q3RHq9FQqEg05k7O9xtIrqn0adVA/mCrK+boVQS+y1GbGFlJiJlVMub1Wt4TmWRqrf4m0Luh41C5miUjrBsDFsXZ7zBWrW2wMStw7Uz0+ahEtQawcgMUfqvfmx4tbi9v5ZBUr81qWfXzV8RtdfzMNBRCo0Z5bQNe1Mv5VqUQOTXKNLPbGvUXL50/pzcYReKLCK2NyJQZfG0xtm+mZWXoayoc42Zm6JLV40Pacf9KqkxRhSeZgdJZPTYTPsB48rYSDsGobMToxV3d3YdPhXjQxbPS119XtVktBkHnh0reBWqErw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=7S/mV5MXvQsw7pgc3MDDA2w9ZREZvifGcvMBlaX8JRU=; b=mrKmTmOUF90eaOt4xmgWeRxLdDaOVVtKoDHTRZBUAyPrZtyvGntIBAgwj7CW0IqB1F4E6Hkq0hc8/Q218f2p1QffkZ37QFi+ba08TuC3ehoMcrQtbivSHlPEgmNUMQ1NTH96/Akbx3uooi4LFZczHk3wCRY/mixVB4oyJ+ajzW1o4hZeM1h56UOXHkrixbs9//v1ndcXcc1dRYmk478Y5rzpV+dYtAiy3V/Ws8gcuVIUYXEkLF/WiuAZt258Dd7b5Oju28LAzN7O7ZCPyzj1gors3bZimsj4Z3ZQhgFd+psv3zUmVuW37jZPJItFBr+CyWXfCHDOw15H3oWlHCgKYA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=windriver.com; Received: from IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) by MW4PR11MB8292.namprd11.prod.outlook.com (2603:10b6:303:20c::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.27; Thu, 1 Oct 2026 12:04:45 +0000 Received: from IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c]) by IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c%4]) with mapi id 15.21.0472.015; Thu, 1 Oct 2026 12:04:45 +0000 From: Abhishek Bachiphale To: openembedded-devel@lists.openembedded.org Cc: Shiva.Komati@windriver.com Subject: [meta-networking][wrynose][PATCH 01/11] strongswan: fix CVE-2026-78123 Date: Thu, 1 Oct 2026 17:34:07 +0530 Message-Id: <20261001120417.1280843-2-Abhishek.Bachiphale@windriver.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> References: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> X-ClientProxiedBy: TYCP301CA0020.JPNP301.PROD.OUTLOOK.COM (2603:1096:400:381::13) To IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR11MB8399:EE_|MW4PR11MB8292:EE_ X-MS-Office365-Filtering-Correlation-Id: ab57b320-ec29-4872-49b8-08df1fb42f17 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|52116014|376014|366016|23010399003|260925022911599003|260925021911599003|260925021311599003|10067099003|11063799006|56012099006|12006099003|6133799003|22082099003|18002099003|13003099007|38350700014; X-Microsoft-Antispam-Message-Info: Ogp9c14z+wDOXdFUr3c7TrdL6FTVyVW3gKkC2fqHIPXhe9t1iOdV/yNICu+mJE60sIlzSy1kiSQzvq0Cgu222D4MkiP+o/JWRGVO/WMHWBvT/5ZpqqDKTo0Z+AHPi/C137Q+9G7fNhdd2ztJPOZCbOQyC2gobsQrLbHPdddUqAJzElaZ/6aA0HDURHWKoD/LEo4btZjqgLCnN1KGZ2UJT+nJDSBmlqeVa3sGeHeTY1+raKcJZJ425cunnFjJOXrqzUjW6mrpiJwEBCTG6we2Ezo3JxTN0j4BWv5blauWcc7szhcQXOQ4p/397lOXIUrGJ9SMx0lf721rX29BugOPG2CHILe2guPuRLMZ4qhO/lXC1YMFJuR0Smb3mKBeA6E0mInKSmkhbtwXw0EzQ01pHUQanXuoOJe049jBnCl/mZV/yoIgXTnx04DoPqiVe1B7tObFDrVggg6icjL48EUKZHaTh1XUbzVUKADrMMP4ThVdzE+h/tsDqS4zcfb5+ihECB1PQDbfp3yOzyYZuYR1bZ+uKu0nub6dc0Z28ew5N/FPsAnriTTvvYtEpVBE2et6eHKamdq4UD7hDxoXFlH/5GlkC7265EnMgrixzq2vnctkvmbwbFo4zi4lKYC6XIUTg02H6xPXwrH2titxcmhJ6ZkNYK2/Ej2pLSriYFHoGY0= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR11MB8399.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(52116014)(376014)(366016)(23010399003)(260925022911599003)(260925021911599003)(260925021311599003)(10067099003)(11063799006)(56012099006)(12006099003)(6133799003)(22082099003)(18002099003)(13003099007)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: lvAJYZJdjmJ+mB/hoPhoCaqvZZoPyFTsL95Zytm/QfAA0C86zq9iTVxj+26D/8ixmmG/8O5f52yBjEcNpgEb4wr2p2S8IWaeb5hLHAg6ihyoXvqpdpn32lScWJVU08v0YSPRw9hoaBfz4nGHklIRayP1VcJ5L0OhilQ2MGVKyB/CThPSfgXodA+m/+xRAdL7gzfeG7Emx1h+h8gwECbllnT3S3c6CmnPKNkaBVWB3yKF6O6B/p82aOLStzjvB1F1B5zpKxNkpX9aexrTHZELOYYX3KqztlQuUujO8sdL3ubKuFz65ypIGEkjOS22Gdfyp3MWKwV1KM+JXquXOzHr7a8uPanIa26HotkVNg6EYREnefRdZhqidD37RZy+m+bSgh01oosme14f6Aq644h0PYkiMBr9Jlhph69DH10aqebs6xx8aCIyKeGfRIk5HLxBP2GkQI9A36t6NLr3TJvb48JAacKAJ1hifc6swMFStQ6FVZ4nt8lfmZSxZAjQ6n65s/uYt/D0vSXl2MUQgjLs12y0MEqnf2hOA/ltTxGjKF1Pu1d7gC8MawKwY38ThxHo7YxNJC+M+9uaUbkGO1VLYXM4v4mCys1ubPieTDYt+gu6y02v72panh19dU77WeS8O1qj9I8+zAWfrU0iB8STuSZxaMaxiYHF8rIzPlquIG9V8db6U5tqViXApKCg6aNzkEmlyyQedTPcp/R34m47a9VEndUnYpZyRqMHEB90OKGdXcDEFNAZNtKKSTM8OlK6SExtZTcwYtEfX9TUJI9wXvE0CidVpmdc0QGGwcnV3ddYOzCmhnXwn1JPM5XMsoMLA7H13RUBgRf1S6rTXvAWzPNszocg9ssQh2YDALb+KbR7RQs4SZfUng+mxLBpj9vzZSk8REOGP4H0+hXD4rTQSufZ1PMJvigH3fuY1fTsmsnOGqCanGvJSF/cKs+LgZTBYpdm7kfqC94pPQT+chG0vnnmw/R7ui+aFnZNyjgr41nVwHQet3t58yIgx11I8TOJYdFom64RW8sEi0xzeDBxiECh0bKLfIZKaOIelOtWVo2DlQ8tlwkspp2nKvhj1ySS8fxb0PLPnboKhNDjtM6lW7lxHnRUspV8LUtVvVXRwgyl3sNfctKSPc2ZslbBD7VdnLhNG/gxeGL+ZVzEZ0pmJPNr5nNwz6lypiHFjTIPiJ4HhyELCaKJgTv3l8NzkQkle7nE4Gk/OLa1yXOmc9F0kT9Ngnj3mmQK0UwePPZ+CBgE9m7U/1qf9rOxUS6bzaZCxcJ19EcjrGM6qB8M2d5kZC2fat6ACejmsQlMBEUiRoodcyxt2FIas+H95gBYpwilw51AmH/DF/H0HhHl7M8DltUpCRBx0Aw32vSZc8lgUkBrVC7Cr/T0iGA7Ue2TLYFY7Uq3w4qAJKHuJNHClT0bOuY6lRtM8qKLtCmFhPANtIoEQBeVQoj1HW79XIu0B39CLzH9u0s7uyc9PYKN163XCJKD98FNmOjoYy8XZqMb5g+E6LzKK8y66EG+mFx9ZxURqEP9sVUR95O7ghOS9apVfP/+g0EU5UQyKMfdSqbpwcSf6SOc4dz9MvRsue79/JEnRsyVLPVopc6HyhN8ZmR5J8q8Wa0zZheGj1yl1ypnRV9UM4UQyo3kPTQYrsERVRmwmOEwEWz/T0OExhs4syIq4dXlQiqc2POqV042vXYPr5xn+FUy6YnFQpdq63b2LGkxJLFiiHVXwRngWx2EMMidPkqr35o9j1wKXp+5CNRBhQ4vJKAZtv5yDdBAZ7thPMK7 X-Exchange-RoutingPolicyChecked: k7qWZjx7O6aQX6bLlJuacB/ZEWeU8va0MzhwtX4NiyKfvc/hy5pKY+3PAufc/MLbx5Mg4h62JcHlqFH5Sa+nnua9cdeN6OsrQXBkOmt94L5gVsOFqUR2UeFbp4hWhDN3M+1wpMM4gdz4vC7u5yLx7Rp2t2xyOZaCu3rNKExneQx1CKDm6CMszxJ5wNEb7FWYozBBQPo1tMm6yhps6U1//tvQghyvkW59/keW59vHeHTocexHvm1t3NYW96Qg1grFR3dfO4omsF0ZQfW3sSU0LDWfr9BPxuOFym06AXAVS5oyvenIkXSwzbm+MluylPNyDLhvdaqVUjovoQJYwYNYjw== X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: ab57b320-ec29-4872-49b8-08df1fb42f17 X-MS-Exchange-CrossTenant-AuthSource: IA0PR11MB8399.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Oct 2026 12:04:45.6512 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: nkszgepQqcXSOLj1Xow2qFVjBYuZ47V16psyUV8Xrm8nKYG0vDsITjvOgunEqdVEfbUcvNTvXwB5MF5RisTtbzswkWGc5DQ9rGo3AvI7Vlfm/HZtO1B6/xtkv+LaZDjJ X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR11MB8292 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfX089mlG9rJEUK mleXQ5vFq0Juz20b3yYWF2mYKDCfeXlAbZ65rf8UJpUvWu3qy1tLz4R/nSpYttEBgymOkoAklGm B3vu8B2OQDo/zmoJahIsGhBDRa5yTHy0E6yi7FH/ivBp9mlFFoK7 X-Proofpoint-ORIG-GUID: mALMO9Vf4aWefsfPhaTP8YlCaACq_fpW X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfXxlolHDmQFtlH +lZhXsWzpaZEkFBrlZkiDD4XsypGM2vtT0S6O9HlNc6v5mAcoUG6da7Rptlafs6VVCk+R7FCrVH 0YQjvW49H7Ib1rPompCOQIdn+PwzdqF54ASE3uI3uk22HEzUWfTxb1Pr6y7K+pI5KGEjXHyb6bs 7k8L6wvG8cuDeMusGRvdxAZEewk3lYEVgu7AaUWEuXjMfZvCejfUwVCKZKvV+qOY0IR1vpgqviH K1vbnh4isik8Tzn33xVZgSHOq4fTrCKFV31iK/iIIu9Tsj7ZO/zg7jBN4aWRwZxWjZiou+3jl5D M6zZtHqQaZEohBUzDBEyQZ6/eD7qpnpHWhPdN377SMKIrV8cBrH0donC9YODOlK6l69QCWWOwqh zf4Cqu/Y9+Zon43isWR2IksZNL0EMfSvOEpOk7/v1Gv66A6v5BWJuT0Y+aOSj9Pt6BUcnk4aQ/O O6gFBzI+2QBm+dZdd0g== X-Proofpoint-GUID: mALMO9Vf4aWefsfPhaTP8YlCaACq_fpW X-Authority-Analysis: v=2.4 cv=S5lMU4sP c=1 sm=1 tr=0 ts=6abe4c63 cx=c_pps a=13WRnYNq68uQF2pe1ZmaJw==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=bi6dqmuHe4P4UrxVR6um:22 a=fTW__CHxibyLmBMfj2wP:22 a=PYnjg3YJAAAA:8 a=KiMCiSwjAAAA:8 a=xNf9USuDAAAA:8 a=t7CeM3EgAAAA:8 a=w8PvocCMYwcLFiy05zgA:9 a=sPCYT0qwnquSfqsKqTDE:22 a=FdTzh2GWekK77mhwV6Dw:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-01_03,2026-09-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 adultscore=0 bulkscore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 malwarescore=0 phishscore=0 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610010047 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 01 Oct 2026 12:04:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130580 strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin. Reference: [https://nvd.nist.gov/vuln/detail/cve-2026-78123] [https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78123).html] [https://security-tracker.debian.org/tracker/CVE-2026-78123] Upstream Patch: [https://download.strongswan.org/security/CVE-2026-78123/] Signed-off-by: Abhishek Bachiphale --- .../strongswan/CVE-2026-78123.patch | 53 +++++++++++++++++++ .../strongswan/strongswan_6.0.6.bb | 3 +- 2 files changed, 55 insertions(+), 1 deletion(-) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78123.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78123.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78123.patch new file mode 100644 index 0000000000..27750ee740 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78123.patch @@ -0,0 +1,53 @@ +From 2918eb8a6d4b3167f26ac011e87c3a7ecc7dbe56 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Mon, 1 Jun 2026 17:51:35 +0200 +Subject: [PATCH] openssl: Fix undefined memory access when verifying PKCS#7 + containers + +If the signerInfo or recipientInfo structure doesn't contain +issuerAndSerialNumber but instead a subjectKeyIdentifier, then the called +functions will leave the passed name and serial numbers unchanged. While +openssl_x509_name2id() prevents a NULL-pointer dereference, it tries to +DER-encode the object at the passed pointer via i2d_X509_NAME(). +Depending on the stack contents, this likely causes a segmentation fault. + +Fixes: 3c820cdc232a ("Implement PKCS#7 decryption using openssl") +Fixes: c61723c69fb5 ("Implement OpenSSL PKCS#7 signed-data parsing and verification") +Fixes: CVE-2026-78123 +CVE: CVE-2026-78123 +Upstream-Status: Backport [https://download.strongswan.org/security/CVE-2026-78123/] +Signed-off-by: Abhishek Bachiphale + +--- + src/libstrongswan/plugins/openssl/openssl_pkcs7.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c +index 73611821aadb..9980bf242c12 100644 +--- a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c ++++ b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c +@@ -222,8 +222,8 @@ static auth_cfg_t *verify_signature(CMS_SignerInfo *si, + auth_cfg_t *auth, *found = NULL; + identification_t *issuer, *serial; + chunk_t attrs = chunk_empty, sig, attr; +- X509_NAME *name; +- ASN1_INTEGER *snr; ++ X509_NAME *name = NULL; ++ ASN1_INTEGER *snr = NULL; + int i; + + if (CMS_SignerInfo_get0_signer_id(si, NULL, &name, &snr) != 1) +@@ -633,8 +633,8 @@ static bool decrypt(private_openssl_pkcs7_t *this, + identification_t *serial, *issuer; + private_key_t *private; + X509_ALGOR *alg; +- X509_NAME *name; +- ASN1_INTEGER *sn; ++ X509_NAME *name = NULL; ++ ASN1_INTEGER *sn = NULL; + u_char zero = 0; + int oid; + +-- +2.43.0 + diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb index d6176f000e..dfd4c0c8ca 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb @@ -10,7 +10,8 @@ DEPENDS:append = "${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', ' tpm2-tss', SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-47895.patch \ -" + file://CVE-2026-78123.patch \ + " SRC_URI[sha256sum] = "07df7cedae56a7f3bb07e66d21a1f9f87e961db70e99184e11d3819413e4f87c" From patchwork Thu Oct 1 12:04:08 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Abhishek Bachiphale X-Patchwork-Id: 99823 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8A9F9CA5FCB for ; Thu, 1 Oct 2026 12:05:39 +0000 (UTC) Received: from mx0b-0064b401.pphosted.com (mx0b-0064b401.pphosted.com [205.220.178.238]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9571.1790856334743057023 for ; Thu, 01 Oct 2026 05:05:34 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@windriver.com header.s=PPS06212021 header.b=NhGDEbND; spf=permerror, err=parse error for token &{10 18 %{ir}.%{v}.%{d}.spf.has.pphosted.com}: invalid domain name (domain: windriver.com, ip: 205.220.178.238, mailfrom: prvs=473490b304=abhishek.bachiphale@windriver.com) Received: from pps.filterd (m0250811.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69170pvI828182 for ; Thu, 1 Oct 2026 12:05:33 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriver.com; h=cc:content-transfer-encoding:content-type:date:from :in-reply-to:message-id:mime-version:references:subject:to; s= PPS06212021; bh=e4SiP840RGXjbcEp7fwm8IlzV1jm7b7mgnpN1KW6cf4=; b= NhGDEbND1HKTFp5a7l+a9sppPu1XSHCK0i0pFsCBVzMLuOXM3C02pROBLTA8LH6i NKF1oqf7bsuQK8NjPCS7Pcb6HclbN9OgoQk1+gJRMyd6zVo04CQJupdRCO3KPar3 FPlTv2UXNHP/7Gaqslchoh6KXXe0leOuv9PP3Lkrsl9/0D9jWAqA6ml/CHidGvsv 3MdbJhc1HrkfRWctEyGUL38t4af+w10OemyLgq5jm7ixYNXB0xtZUcsSg6vAgZed ktH26PjBsQEeEkwwPMbSzjQpCG5QFUBNHK7pFm/GAq0iVCaJnE9c4OH9EmJ0eDD+ VICZB8mPHs0yfBiuNZy5pw== Received: from dm5pr21cu001.outbound.protection.outlook.com (mail-centralusazon11021142.outbound.protection.outlook.com [52.101.62.142]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 4gx38wh0kt-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Thu, 01 Oct 2026 12:05:33 +0000 (GMT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=rL+fB1rGf7i+XKQqPsBuyWWZYOmPqkMkmi0RPGjAF8Rq2qi+N3MNTwD74EnN/+meOBYeN0ICkjxqK2jLudBu6fkPZHcYcu0IU74YyNaqEGhccv82I+k/hNXkCRewNYe2kUS69Y7Raqktjrsif58eJz29pTzBg5+0jBhslnMA2gAxDy2Z7aXUf1SM9gUuKmfvjkkow/jI54bBBu6nJnSp4MT3iSZnfluVwY1z9yFmyyZrfVrCNoF7U6K2IlnxyXwlNLXI0fgmO9ltpMb2yFR0l6XkTq5DmWaSqSyrlp3MkJMSx2lhmLzbxx6oFp/vBspDxq/MI4xCJPsgP54QvGCfkQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=e4SiP840RGXjbcEp7fwm8IlzV1jm7b7mgnpN1KW6cf4=; b=Qsxxw0hHcWIohnhP2FgeE7XtkacK8nXI9x1XGo3MmMhI7Parv2dd7U0/54jw1A9oClF5mLavi6HUd5VMNscRy33xQ/VCgi2036qZwDbnJYrSBs43B8fW3GCSwAIWmjyuGg+VJl42Qn3d0Bu1rFPQNIEHj3TGf1OSLxvE46F4weT2MFV1JcB34y3w5JtpqXm49pfkjfemBDCvNDCdAnm3XpJJ+VzDfUInXgy0JutZp4r+cPPx+4VHUafyWQCxuPBqCMjnaCCI3vCARfhd99uZJ9sFYC9nKoC/1yqnG5e3sqX2YnTPqyxCauGUHcOH0fDEWfBnt/s95r0bqoSoaCdhXg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=windriver.com; Received: from IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) by PH0PR11MB5142.namprd11.prod.outlook.com (2603:10b6:510:39::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.26; Thu, 1 Oct 2026 12:04:47 +0000 Received: from IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c]) by IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c%4]) with mapi id 15.21.0472.015; Thu, 1 Oct 2026 12:04:47 +0000 From: Abhishek Bachiphale To: openembedded-devel@lists.openembedded.org Cc: Shiva.Komati@windriver.com Subject: [meta-networking][wrynose][PATCH 02/11] strongswan: fix CVE-2026-78124 Date: Thu, 1 Oct 2026 17:34:08 +0530 Message-Id: <20261001120417.1280843-3-Abhishek.Bachiphale@windriver.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> References: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> X-ClientProxiedBy: TYCP301CA0020.JPNP301.PROD.OUTLOOK.COM (2603:1096:400:381::13) To IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR11MB8399:EE_|PH0PR11MB5142:EE_ X-MS-Office365-Filtering-Correlation-Id: 14d3fba8-287b-46b5-49ed-08df1fb43061 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|376014|52116014|23010399003|1800799024|260925021911599003|260925021311599003|260925022911599003|10067099003|11063799006|56012099006|6133799003|12006099003|22082099003|18002099003|13003099007|38350700014; X-Microsoft-Antispam-Message-Info: vfS26VLoLzItKtuarH/0KtRg49X62RSg/XNOK+j3DDCE8Ui0zmCoMuHQCqRqGciES9P27ho07Rxdr7YTLn9Tbs+H+a4n6TFW/KqHZKUPfWkDmrSVlBRYEFozi2En4juKLTkfGPR5+JxGuKJzQ4/6sMvYGZRbwlmhjrUBW7wM5AooGBJxSdF5I6zgPtWuhME7Z9KavNeT2c2y7Urkinxm0qH2iiK+51evnfVc0Ru+DWuhhvZVLruOaZJFYtQwRrQ1KuiqgR5XLLV4APz/5z6VWi0vR/zVqh/SjAMqyjl7HbTGaqYctEiVGDnytwrugaC+QYupZ2Tz9qwtlXv0hUhDT1Nujw+GxbsTgoxPgtMXBtxO2txmLQtn5/lGcjD3hv214yoqizl11oc6bVRr8d58TGUXqbA6zzEiXfIiv88pAMVlv2b+QxxQOlGvdsU/tWwNG5l6u/JzsU26XrJfKCevYBdSqFV2fZB3KTcz1TYhFtForPyKa4q6KGrw0eRe/9LRRsxXYcyCM5G9R5P7bY9MV002NjiHv+sZtyr71aUCoMJlAjDAxWXhwZJc054dGUbiLeF/JLTAV4kP7Av4CtXXwq76tQflZcxtb55oFQSqJCiP3AcfjelZ+Af8cvzo3yovk2vLZGhmMdpoafhP4tMxASBaTiynI6VbAzUT0UhvlHA= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR11MB8399.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(376014)(52116014)(23010399003)(1800799024)(260925021911599003)(260925021311599003)(260925022911599003)(10067099003)(11063799006)(56012099006)(6133799003)(12006099003)(22082099003)(18002099003)(13003099007)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Bqn54CC5C17mR+JNXXqAjQV8Cwg7Jl0zOJnUePciw/bts128RGiwT9L0nmzCCpuDFhJyfoho5MYEuitsi5NE1Zlhg0IL2qsM7byf0AyeH5w3zVAALmu4aT8DcnWt+tQIfwS9L4fFaHoRRcsWetkjUZAd3kgNDN4+Nc89hLdAyDV+DYONNhTvhE98x3vOACu/wmLNXtBbRI6AEmp839NgzAz4GucU98UXSkxG0d0YikmqA39VwX0PK6pkhE/YP4Yw+G4ePsBei/u1ehUy3n2d5aYeBO/mLcOI1YcUQw2zHJcC/Gm3GYdLciE49whyTUw/GF8l0Gim6g38IB7yUlZ/FsAMDVgZwQorr/vpOUw7W6xPYcvHf/VNJ7m+K294tm0mNbwVnkYK2aQG73wj/DRilEIMloudMULgCC/akQq8uO+bmbJZ4U/G+QBxEQsAeYNELceBM5seanwlhvMCA5nKZ2ZfcPZayd50C1XCWJeKvWK8BPriiKrNqcoFOYzdrirOOg1sbz+g1us35f0wPm1C/DJer8VfJco3Tdra7tuult0nBh6SVn7VWcKs83QbW6OwLB86pUp6HQymWtSz+S4WPJXjhoBQW402xlnngfNjx0i1uB7v9tmxWqF1s6jPZ0MtbxMLdmqaEoFH5VUUkjMhahk3ICVFQIGoVu9rSHH/vey+sDCVcVuHO/CPLohPKDAXU/C+lfY7H1pm3tGOR+i4ThOEidVN8Q8mmAD6pngL5wX4dlYEc6M+db2oKVuqRrfKJlBN4UMiZp4LgZqMycdNYVW5Sd/geXjON0/Qx4JmdItuWTV7pzLra2UdfSMnq7cwrNMaRUTx2UWrEwZZtTf3U698nV7fUKA5Q7uSmD8dbF3+ds0ph7FPNcyI1lBOZZYUJfqHRsPiw9QnjTrfG/PhGXf6UvOMW6/CDc2ODJYVak2zygEUaoFrcwDLxFuu75yugAksp7WXs3sUvNThXHw+N8qFPTfSGLoqTwdGY909JnZFNMT5qXHf1q7fakHZQuPMbkR1XqyvKt4ID95I3MUs/M2xOfngI6+kFEgx9c2v6LJUoDKdjGejELWL2oGgJvn3JBaisUas8ucxXAjH6CJcI81jB48YkPqoOJ4IXF6e2aGR8vuRvKMDWsdoJj+vFLXy719pTQuQX2wOgWpgtau/enTIGzmgeMimm3ExeeMcKmuiinYUYP4Zz0YqJ9OmKsvLL3xLaEDOCx9Fd1KMH+FYKckGlzr+Hvxh0T1aU0WX1QqzOaxPn97yEvYeCK1EzQYx7MZMwGxF++6ecqmPf3OBPRd1eHJwtSjNwBwkfP+l1JnPmuI70PFTbmqQPfvIgoqkdONdMtuNh5FDMxRP8Uma93hUECP2YCOI2fCdGBdCbbzw2nZ//GXEqBpIpslr4ul0J/p4vmJjWQrQAC2W60sJolIkik0zpFKUUE9Q3TFhWYBm4FhmZFddfuMo3jXvZ0cdtkmbRao6+yT2xssCG+b73mvIX4qA+HLOROx8x0i4iUzam51tOq9X2VkHRWAyvUbqXAEgxAVjUAYAzQpZtSY5vfLh8AoXwwZF1DZuUt8llu4Hha0CxQpKP8R82TF3rB229P18iXSGngZ1ZeL0IBh8snB9DTOYmwYOynDUkti5Z6nJaacDv78R5ElXxiK5pEViVIz3k08aUpSxqA2x/TwYoz81xKnn4CB+6WI1/ss4wwM8GPt6boaoLtirodO7UUA9kea+dSAI9jeCfstnhA9Y6bpNkYrJFjDfoMZ6veYCh77AQD3SyWI4D15BIk5bL8ag X-Exchange-RoutingPolicyChecked: dg3DqZzvYGlDbZBn0ws89QQ7ZRIXgPsobyaUvXPdGXKyo0riWwJqkFHZt2lWxgDU6EP3GHLUPhuEBEgoOak6gCAHJ//Ur/kDh0mbVN4eiesCU6cu7KpKfH+l/1AAmLQtsCIsHLcBV6pIiCwHHpRwEjNMPZYtBb11fUwsBvrMDS3HlqtkYpHm0y2uqOBB2/DQatHOeueHgwyUMj0E9hHcEJPU2zUTY0ysbXXfONl1u9bDY8WHxVR9eddTYEstIXDsY0cSmzLKY/ncpHNmivbvIH2jP2LRMHIb21P9XwfVmG7EfcdStxE0JVD3GglaXxWka56dzcxfG24fGIWeC3DT1w== X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: 14d3fba8-287b-46b5-49ed-08df1fb43061 X-MS-Exchange-CrossTenant-AuthSource: IA0PR11MB8399.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Oct 2026 12:04:47.7628 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: r6u59stWbbT4pOO8K0IAHbtyMoVEX0F39wYJpqMFWMq+lOD+vbYpTp+oaAFWM/mjKNJC8UC+mseMcGBi/orUbUqA5FqshWcEJD2IwbqHOIhZpLLHVTER2S0y/3fx7pv6 X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR11MB5142 X-Proofpoint-GUID: _r_6haRRnIM5DNmMkvshOGkkjLdNMXUr X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfX+gTlq26aNH29 uhSC+3vdQGXU+ammfZ2Oz3gmXNJUvVqOE8Rkt4Zk5aclS+RPCTdKw1Fk0H6PaYwyZRupC+BmcrL bAtmHIWhmKRZyKZhb3bN91YuV9t5AWHLq2I8dJsOTUOsZigRPJCjiflUFE7MQmduvhD/ba4p4J9 /VpuCqKlAG1Ciu0n9bGkV1iX1mM0S72OFww8e+sH5WWCDYFp13pNcZP/PTRKP/Eu9k3FXtMUFY0 69nQQnKBD0eLnTv+K1G8QQn0GvNfIsRmvm6n6Hi20/FdMKOd4kEPhltFAAlD9z5txNadPTUvHo3 aFmKLNFn5gMP9G4iVGiJI0vDWbnAAZg6kJD7dHdgUlSJ36FTqCt89Acffwiu/TiZnDjcH8YUGAU sP3fxDTa4pVzw0yFz+XyNCBu9BsCkbMJ8qi14u+EZ3m0qUe+nAPj8nLhPjoK4XU+NXcCsXi/JYg tUDBsrWEi4UQakm7F4g== X-Proofpoint-ORIG-GUID: _r_6haRRnIM5DNmMkvshOGkkjLdNMXUr X-Authority-Analysis: v=2.4 cv=ZYSIpcVA c=1 sm=1 tr=0 ts=6abe4c8d cx=c_pps a=A3wBdPz/itNY2Bh/0u/a6g==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=bi6dqmuHe4P4UrxVR6um:22 a=klDOsUkWDRETUCZYPvoE:22 a=PYnjg3YJAAAA:8 a=KiMCiSwjAAAA:8 a=xNf9USuDAAAA:8 a=t7CeM3EgAAAA:8 a=x3ZMZMX1nGGarHV9e9MA:9 a=sPCYT0qwnquSfqsKqTDE:22 a=FdTzh2GWekK77mhwV6Dw:22 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfXxV691D3liknt eU40UYnf4/If62BcBZqW4Pu2xA05wEMe9nJ4+seTaUESxXHj/HglOkaCACvBLjeNbrZPZHJ7dM7 bTwSE0NB2fPiEEyuOdzL0MwD7EaEjhFyRIE3mHkNJs9G7Q05y3k7 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-01_03,2026-09-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 bulkscore=0 clxscore=1015 priorityscore=1501 impostorscore=0 phishscore=0 suspectscore=0 lowpriorityscore=0 adultscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610010047 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 01 Oct 2026 12:05:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130590 strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime. Reference: [https://nvd.nist.gov/vuln/detail/cve-2026-78124] [https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78124).html] [https://security-tracker.debian.org/tracker/CVE-2026-78124] Upstream Patch: [https://download.strongswan.org/security/CVE-2026-78124/] Signed-off-by: Abhishek Bachiphale --- .../strongswan/CVE-2026-78124.patch | 36 +++++++++++++++++++ .../strongswan/strongswan_6.0.6.bb | 1 + 2 files changed, 37 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78124.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78124.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78124.patch new file mode 100644 index 0000000000..a82232a675 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78124.patch @@ -0,0 +1,36 @@ +From 2a3a678be189e51465d17c611982a9e5f379b016 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Mon, 15 Jun 2026 16:02:01 +0200 +Subject: [PATCH] openssl: Fix memory leaks after enumerating certificates in + PKCS#7 container + +This can be triggered via IKEv1. + +Fixes: 04884be3b5f7 ("Implement openssl PKCS#7 certficiate enumeration") +Fixes: CVE-2026-78124 +CVE: CVE-2026-78124 +Upstream-Status: Backport [https://download.strongswan.org/security/CVE-2026-78124/] +Signed-off-by: Abhishek Bachiphale + +--- + src/libstrongswan/plugins/openssl/openssl_pkcs7.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c +index 9980bf242c12..46584055ec3f 100644 +--- a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c ++++ b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c +@@ -132,6 +132,10 @@ typedef struct { + METHOD(enumerator_t, cert_destroy, void, + cert_enumerator_t *this) + { ++ if (this->certs) ++ { ++ sk_X509_pop_free(this->certs, X509_free); ++ } + DESTROY_IF(this->cert); + free(this); + } +-- +2.43.0 + diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb index dfd4c0c8ca..4a1e584d84 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb @@ -11,6 +11,7 @@ DEPENDS:append = "${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', ' tpm2-tss', SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-47895.patch \ file://CVE-2026-78123.patch \ + file://CVE-2026-78124.patch \ " SRC_URI[sha256sum] = "07df7cedae56a7f3bb07e66d21a1f9f87e961db70e99184e11d3819413e4f87c" From patchwork Thu Oct 1 12:04:09 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Abhishek Bachiphale X-Patchwork-Id: 99819 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 51008CA5FB3 for ; Thu, 1 Oct 2026 12:05:29 +0000 (UTC) Received: from mx0b-0064b401.pphosted.com (mx0b-0064b401.pphosted.com [205.220.178.238]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9570.1790856327426184423 for ; Thu, 01 Oct 2026 05:05:27 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@windriver.com header.s=PPS06212021 header.b=LMbeFAOJ; spf=permerror, err=parse error for token &{10 18 %{ir}.%{v}.%{d}.spf.has.pphosted.com}: invalid domain name (domain: windriver.com, ip: 205.220.178.238, mailfrom: prvs=473490b304=abhishek.bachiphale@windriver.com) Received: from pps.filterd (m0250812.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 691B9dFS2542266 for ; Thu, 1 Oct 2026 12:05:26 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriver.com; h=cc:content-transfer-encoding:content-type:date:from :in-reply-to:message-id:mime-version:references:subject:to; s= PPS06212021; bh=eDZi1+lHfITO+ZlBrEJoVcoAJnp4Pncnc3M5q45WQuo=; b= LMbeFAOJdrVCcP1YauKkdN+G7gANPdoPm6CQDbty1dmOxcqDdbDHjadb38aUFWFN EZoAssYlQfHGisbylTSmgdQc7Eq/HAk3FPjSVJxss078cnvg/ZXn5jCzETTjiCRK MHUtHWNqYdZGPXnk/GtBPTe9sXgujNWwtW3Qvln8RHpzgTKENCbBjnLMFkB8sWnr 63/v0RCaP5wJbtC8mSIcducOoMlvF5+NeMd4X97D1CB5216f3GPcLjxX0ZarLvWA RrOYIxgDVXjyTtB81IwTi5M9FNjnxAxCgDQpltG5/fmhT4Jxd9Xg/9HOq/84uTJD MKfyW1loRuadVrNkh4u2gA== Received: from ch5pr02cu005.outbound.protection.outlook.com (mail-northcentralusazon11022098.outbound.protection.outlook.com [40.107.200.98]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 4gx515gx81-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Thu, 01 Oct 2026 12:05:25 +0000 (GMT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=hVQQi94EFMaRIserOKiyBinTUetNLUhxwQwQ9JbUO1yl2LIicmYlm3IC/wbK92WSNaf80zZAZtulrn4K4Efk5YCBy4kitvVhttPnfGUhFk9YEPPWZrDJOnApIfFOatsdQJtUBW9vdrPXBQr20pUqjsBK6sRM5JIvTpktDPG5iJ7pvjNLmprLi5mxWHfWrd1pA3iBp+tG9Sx10wPP3vk+JfaL+FSY9fj6rYZ55vISiZgTwkccxAims7TY1UfboRKNrsEH6HQLZ7GDRH3Q/PMRDc9V2s4v2wtO21Xg7TnFyKtw3QltiPY219PqQQ859fjPB1bCeXyS5mKjMtpxAhUTPw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=eDZi1+lHfITO+ZlBrEJoVcoAJnp4Pncnc3M5q45WQuo=; b=gPGA2RSYust1du97uaum4Cw/reno94YxOJUidO2GkHz4u9Aoke6DeP1nfjeOLvqu/jSdOcEYGcjoFpkUiAAGS8NnIBy4DLVGCXBhqSbQgEXrmszz7BxujVF0/RjD4F3rt19i83jAb4e3jxG5SNR3t8h2onmbnQE5KlZo5BDR/zrJS/slevSeEit5XO9CNSioelNA/YSZlzm42803q9IFbmNul9yv96nq5t5CMcLTSJfsec4l5NAww0R/qrHYGoyY6El6Q/yqYSZBbsYZTC8R+TejOoAnyJ0unaU6x7JuxPRfwGVJafzMZHVuKguFv9Fhe6jzKQLWt4CltYzhpX4vVQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=windriver.com; Received: from IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) by PH0PR11MB5142.namprd11.prod.outlook.com (2603:10b6:510:39::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.26; Thu, 1 Oct 2026 12:04:49 +0000 Received: from IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c]) by IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c%4]) with mapi id 15.21.0472.015; Thu, 1 Oct 2026 12:04:49 +0000 From: Abhishek Bachiphale To: openembedded-devel@lists.openembedded.org Cc: Shiva.Komati@windriver.com Subject: [meta-networking][wrynose][PATCH 03/11] strongswan: fix CVE-2026-78126 Date: Thu, 1 Oct 2026 17:34:09 +0530 Message-Id: <20261001120417.1280843-4-Abhishek.Bachiphale@windriver.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> References: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> X-ClientProxiedBy: TYCP301CA0020.JPNP301.PROD.OUTLOOK.COM (2603:1096:400:381::13) To IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR11MB8399:EE_|PH0PR11MB5142:EE_ X-MS-Office365-Filtering-Correlation-Id: 53f735d4-108d-4ef0-d8a0-08df1fb43161 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|376014|52116014|23010399003|1800799024|260925021911599003|260925021311599003|260925022911599003|10067099003|11063799006|56012099006|6133799003|12006099003|22082099003|18002099003|13003099007|38350700014; X-Microsoft-Antispam-Message-Info: /CaWWGAxaaXtIley+BpyFD4Zu1HRqh49pSXdSo3NomlQAIa/PxYZJnS9M2bDqrcyZLrtEMKkgIIupkzcOLUk011eQVjP1hr/RhiT6tXBUSl70RM2dnyvZoVEd2zv9nV6cR69/2zfNcqRduGp3cuvoLSVoAO/Au9IPd21ti3/7GE7o9l53zXQbaPVxmkivboFoy06Ww0EE+lrFKm0zm+lRrzINWhDPFVGaeinR69Xgjge4YCKt6qC5Wvuq7JxrzLG1HwaPMDce9LyvWuR4exhxJKy17KCTe2qJ0pxVTR5ephLBW1oHHF60DmAG79aTpwNe1o0tOeVKfYIo+tTwFrBylN2LfsIwg/2A2Ex80SNoBA1d20kx/SVrKbuWEtOWDSkNZU48eZOFEN0I1oxxlghNFjfDs8X/dgiAyOgAoWz9imrl5o05B8tCYEq9CcFOtJLw0Zlv46OSfOCmoxuKOBa9k3B+E+Wt/JD7SwRCXnW6dUumrahIPOoJl23V5FbLEdh5Ipdwj54u/X3xvVkCaZjbcVJRZGuAHHNIA3a2Oz8gdHzVXtBozbfU9exZ480lnAIrENxAdLsD6aySjZa1YHKA9gsgn8YlNE6vOgq7+xTIio0e+eozRY6f6hT4+wdBYRBgEaGZgqCLQ9b8s2MoyFBzN/iBFEBbSKaOsvqfDOTphE= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR11MB8399.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(376014)(52116014)(23010399003)(1800799024)(260925021911599003)(260925021311599003)(260925022911599003)(10067099003)(11063799006)(56012099006)(6133799003)(12006099003)(22082099003)(18002099003)(13003099007)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: SHeqPdMiCB9aumjKaFCVj8HPVYAV3WV3K0hzRggpQB5wUlFJ0fzFy3By7B5XBB67vD/dbQWwfWWMeJanx5KdqJFAZ4H+xw9yPztasCBPBJ1NS52xfGUsXJDhiqXErEKJO/cdzwVKzqu0nZE73kb/thVKm5F/VZjgajsF5RJ7aYFNNudS1HeR7ddnWzPiGM0Ed7dfFBIAtzWNUuh7FiyG8Zjr5LfaP4LigYJ9IEBynH6iYVjTnHNM/50K3vcnrHH0dg80EQNylg5A38IyOHdWyqgZOdehJToLKjkg6V4/jEwlqIV49XX5Ryro7VVmeCondDHD1C1FvBwi9Seg213pU0VdjNGOx9IT9d6tg7ugK1iuDOE0HuCT9Ls5brmPxdyeDEyoTgVvO1XwO3cfT/h4eKuiTyQK3wps1LNO6f4gWxxINHpfmif+Wb4vOX+JZsp+XYGB4erL+DpF/fPNGPoQ8IBLYzEglsZ72p01iMVD1PBGwGvotWagNjvArFiIkjIlhhicDe+v+uVGkbzyzTrWCahTZetwTVsTO74tBw+jhhquLTtBEDQloWOrMCbKTWBMftfWi7CrpR3/tE9B4Z0RjZ2h7roBMYmOW6g76esN8SKHnjNuuloYgqTA/IW2MC2M2KAgNtvAchWPdRGvRyxUsBKckH11xX1DwIMChDOP8AzmQ5FWeIeK2gUlDNNGDw3YHaQzruKBIjlSajUbg+Og9qaXmuZuc7EkeUI6q8y+ax8wstofhTIkA8WMXvzdK6HOcwlXJqtrrS4epIcr3bU/yGmSOV25qyZeF0JvxGttSDo0umG9cXhQd9udCrwLy805g7Z1B3Nk77zz5xgSykNOMpTDpJ5x1q358E9nEJxIKCon3XUUeuw7xdtZj86C5PqHgJSGqTYLqpK13Bjt/IVFTmCWpTrSgCCSFqmA7GcUfV0SIwNypxMtPx09Nb2N7RbxkRZgXjs0n2fnzsPeWuMGcrq3TpZS3VutYmOn2/janxE34Kpha6R4caluycfB0QGDsObDTtuQlwsuMZBXL1Tmx7Iaru2GIsh733ggJMSDUTDyCoh4kOSyxalZrF2mHYYDhWjBoEAVJbWHvNdqFI3Ei+pzQc6tb16fI568y0cxQaVsgFts76nfDXGGiI3FN2DNGS771FFNbb/1u0Bz8Fv8U7pgbdu39tCm0TBQz7bhMHMV39N5iZ/8U/3fh26AOoQNI7Rqw3pE57v1YW8xGllB0ch3f50XW90Brb00eI9DErspLctWQDTQANMGXtkp3UVoyLD6BuSSvX5nXLT1qMg9kDy53NhpTH+uqGMcx+fiaqJUQdro/Y3bjP0XmyBIrIsmXUTpyB5EymC06Avycs1OWiYUl62nDvnLHnplPHhkKy2HaIiZTff8+jzCaZuxxF0JGtBEZfKVw6jObb1uKVQqoy0PhK2jEf0plok8IAegYzJn0bZkpF3Bhzq8BtWtqDOJN+q9F8jysVLLxACbzEeCnMOpmtlWD+gyMbUlVTw4J5WnNe/PdeXQWEUn6l4YACl2DFkWmLAQaKeeyyD+9rETXgXXBFLmHb1eBUPxVra7CVl8Rv2BS4vLs4aZy9hXdNvBMiVff2wrCAUnbC2nHSvWC3LOyMaUNLNGCtN+o7Js/cw3BKW7SJ973ng0WcaLG66IjmGWIpgNB0z0CjC4umSvsrK9dR8noMRASbfn0XA1yBI7IpySaP/q2Lf1IRkQD3bsfZUUKapji8RSDgbG+A5YlMyMEOVZmZ9nr7gYjapqbiEKxXjdbPqe8wDrDHlc4qVM X-Exchange-RoutingPolicyChecked: nx/yrTCL8bC7r4/iFq5OxFMX6cxiQsnojtrarTt7jDj5zoGi74NcJb/bnFDR/1BR/DtbEjjEf++HcaL0OKETjU1Xl/SDuiu6v8RkHzvVa1SJYyBFNdHQOBN50cHsF10cANo86y+lwskENYe2MIPAAh4J2T0c9VNnlwMpwBALvPhk6YyA9fcRdcpTcUbTwqDdRCO5+AkLpj8KZx9DXaf6s7DyNdaoRDVmXxoCxsaWr4SyI4q77Dc7TGxVm35xH7YtUP7wqKLg4G9zh5YFFZvm8OI+zmCXNJHafSTIPG+8015+TUwSVzek0P/seSgC3rEyR+oGNBfu/i9TZg8/4jlg8A== X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: 53f735d4-108d-4ef0-d8a0-08df1fb43161 X-MS-Exchange-CrossTenant-AuthSource: IA0PR11MB8399.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Oct 2026 12:04:49.5153 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: sBlF4GanwDcC7vl3PEyJ5i5ylZDnQjVh/fZBfziaMaelHR08nFMqziW4nAVsAIDxUWm43vj2/g/VuowwSB2z7s/v8X/juxvClj34tl+UrHATqGRtO6sn0aMY4Gs29PYG X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR11MB5142 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfX3LmQHSpWUOSf /DGKeorhDywxoVN7SYw87eCwXVwBRiEBIF9mHYXBY7zQMnqS2SwwBdNc7WxAIy/ocuBfJs/EB9A xrH2Jv7uenaKdPaSlJZwDS9Ondc+6Mr7DJxPqfwjlRjclAwZdytD X-Proofpoint-ORIG-GUID: 2nT9SVeOcFivEK9fffYZ5BMlo0J738iV X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfX4jckc0Jo0nO9 9lAufgNbOFLEdHuZpfLHhZQuKZpkdr3k7GO5wjy6vUBrMKBWa8GMmq4GDI6Zruv2TjyjCXAr5Ir dRioHbLg79MLKuo4pzLJTWG7ZcajM99N5LrpH5SOEJ7mnHcepGTLlD049tqwvY3W6metz6dUu9R Y/67c2hWP71seUI2De9UJdTRWkeSUEePeUZtBrcsCFZTGWgTQeUDmBV+wlnnFexnu8RNa1iU3I6 iF9NV9eHUZfqGbdnahkj9ASE90ZHg6HhGT2kIMZONXEZhD8UWA+eRNyAIJvWv4QUK/NZF4B1glF 450uZQYkYsYCmRB8aRCCBU2wLMIsrFZZpT2k2IOFUl976fHU1dH4kk1EpYa3Em3aS6Xtqfn9cid fG5ZuguW6sl3PIxh87AMxVIRPMtHqfm5e3BLUZk64gQk5W6vq3ca0yL/IuuWXItdi/q67K9hfeP BobW6t3y/w3xNZ+/Dhw== X-Proofpoint-GUID: 2nT9SVeOcFivEK9fffYZ5BMlo0J738iV X-Authority-Analysis: v=2.4 cv=S5lMU4sP c=1 sm=1 tr=0 ts=6abe4c86 cx=c_pps a=Z0C3GUl4QImALGAV7svfNQ==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=bi6dqmuHe4P4UrxVR6um:22 a=fTW__CHxibyLmBMfj2wP:22 a=PYnjg3YJAAAA:8 a=KiMCiSwjAAAA:8 a=xNf9USuDAAAA:8 a=t7CeM3EgAAAA:8 a=ZumAQrI2ZkeqxSiaTv0A:9 a=sPCYT0qwnquSfqsKqTDE:22 a=FdTzh2GWekK77mhwV6Dw:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-01_03,2026-09-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 suspectscore=0 adultscore=0 bulkscore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 malwarescore=0 phishscore=0 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610010047 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 01 Oct 2026 12:05:29 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130589 strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin. Reference: [https://nvd.nist.gov/vuln/detail/cve-2026-78126] [https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78126).html] [https://security-tracker.debian.org/tracker/CVE-2026-78126] Upstream Patch: [https://download.strongswan.org/security/CVE-2026-78126/] Signed-off-by: Abhishek Bachiphale --- .../strongswan/CVE-2026-78126.patch | 39 +++++++++++++++++++ .../strongswan/strongswan_6.0.6.bb | 1 + 2 files changed, 40 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78126.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78126.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78126.patch new file mode 100644 index 0000000000..dec546d8ee --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78126.patch @@ -0,0 +1,39 @@ +From 632a7498f834ff07ecf7a3dd604c06f6b89dd768 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Thu, 4 Jun 2026 10:00:02 +0200 +Subject: [PATCH] eap-aka: Only accept AKA-Synchronization-Failure if expected + +This fixes a NULL-pointer dereference if the client sends such an error +before the server issued a challenge and allocated this->rand. + +Fixes: 26e246769224 ("ported EAP-AKA branch into trunk") +Fixes: 4735965fc048 ("EAP servers check if the received EAP message was expected") +Fixes: CVE-2026-78126 +CVE: CVE-2026-78126 +Upstream-Status: Backport [https://download.strongswan.org/security/CVE-2026-78126/] +Signed-off-by: Abhishek Bachiphale + +--- + src/libcharon/plugins/eap_aka/eap_aka_server.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/src/libcharon/plugins/eap_aka/eap_aka_server.c b/src/libcharon/plugins/eap_aka/eap_aka_server.c +index 89e51c733bec..1140fea57907 100644 +--- a/src/libcharon/plugins/eap_aka/eap_aka_server.c ++++ b/src/libcharon/plugins/eap_aka/eap_aka_server.c +@@ -505,6 +505,12 @@ static status_t process_synchronize(private_eap_aka_server_t *this, + simaka_attribute_t type; + chunk_t data, auts = chunk_empty; + ++ if (this->pending != AKA_CHALLENGE) ++ { ++ DBG1(DBG_IKE, "received %N, but not expected", ++ simaka_subtype_names, AKA_SYNCHRONIZATION_FAILURE); ++ return FAILED; ++ } + if (this->synchronized) + { + DBG1(DBG_IKE, "received %N, but peer did already resynchronize", +-- +2.43.0 + diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb index 4a1e584d84..43be8b287a 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb @@ -12,6 +12,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-47895.patch \ file://CVE-2026-78123.patch \ file://CVE-2026-78124.patch \ + file://CVE-2026-78126.patch \ " SRC_URI[sha256sum] = "07df7cedae56a7f3bb07e66d21a1f9f87e961db70e99184e11d3819413e4f87c" From patchwork Thu Oct 1 12:04:10 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Abhishek Bachiphale X-Patchwork-Id: 99816 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C5789CA5FB3 for ; Thu, 1 Oct 2026 12:05:18 +0000 (UTC) Received: from mx0a-0064b401.pphosted.com (mx0a-0064b401.pphosted.com [205.220.166.238]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9561.1790856316465585252 for ; Thu, 01 Oct 2026 05:05:16 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@windriver.com header.s=PPS06212021 header.b=DPbH7WDp; spf=permerror, err=parse error for token &{10 18 %{ir}.%{v}.%{d}.spf.has.pphosted.com}: invalid domain name (domain: windriver.com, ip: 205.220.166.238, mailfrom: prvs=473490b304=abhishek.bachiphale@windriver.com) Received: from pps.filterd (m0250809.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6918Ecev955562 for ; Thu, 1 Oct 2026 05:05:16 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriver.com; h=cc:content-transfer-encoding:content-type:date:from :in-reply-to:message-id:mime-version:references:subject:to; s= PPS06212021; bh=wc2XhB5Ew64H3PcFmyZ0W/fUvH5wpN+3yIKG623+g0Q=; b= DPbH7WDpApFbE7qLyziLtXcsnV/C0dpjZFF8q9daJaHnp6puOGP6TOAbqOu5hplx 5rLog775HMKeiq0FmYUG9czcldID19S/D8ymlDcKbzUxEmUVwUyZvCrgiB6SE8Ab BlI1z88mdwr0LPxDUEqVsIh8BDMGyYUHpk0hhNnE8cAzAr5QYRM0Y7dxxPXrhsg1 b3lNpaHzulPfAwvMrLHEU01UKDVFMRAdeWTlP2znsn7DcA4uUy55xknb72XW59sa ILBeXR5cJbi7Znmq7O105LoM+42YN5uwgsxobyiy30RUg0bZszyqjlM78WWB74wi Wu5aP8s/7zC+Kfk732dYkQ== Received: from dm5pr21cu001.outbound.protection.outlook.com (mail-centralusazon11021080.outbound.protection.outlook.com [52.101.62.80]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 4h1ku8gaqw-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Thu, 01 Oct 2026 05:05:15 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=qa+ToLt7Qp8RQAXLS0PxRMlQfPBVtp4cDjvt47eqIx+GBG26i47DqkLBRaaisb51ch+38sdgoIpria7pNyqeljvbU7GS7o7NRlOUlkh0ctFvtLZxsbvTjTMvjc532lEsVELKzZjj1pVeQ0Y1owYGoEcGn6zlZEETrKI8u0CvPlzdUJGVg+jSec821Z8LwapBO/j4rcRKLexoQxpvvTQR/LcczNgaBud/3P4922Zw1cmNFRek+VvBCVwZy9AcgflStHOGmVROWWRcgk7PQCUoyQSW/oAPF8wq0sZ+eTHb3K7znYZig1LYgE0Zg93srSkTR1GdmZMa2UV64LMgOEzlAA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=wc2XhB5Ew64H3PcFmyZ0W/fUvH5wpN+3yIKG623+g0Q=; b=w3cQaPxL8sZrUle5hgKHGsInfhg/xwoq89JQZ32OuSG8UDUHf4SawBT9KKrO5G157u6jqxk3JHxJzXomTXFadwqSksIkznh5Ve0xcV8Qv/Y5uyhG4PVxj05rYyzynYJt6wIoic9RXux9NOiuY85urJcoE/v6YDQEufDRgx5spxociHjutWlm21wU//vpgK34rc7gS6C3T9zBIRHu8IS2BCa85RSIPQ4MvSmGl0KwR7GOJcSdxtFrDmQyKDpFfhJO/tEB1sxUNDQswhRR0AKCbi55jpJIGMNL6jgGJrR7t0bGsnt52Hs0Nd+Auf8hyboEGLJDY/0MHDt/cL5zU8xJoQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=windriver.com; Received: from IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) by MW4PR11MB8292.namprd11.prod.outlook.com (2603:10b6:303:20c::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.27; Thu, 1 Oct 2026 12:04:51 +0000 Received: from IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c]) by IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c%4]) with mapi id 15.21.0472.015; Thu, 1 Oct 2026 12:04:51 +0000 From: Abhishek Bachiphale To: openembedded-devel@lists.openembedded.org Cc: Shiva.Komati@windriver.com Subject: [meta-networking][wrynose][PATCH 04/11] strongswan: fix CVE-2026-78127 Date: Thu, 1 Oct 2026 17:34:10 +0530 Message-Id: <20261001120417.1280843-5-Abhishek.Bachiphale@windriver.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> References: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> X-ClientProxiedBy: TYCP301CA0020.JPNP301.PROD.OUTLOOK.COM (2603:1096:400:381::13) To IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR11MB8399:EE_|MW4PR11MB8292:EE_ X-MS-Office365-Filtering-Correlation-Id: a6201c0f-276c-44bd-6e79-08df1fb4326e X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|52116014|376014|366016|23010399003|260925022911599003|260925021911599003|260925021311599003|10067099003|11063799006|56012099006|3023799007|12006099003|6133799003|22082099003|18002099003|13003099007|38350700014; X-Microsoft-Antispam-Message-Info: zhaVRanpyW7hbOs+lXCHrP047fm4JjayPUkD2POf6j243Y0CPCBw0RICjUkWxKud09aAiVgrc8HgksTqKvp+2STV/qR922cLlPw/+Cl+DNiytVX5k0GYlkPB/bXZN0myPXbfSKHTI/0y/fGx5RAr5rO2HJKicXPXL5sweggszqs8ePmA1jevXD3AdllD5KEsTxREd75jFjdXfRWddqlK5eZ4zL3hVZJxQHbW8GPx0YRzGIdsWpp6Xx+STvc8874YQno6LIKtTThva7qug+exhGGx9QE9ZVGjJYvRTLsB2g1gMWHF+1jnJJdgQIRfK8xVDe6act+SmWeLjnz2eC4H7ZcMUC/X/iH8S1PUoOGahNmagMeo3HUhY6IVjj0JbwusvENBFu2HkgqBBaF9pneCGTEzEpVICl0mu5f40oVQdYV1hMpsfQT7tzjMVwLkH9Bk163cCKEAb4HX+rZFkwMlSYH1v3d8iNwWv1TTlI8C/bfS23dnlS6rSC7V/c1LM5msD+I2UxB41MBfXvY+Qv4zqhlIbR/rxqTCqEKdm/hajh4Y8SXtJoqrlVx1QseFeRuw2iBcdFBJuYWViOOc6mVAXzGSB1etq6xz5Ex7lwdoL1TEgJ/HSLk0s3ol9ZV36G8fID88QDWDENXY8U7Qz1N9mhdAipZ73atUQ9lT8NNrIR4= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR11MB8399.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(52116014)(376014)(366016)(23010399003)(260925022911599003)(260925021911599003)(260925021311599003)(10067099003)(11063799006)(56012099006)(3023799007)(12006099003)(6133799003)(22082099003)(18002099003)(13003099007)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: yJ2P1ecrsoJv3BfdS4rWukFARZ3zHlz1tcvHp3dA8PlAec0xk45AuBGSGB/HiAQjJUBoF9c07d0QMMfoDclYsBC1c84vVDwJJcMiqLl/uQMziBUyR6SPwGgR4yK8HscCv7wX5eQcKYdxTwfPsCENmhTZByUrGNaB/ufnewi4jOmRQwUiy2ClX/aORd25NXvF0l9XUBeTWyy9IV4Rc94rvrVskMEyn3baYBK1hBfQQ7OHXmWX4/PHveGw5+2NiaRroxGlyz0QX6zOWlP/flDq913SPy1CWff3MpRk8IoCutMPfNnX87pF6e6bf03hESCCuLyJTyMJxOUpMyAvH+qXSuX3YeJ9P8WQq4O6wa5DVuKOljjPWOOSd9yKhtGSmMLJ0aolKmy4FpHF9Ks2IpRjOlTQkXwHUZqjEn6vKC6m/hfsL+WDxNXe56Yvr1rMW3RIyKFv1SfB2NplMcG0FFktkridU7rExL6Ou+90GLBOYeIEwQJpoqG9KfZYOJ5MrMAHyDhO1bNfvid83g8qBsszbct7g7lslUdIWwDUouE2OAOnXCZo4DdhJh1t9NhI5oq9rlqvTnMDmn56iBO//yoV/kJQCRucd8Bf2/gX0nieVh5RUPTmgxm5b/eET0vlRG9VLmx7WsbKrGiKLsugBYbVbr1OoBE8OJZIH8OFJNQbynZdDw1OzWZbCxGhOP9oIkPN0zI+beaLlJo73Q6vYjP9QT6N77sjtZDK/yBah5i3bzahcFb75LOjIoz5tACpqdwVxZLRWYwpRilbUIVrhaBhR0uCFtCpG6oCfRUtEnhNJVdoLfeRHWTL609OXS3Apc/jDGMZsKz5ULg1yD/2sDHwAqVhB6i9CWVFQ4B57imFF7Rmr70O2VUyUCpUPZzy4ro09oKVtlbXj0p+G4Jj5+knrmwDDOQ9js/7U0KJ/LmHht24i47+8IC9iGv+wSJUfC5V/X8+pHGew1pO/YDoSLMT2x6MlBUJvgdCFD3INQo4HJu9oskq4+M6bdstgPOoBzZ0A3faw9g6VHSIL5He7EgK/CGw0wVAZLOP1x2XfK+NqhTco1S7lRvH1JZioWi7AVZ5Sl/BRGXWBm7BNiNENBptIwppJorei3E/ODxyr8duugvm2QIoDE7h9ErIAvsF3hkR39TpzIFyIj4RTwf00PszF2EjRptxYSo/aU5PNwcsurrT3QdiCKKM8yvy0QqDOSkFibRCmc5NUrWzmj2y0xy8pWpwNpRMss8qV7x7R55cS4FMnlmEVSIuz2M1fKmYTvVSZq3KFHLlD9d30Jx5feNEDl44wDyosaOZz0mi4vpY8o9AgOLFvUQqcOHmmBaCR9/XSVYjae1GczPO+8CfKUzpi/SjUY2CkUp6fUOYfGmvmycxF9QvH3deIl91uSDdmG0qYkN2zTnrnvHcNZJqwpGLGFm7uqsJZ2fJcVen3gk3kZhs2kwbgSVXYDZeoMT7fFHag/xwIXWp9uYngzO/rO/AQOkWwSp8k18JUGQb4t+HD66dOw8aDamvNhjcG3Fvcos89+G+CjG71H5g5XF6tS2iE3z5JQEW88mHzxdESh9YhPfw7IgQQkzK0gqDK1rePXWo6ciIBI4aYLpy44DK5jzXmvFAyREbQ9+LjdcuXX+k8eCXffllMME9MIx6dr4YDrzKIDFMWn4XNI8eLknDDRIwnvTcFVTmbNROSOcgMjGNM75GKyLYCa3PFRV7dVTjJbWSyl1Wa6QUjojmDD8uU3R+K7+9Jnwvw6qjGAA2p+NUiKYBCJ+vWc6HAuzclzveTZiG X-Exchange-RoutingPolicyChecked: h43DzGDFC85TvR01p+aLGDlj4bn8jYkLn8iBNKeolTKLHA60Vu0fFSRpmwSFRTp1z0oatxDTyXsTilYmYCkORlepLy4Fgtt0DXuU6pNzFuqag+xi1g3C7A5xSn66HxbQfbLwuSWzThKrWPKQnEr2w6H4DV5XoEbpD+MfJhKrWrsYDVoQXhsXpYx/gVokwFRITtjHVoRKrfJX/j1l7X9AgHfpEK69Y7oeQToeZRsPq6IeHw8RpNJLa8LQ92tLn2DNc3lfzIPK7Vnl3nCh+Exg7XsWnJ9RqQxf2cqSAV6fPJHW6NDzQnzElmT2UtoAZxFloOsisPjNlIi0Ea2KCVp0Fw== X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: a6201c0f-276c-44bd-6e79-08df1fb4326e X-MS-Exchange-CrossTenant-AuthSource: IA0PR11MB8399.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Oct 2026 12:04:51.3062 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: CzJeZb9aCtW76cyHgnaMX2LMlI9urbiD/vCNLJXYkSeczzkH0d78mUrCf1VtDRai6oLNh4IfqmN5Tb1qn72pkKbiAhrluq7wvcDr84AHrzhpB5GgYXL34/f5iXi1dQ2I X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR11MB8292 X-Authority-Analysis: v=2.4 cv=c8Q+0h9l c=1 sm=1 tr=0 ts=6abe4c7b cx=c_pps a=rDyEm/81vvKQCy/iKDMZrQ==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=bi6dqmuHe4P4UrxVR6um:22 a=iKiJcTA2PjBS6x5JeXcw:22 a=PYnjg3YJAAAA:8 a=KiMCiSwjAAAA:8 a=xNf9USuDAAAA:8 a=t7CeM3EgAAAA:8 a=2VWBBesWaoQ5tO3Fx5YA:9 a=sPCYT0qwnquSfqsKqTDE:22 a=FdTzh2GWekK77mhwV6Dw:22 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfX8o07q/5ofWso MeRWMR5ZOBo8ezYQ0o+YvU9Exq9ZrTZ2UNo2RuVR9m5Cbj2mBIl4FGQfu4Q19Z4m0CTy/jZMW8s 8JL8NPYoiQZwSletx63NAIwGJ3iD7QxcEuc91EM0wbK6A3lV/E8Y X-Proofpoint-ORIG-GUID: 0AuAFuRQmsbRwTI0kB3TVPbKeMbjTOXC X-Proofpoint-GUID: 0AuAFuRQmsbRwTI0kB3TVPbKeMbjTOXC X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfXyi3bSDj9EjR/ ASbwfNQMXdECGWUhmc8GBEG6WJ6mEeo2IdFiL+NKEX5+C6G7AKNZR3KlntQdL04XDUQvBvnldb2 hPv4GFX5j7FpU+pb+4KcBFPmOT44xRKn60R8ld70hcCy3A+1DGQqi65AJ1DwaM5jqgh3Z/nMNSy fhrKmN+E1u+aMbv1+GaUOQW1t56nyub6rtSZ2tHkV7spnwNecWyJgOT5D9IBSZ97SoTL8rAeK+m reHZ5TkomfZuI2bTCSoO0UG+QFOtX41sEewh4BwGm3d37P7Y+df/FnkhJCQoZdtKqPDLLxGuUq8 xddi5qIUxtAtU5AtnoPSJZQyWcyt1P0hfUG3G6O93qU7R6bosOLO0sbsULEtkPODKPkhPkhpcpJ bnC0iyyHE/kTPSUUx94eHEg14U3RXqVC4iSZOc1fzuWP7EkGtgf9yCFHhBwjYw1mECzWDHPTzMS W5Ev2pFoVSwmlLJenHw== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-01_03,2026-09-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 clxscore=1015 malwarescore=0 phishscore=0 lowpriorityscore=0 suspectscore=0 impostorscore=0 priorityscore=1501 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610010047 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 01 Oct 2026 12:05:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130582 strongSwan (since 4.1.2, through 6.0.7) allows a denial of service via memory exhaustion in libcharon related to the logging of IKE messages. Reference: [https://nvd.nist.gov/vuln/detail/cve-2026-78127] [https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78127).html] [https://security-tracker.debian.org/tracker/CVE-2026-78127] Upstream Patch: [https://download.strongswan.org/security/CVE-2026-78127/] Signed-off-by: Abhishek Bachiphale --- .../strongswan/CVE-2026-78127.patch | 117 ++++++++++++++++++ .../strongswan/strongswan_6.0.6.bb | 1 + 2 files changed, 118 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78127.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78127.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78127.patch new file mode 100644 index 0000000000..a667b57556 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78127.patch @@ -0,0 +1,117 @@ +From 1d758b2cd2f13af02319274c4e48cd7a2dc62e42 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Mon, 8 Jun 2026 09:19:42 +0200 +Subject: [PATCH] message: Avoid memory leak if string buffer for message is + too small + +This leaked 40 or 80 bytes per parsed message for the enumerators that +were not destroyed. While triggering an OOM condition will require quite +a lot of messages and the DoS protection also helps avoiding that this +is triggered quickly, it all depends on the memory constraints of the +system and the time available to the attacker. Also, if IKEv1 is allowed, +it could get quicker as the lack of message IDs doesn't allow dismissing +unexpected messages before parsing them. + +Fixes: 092958c89d52 ("fixed payload debug message") +Fixes: 6a4a47511f75 ("Show contents of the CP payload in message_t stringification") +Fixes: CVE-2026-78127 +CVE: CVE-2026-78127 +Upstream-Status: Backport [https://download.strongswan.org/security/CVE-2026-78127/] +Signed-off-by: Abhishek Bachiphale + +--- + src/libcharon/encoding/message.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/src/libcharon/encoding/message.c b/src/libcharon/encoding/message.c +index 8da9a1d71e47..a4bf9cb26b73 100644 +--- a/src/libcharon/encoding/message.c ++++ b/src/libcharon/encoding/message.c +@@ -1398,7 +1398,7 @@ static char* get_string(private_message_t *this, char *buf, int len) + payload->get_type(payload)); + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; +@@ -1424,7 +1424,7 @@ static char* get_string(private_message_t *this, char *buf, int len) + } + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; +@@ -1454,7 +1454,7 @@ static char* get_string(private_message_t *this, char *buf, int len) + eap->get_code(eap), method); + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; +@@ -1495,7 +1495,8 @@ static char* get_string(private_message_t *this, char *buf, int len) + attribute->get_type(attribute)); + if (written >= len || written < 0) + { +- return buf; ++ attributes->destroy(attributes); ++ goto err; + } + pos += written; + len -= written; +@@ -1507,7 +1508,7 @@ static char* get_string(private_message_t *this, char *buf, int len) + written = snprintf(pos, len, ")"); + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; +@@ -1529,7 +1530,7 @@ static char* get_string(private_message_t *this, char *buf, int len) + } + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; +@@ -1544,7 +1545,7 @@ static char* get_string(private_message_t *this, char *buf, int len) + frag->get_total_fragments(frag)); + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; +@@ -1557,16 +1558,16 @@ static char* get_string(private_message_t *this, char *buf, int len) + written = snprintf(pos, len, "(%d)", unknown->get_type(unknown)); + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; + } + } +- enumerator->destroy(enumerator); +- +- /* remove last space */ + snprintf(pos, len, " ]"); ++ ++err: ++ enumerator->destroy(enumerator); + return buf; + } + #endif +-- +2.43.0 + diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb index 43be8b287a..2ad92d3d97 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb @@ -13,6 +13,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78123.patch \ file://CVE-2026-78124.patch \ file://CVE-2026-78126.patch \ + file://CVE-2026-78127.patch \ " SRC_URI[sha256sum] = "07df7cedae56a7f3bb07e66d21a1f9f87e961db70e99184e11d3819413e4f87c" From patchwork Thu Oct 1 12:04:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Abhishek Bachiphale X-Patchwork-Id: 99824 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8ACE0CA5FB3 for ; Thu, 1 Oct 2026 12:05:49 +0000 (UTC) Received: from mx0a-0064b401.pphosted.com (mx0a-0064b401.pphosted.com [205.220.166.238]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9574.1790856346448975732 for ; Thu, 01 Oct 2026 05:05:46 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@windriver.com header.s=PPS06212021 header.b=eCHYwK9i; spf=permerror, err=parse error for token &{10 18 %{ir}.%{v}.%{d}.spf.has.pphosted.com}: invalid domain name (domain: windriver.com, ip: 205.220.166.238, mailfrom: prvs=473490b304=abhishek.bachiphale@windriver.com) Received: from pps.filterd (m0250809.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6918Elw7955840 for ; Thu, 1 Oct 2026 05:05:46 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriver.com; h=cc:content-transfer-encoding:content-type:date:from :in-reply-to:message-id:mime-version:references:subject:to; s= PPS06212021; bh=nDuz+aSW18l1bN6QE86YKVAVcdnf7oqisX6B/srkvpk=; b= eCHYwK9ieXG3WzzmirkWSCuHvNrrp8CRx2BJbFMdsKX91jmpJRVDFKyodGEYblFq I2Chjq9In7/L4pYafWZhAuVSWZDoSNIlNcDs5WecO/ftbcVPLjhYj3fXCpt0zK1k TWKcZR2+Wxsv/aiDttacchxlhjZOgedMLKkS2CcUmMNBpkAYEncvYWgCEw7ZXEGl +zIgiQudhI9tnTDrEwSrBBPOmOUIK9z7qTwNdLWtkrY7Zmfp8amhgo5dxhlbk8ju Z7rCbg9zrd2qjt4AnQ51ayzyIohifAO98/Tq5YTfLSuNrVdMnlXgoOuGFRAlzFQ0 2+/YURSbDBpkGxtMRnNJzQ== Received: from dm5pr21cu001.outbound.protection.outlook.com (mail-centralusazon11021111.outbound.protection.outlook.com [52.101.62.111]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 4h1ku8gasd-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Thu, 01 Oct 2026 05:05:45 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=ihjPtM/Lf2HUzAwJE7t0son4CPdK6vutyhxTB0oAfr31aNFrMaxX7S1YX/GRQOiSn3TS4Ysbhh4qXfLwzQNtNbmyTTGO95M9RQ/fklbLQ1I018tRE+JcWWqZHZ8gGMC9QnxOCRAZZko5SKHTf8jwOPEPR+JH7SrepAGzSBC+5IsMvc4vJhuywz2EquX+cUGQo3ckmJ+HxOZzt0qMKgCIr80HxwRKgI0kB86r1Exla10WTzzrltld7ZIpcH9B6m/YsQQXReJC9/lN4rvdjvy8OR04jMVArzBtj8ZniCYNZqBt2pBCyE+xZQjNJbqLC75RVNbRlptLwWy/SB/8fnBEWA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=nDuz+aSW18l1bN6QE86YKVAVcdnf7oqisX6B/srkvpk=; b=bVd7fUbXcttC9bo5++HgXeU67nksF8/IYwGdBmnePjctDkS3afUUPvVKlQBNnhGEg4i9mSIxKmD/TNThS7tOX16HBkSls1u4uoKY2/7C8ntYjBDLNGbD8QoKvUsb4q0M/Hjbvkob+h1PG2LmVMxQ7VWNXKCMsanp/JnXxHdvoziYvf4e0NrdBeHBlwlDNv1Sz2vcrrx/4dy8V5ZM5xGYW9wZUDK6QhxGvY7F9mmuuyInZKVMy3KvLHkEV+mWpK52yGK89Rt9ZXCO1FexlGF4rW+o5FJh8ABUZB6AErvE2wKdEXQ6SetaKtIw31BB/P1swo6dbZ0FQFVynIKH6dtx2w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=windriver.com; Received: from IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) by MW4PR11MB8292.namprd11.prod.outlook.com (2603:10b6:303:20c::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.27; Thu, 1 Oct 2026 12:04:53 +0000 Received: from IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c]) by IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c%4]) with mapi id 15.21.0472.015; Thu, 1 Oct 2026 12:04:53 +0000 From: Abhishek Bachiphale To: openembedded-devel@lists.openembedded.org Cc: Shiva.Komati@windriver.com Subject: [meta-networking][wrynose][PATCH 05/11] strongswan: fix CVE-2026-78129 Date: Thu, 1 Oct 2026 17:34:11 +0530 Message-Id: <20261001120417.1280843-6-Abhishek.Bachiphale@windriver.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> References: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> X-ClientProxiedBy: TYCP301CA0020.JPNP301.PROD.OUTLOOK.COM (2603:1096:400:381::13) To IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR11MB8399:EE_|MW4PR11MB8292:EE_ X-MS-Office365-Filtering-Correlation-Id: af3a1aea-0cff-4b69-e8dc-08df1fb4338b X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|52116014|376014|366016|23010399003|260925022911599003|260925021911599003|260925021311599003|10067099003|11063799006|56012099006|3023799007|25016099003|12006099003|6133799003|29003799003|22082099003|18002099003|13003099007|38350700014; X-Microsoft-Antispam-Message-Info: h6Mnr5OBsOmyQr5biUiGNFp+2Edszr+eqwCsfFCFGyonPscPr+SbE57nLbf8+zUXuC+kC1emCQM6lILmzAgy8UQ1wdACdbyLajk4GaWQSEUvXoex+w/0bnK0tido5jTjdn3MPHmuoBezNVOpM5GsuggHz2VYtj9rOYL4na2BQrpzKpulP2atTLIzGN+HJJvZmIkGkgerHqABsfV4RJYL9tXQCYYBvS3l3WDqPIFfr1bspsZS10UjAOOfA4PV8NBGISpdVU7PEpJJCVvORoddNrLjgo3S531arqCRelvi8a3f2EkL0899t4aIX4cv4d0Drpw5dv08u8OmkUMAGRB1vuyaeJYs0yUO2C4OZbBmOmzfttw/qOLbQ2Pp3HHYMztiPdpc83Qf1mA8nvXoPCWcTNeeiD//TXtHU8jSqNVCyTQogqS7LcdjCNiI5JA1jVaa6hdlisSj2HLKpuNcql+u3GdWJY5opq7vxGAgiNIqP7u8S4GgowagXEliDYx8vfC/IIp9EVEKjmOoi3ZZHC8btKGYiu7gv6/6YwCkXYyD+LVptJnr6S2sq2OwR08WcqJ0xGFVGYysWg7Dudu4d+3dkzhgkqcn08LtB/rShvNBL7+eDzBJ598qLbzWPIh91Gc4JLSsRz5Lro+PcFYXGIihbblCIfAtuCqTZGm9ns8hpY8= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR11MB8399.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(52116014)(376014)(366016)(23010399003)(260925022911599003)(260925021911599003)(260925021311599003)(10067099003)(11063799006)(56012099006)(3023799007)(25016099003)(12006099003)(6133799003)(29003799003)(22082099003)(18002099003)(13003099007)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: bG5yqIaVC7c/JL4Iu3MsKhaY0S2diLlrUK+PA9oKZ5osDvG/56dT1RMsQwE5PL1Ch9RVlDhr3IuOea7twAikNmv26oa5hODoeoAROqtewjTlJoq46395OHxireg/Ul2VKnPKCo9PWJXKriZRNIVtP5/izrk/EWG+v67NgjLVphWiidSRKUrZiX2aopb0hEVVWOt2hqwvmDDE1Jxod53SErF6RoiXLL7GQB3vGbE5buC5c6OqKTce4b0PcnCRhUWlT9xqLOYseRh/0T9AMVk0logMluhSUnR89+6XJzHk4dGEZMtX7KGOAjG1D1kKINy0LbEYhQ8q4piZVAuiN+WBmGO0toFVzml6RNWOZeLWKwInCySwL5DbJ/Vz0E5KbzMkaz8uT3ykgZut22FHxv7FpfF5kMyXMafJJBlapY0piGsFoCNcS122LCLPsIly5F9unH1yYQYXFQTXaJA77uKQT4WXNhXCKlacEGf2vLgUCGzKsNsavPcEgZKhWpK0noLWRXbywDRiTJQXbmVA6EGF9pxe8V26san4kIBxXOgObkmVGEwK7AnwVuyKe7PJ4BWAhtB8HquAIvgGc6LLhpIm5KqhgfrNPwYuEo8wv7aa1PjI3B+vbVV6+EI8pHzW0vw/KI8esb7Hv5oNU8FzSzf8iW55IRqi15t09Y3sbtqzVUygUpf9kjwzkuzsBo6GqbKaCGDmo1/yxV0JNQQhQESOCxHnXqdrrIObqPp+D83Y1E8w7c7AOqhV9smDRb2zaloOYXz18+ol3tNgLo33Sm1Qf5f1x9Fj7n9hxyxJR9MBHn8aUNHKTDTf1V+IurWgPSGUm36CrtI2ck2P1SkCG+C8GahHEgITSAQVDKzV4PYHupdnvvProY5knLBt6HRnocj/forJd8ORp3e36husR7CTtfAZmxVsfgZkvwS11AnO4q8c9H6pkqzR8vpQsOBkMQOxlc1tDvlzIDEkxWDYYBzK9BOSBM7KWyyqmxL87dfEVv01zxYzGcUoyHuz0L/G6pgvRo6sAhUeIAxoRHVo4Bde20goWqKSg+1gYrzEFSFFzbyaoLhjqYjMWLtOBecAiDiC51D/jUGCoALZHE7noSNSwZTLj3PJMg61A2+2GutV6vbf7kNX9bKjiH2C4PQx4DeBKXvHbRK+v6w0svyoqqIFFSbPwv9yD83HjABQnnPXMVPgx2BHXMgX86dzfA65Eeg8Rk1g5/Rion0zl7CX0YS2E/XxI2aEK9s+wsGRbISb3v5e7Pu8fQLxQ8uvODlMQXZpj/x0eEWBdM+LiUDY86OSe3em2O/Pgz70zgWt3ml/lX2VFwNbZtSHY+u1mR4iWzA5zmvkFXnQPSZQuU3bSqakrav0G4jOmOjivrkC9zxHvJoXEsY4Q0FzVa7nL8Jk8atofkcj8EovX1+jYbmtRGjomeAdNtz5iM3hdplVUXp5Ivh0D0fUhOGEHGjckgpLZcTYddL3uol7V2ZizFZ8I1mq0bzUEhw9B81ejY0JTn/VEmuO3phqjSGeSU0I4pqMVYdi+Yq6wSPQ5YAShPmak19dXZLLEEBZWIjiTme2fYQUT9dcRtgX0JBx3Nnc1WCM8XRHA4cePzbGoRfw4lcVqQ4wIJS10rQ8+cMNKW9asb1IaShmmF+q+C/qBqfqLuuxhv4MMpzA7pdaYB5XV5TV2+IrRMoYuWZO6AlLIBmFp9Dzv2FxhhwDYyIluEGGjZdFIXf4VPOd754Y9fwYnsG4qiisLw1z038JmpkRKLYIHp/b8i2KHD7jNaQAuFIIP1ikSJMO X-Exchange-RoutingPolicyChecked: tzqHa+qGMTIq0NUImQrGqa/Wulr/sYCOPNurbT+hPoV4IRWn+uP1OfTOv2c+ii5FotSctUT4g08GPFtA6DpSRlgb/zF2Ihvy/u6FZcZRvsbcaCRkUmK+bdoucvfO0p3j+GBJQtcwl7Stpr1lzHOiX/HjZvwLorW0WV28qpGHX5hi+e30rbMFOhknltXwZnR/fA66eNs0ibPGMwPdFK8Jxmzbo68p+DsZJLb4aXfFMuosb6BTPf1Y2kfpknqDhnuPUE5F7mZZgm02BuvZss9qdpFHVnqrxAkjCsuF5qHowwh2N6KJs6joeKwtJA+AcxarHXjkVsGixy+8ctLX+7e5qw== X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: af3a1aea-0cff-4b69-e8dc-08df1fb4338b X-MS-Exchange-CrossTenant-AuthSource: IA0PR11MB8399.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Oct 2026 12:04:53.1057 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: gajHKUVyHmhrp7N2AIWsrVgwVwvrAhMLaaVS9O4QvECGFCClhArr4jqq7LRgxTyPrAI5f3+6NNG3RLCNVb8MHOhcLR0q9iA3rw9wvwf3n5FTdVQ5fGJmwo91pYA0FZjI X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR11MB8292 X-Authority-Analysis: v=2.4 cv=c8Q+0h9l c=1 sm=1 tr=0 ts=6abe4c99 cx=c_pps a=pLVGl/zQNnluPJXkQhez9g==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=bi6dqmuHe4P4UrxVR6um:22 a=iKiJcTA2PjBS6x5JeXcw:22 a=PYnjg3YJAAAA:8 a=KiMCiSwjAAAA:8 a=xNf9USuDAAAA:8 a=t7CeM3EgAAAA:8 a=YiY5I2fGxHcONxC-_OsA:9 a=sPCYT0qwnquSfqsKqTDE:22 a=FdTzh2GWekK77mhwV6Dw:22 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfXxIRG6WWEq4EK 04zDwzPPcHCDz4vJKwKA0Qv1IzHNRmm2zYMQpjS7SAw6LxF154Djw28SCJ5alMg8nHBqyw2TeV3 neV3q8QLhq0ZaXbTfX3yDOAwCfUB3g0SK3bUmZ8+HLYF2IhY6yrU X-Proofpoint-ORIG-GUID: 8v6SYXesfSWQMTV3pSWczB7Juz60Z34_ X-Proofpoint-GUID: 8v6SYXesfSWQMTV3pSWczB7Juz60Z34_ X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfXzA2wQsjpuq0Y 8bNdo1QaaUENGHu/9EmtA5qn3Q4G5ygnd+bIcxReUEmbTTwXM27lonVJgXn2jKGLJtylvKHf/1v 4KSSgf74+ffmsv2dqL23xuuHQY+C+98XmLFA/MrRZq1Y5ceILh9Q51LMlhuwyTh05TtxgOwv2gT SzcP+eYxo32wdhtenyu7buJj/Gv5/NhCCDDm6Wcne/aDKMkNjWEaATY8V6gZLv2EyJ6VPntTAJC SU5YOlm7G1rhyUxOSK+DDwqqQ8CgFqqzXMJhusT6D2yvFtRmOaZCicJbxyNp+9LG3t3RxDRzdAD I+22peyByY51J/WEXhYztXEsJuPNXtSCFMWfQpR21zizUtKvEIa9GcAqSvGaAHWf83wJReh2oAx F9/idlK8r3hZHkcjXwknk6oFQKahAFDWnXnjnG2uSwDQtu+YAYNG0zZCcMNjX0ybVxohs+D2buX XoudvMOwj/gmni/DS1w== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-01_03,2026-09-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 clxscore=1015 malwarescore=0 phishscore=0 lowpriorityscore=0 suspectscore=0 impostorscore=0 priorityscore=1501 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610010047 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 01 Oct 2026 12:05:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130591 strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption. Reference: [https://nvd.nist.gov/vuln/detail/cve-2026-78129] [https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78129).html] [https://security-tracker.debian.org/tracker/CVE-2026-78129] Upstream Patch: [https://download.strongswan.org/security/CVE-2026-78129/] Signed-off-by: Abhishek Bachiphale --- .../strongswan/CVE-2026-78129.patch | 157 ++++++++++++++++++ .../strongswan/strongswan_6.0.6.bb | 1 + 2 files changed, 158 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78129.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78129.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78129.patch new file mode 100644 index 0000000000..9d18524ee4 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78129.patch @@ -0,0 +1,157 @@ +From e7a3a51459e795136c249bfe83978b41d7d5ecdd Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Tue, 23 Jun 2026 11:55:31 +0200 +Subject: [PATCH] pkcs5: Validate parsed parameters to avoid DoS attacks + +With the unbounded iterations, an attacker can craft a PKCS#7 file and +send it during IKEv1 to block the processing thread practically for an +unlimited amount of time. + +As the key length is used for an allocation on the stack, not limiting +it could cause a crash. We validate it after parsing the params, but +since `encryption_algorithm_from_oid()` only returns trusted key lengths +that are lower than the limit, that's fine. + +The unlimited salt length had no direct impact (the maximum is bound by +the accepted message size), but we now limit it as well before cloning. + +Fixes: 4076e3ee9121 ("Extract PKCS#5 handling from pkcs8 plugin to separate helper class") +Fixes: fd1ff46f6143 ("Added support for PKCS#5 v2 schemes when decrypting PKCS#8 files.") +Fixes: cab127cba66c ("Added support for encrypted PKCS#8 files (for some PKCS#5 v1.5 schemes).") +Fixes: CVE-2026-78129 +CVE: CVE-2026-78129 +Upstream-Status: Backport [https://download.strongswan.org/security/CVE-2026-78129/] +Signed-off-by: Abhishek Bachiphale + +--- + src/libstrongswan/crypto/pkcs5.c | 65 +++++++++++++++++++++++++++++++- + 1 file changed, 64 insertions(+), 1 deletion(-) + +diff --git a/src/libstrongswan/crypto/pkcs5.c b/src/libstrongswan/crypto/pkcs5.c +index 822656f84b22..e01010b90ad8 100644 +--- a/src/libstrongswan/crypto/pkcs5.c ++++ b/src/libstrongswan/crypto/pkcs5.c +@@ -14,6 +14,8 @@ + * for more details. + */ + ++#include ++ + #include "pkcs5.h" + + #include +@@ -22,6 +24,15 @@ + #include + #include + ++/** maximum accepted length for salts in parsed parameters */ ++#define PKCS5_SALT_LEN_MAX 128 ++ ++/** maximum accepted iteration count in parsed parameters */ ++#define PKCS5_ITERATIONS_MAX 1000000 ++ ++/** maximum key length accepted in parsed parameters */ ++#define PKCS5_KEY_LEN_MAX 64 ++ + typedef struct private_pkcs5_t private_pkcs5_t; + + /** +@@ -379,6 +390,41 @@ METHOD(pkcs5_t, decrypt, bool, + keymat, key, iv); + } + ++/** ++ * Make sure the salt has an appropriate length ++ */ ++static bool validate_salt_length(chunk_t salt) ++{ ++ if (salt.len > PKCS5_SALT_LEN_MAX) ++ { ++ DBG1(DBG_ASN, " salt length %zu exceeds maximum of %zu bytes", ++ salt.len, (size_t)PKCS5_SALT_LEN_MAX); ++ return FALSE; ++ } ++ return TRUE; ++} ++ ++/** ++ * Validate that parsed parameters are in an allowed range ++ */ ++static bool validate_params(private_pkcs5_t *this) ++{ ++ if (!this->iterations || this->iterations > PKCS5_ITERATIONS_MAX) ++ { ++ DBG1(DBG_ASN, " iteration count %" PRIu64 " is out of range " ++ "(1-%" PRIu64 ")", this->iterations, ++ (uint64_t)PKCS5_ITERATIONS_MAX); ++ return FALSE; ++ } ++ if (this->keylen > PKCS5_KEY_LEN_MAX) ++ { ++ DBG1(DBG_ASN, " key length %zu exceeds maximum of %zu bytes", ++ this->keylen, (size_t)PKCS5_KEY_LEN_MAX); ++ return FALSE; ++ } ++ return TRUE; ++} ++ + /** + * ASN.1 definition of a PBEParameter structure + */ +@@ -399,7 +445,7 @@ static bool parse_pbes1_params(private_pkcs5_t *this, chunk_t blob, int level0) + asn1_parser_t *parser; + chunk_t object; + int objectID; +- bool success; ++ bool success = FALSE; + + parser = asn1_parser_create(pbeParameterObjects, blob); + parser->set_top_level(parser, level0); +@@ -410,6 +456,10 @@ static bool parse_pbes1_params(private_pkcs5_t *this, chunk_t blob, int level0) + { + case PBEPARAM_SALT: + { ++ if (!validate_salt_length(object)) ++ { ++ goto end; ++ } + this->salt = chunk_clone(object); + break; + } +@@ -421,6 +471,11 @@ static bool parse_pbes1_params(private_pkcs5_t *this, chunk_t blob, int level0) + } + } + success = parser->success(parser); ++ if (success) ++ { ++ success = validate_params(this); ++ } ++end: + parser->destroy(parser); + return success; + } +@@ -471,6 +526,10 @@ static bool parse_pbkdf2_params(private_pkcs5_t *this, chunk_t blob, int level0) + { + case PBKDF2_SALT: + { ++ if (!validate_salt_length(object)) ++ { ++ goto end; ++ } + this->salt = chunk_clone(object); + break; + } +@@ -500,6 +559,10 @@ static bool parse_pbkdf2_params(private_pkcs5_t *this, chunk_t blob, int level0) + } + } + success = parser->success(parser); ++ if (success) ++ { ++ success = validate_params(this); ++ } + end: + parser->destroy(parser); + return success; +-- +2.43.0 + diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb index 2ad92d3d97..06668fb19a 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb @@ -14,6 +14,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78124.patch \ file://CVE-2026-78126.patch \ file://CVE-2026-78127.patch \ + file://CVE-2026-78129.patch \ " SRC_URI[sha256sum] = "07df7cedae56a7f3bb07e66d21a1f9f87e961db70e99184e11d3819413e4f87c" From patchwork Thu Oct 1 12:04:12 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Abhishek Bachiphale X-Patchwork-Id: 99815 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DAE66CA5FCC for ; Thu, 1 Oct 2026 12:05:18 +0000 (UTC) Received: from mx0a-0064b401.pphosted.com (mx0a-0064b401.pphosted.com [205.220.166.238]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9562.1790856317102550122 for ; Thu, 01 Oct 2026 05:05:17 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@windriver.com header.s=PPS06212021 header.b=lRiWAC1D; spf=permerror, err=parse error for token &{10 18 %{ir}.%{v}.%{d}.spf.has.pphosted.com}: invalid domain name (domain: windriver.com, ip: 205.220.166.238, mailfrom: prvs=473490b304=abhishek.bachiphale@windriver.com) Received: from pps.filterd (m0250809.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6918Ecew955562 for ; Thu, 1 Oct 2026 05:05:16 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriver.com; h=cc:content-transfer-encoding:content-type:date:from :in-reply-to:message-id:mime-version:references:subject:to; s= PPS06212021; bh=EMAHVE8QdJYklYiuL4j50HpLKgSd67YFblaS8zqszFk=; b= lRiWAC1DelSyNhPNyAQTauh4gVOEdRHMcin0NcHERtfQJ8sUgdrDczeS4/nKHEzm M8p+wz+THiMHXHweX1GpVZqXFazNhbS1XltwRGCZ5FyG5unERr5lHsHyHNrbHU8t UWFbUN+8oPq0TFHA8G8876cAz0eyjdChcNkXVJtr+izlJD5XHSgzte+CuUq6Pw8o RspZQa6uykLzr3rxqFaC0i9QeICzCuQVgTu0G7BPzGggzTR2x0u1lkw2hvDz1B4/ dyWu0qG1+oXnJpRNgLMiBUZyvvyU1vt8j68DZgKW75MGTr8Bj359XXW9OEUlJxkZ o9f/b0KHxf8tvtSmEQIPWQ== Received: from dm5pr21cu001.outbound.protection.outlook.com (mail-centralusazon11021080.outbound.protection.outlook.com [52.101.62.80]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 4h1ku8gaqw-2 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Thu, 01 Oct 2026 05:05:16 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=rEDpMwU9BrDs/1y7yjO7xrpooG1i+4KafPYGWHhJPbrciESgCFtVN0TqXlZB6riOvNhD452fpIOehnYmHHpXIAUYjNeVsCoot4w00/bv0llhFAsJAfrcxccmNWRDlW8JDsHLEDSqdMpHDtfd0Rcx8QNPS3xg9j0TpxX9qG7eEHUtpFMGiDPh6SLdDAFPuh2HDIT+XrO39a83kxMtoqeuGgd+B2LMaxVcDOxoi/aB3/J9qIzxy9vrvHP5jkdNtjMl+ucfHmzJY0QFCL7Qc54fFCEQNBebRLNPAdUGWYFkjicjt6B2uKkttVktcdY55+CvxkT75RwuZuPauhypuVzy9Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=EMAHVE8QdJYklYiuL4j50HpLKgSd67YFblaS8zqszFk=; b=CwOTTRKer/x/0R16EV88HAK3P+A8ADYFpPpMK2ENjqfv9jHNSXuSSn8qoamtP9oAosbWTOTzvb1O74WwFpXBRx6mCH3Is/u5EESPrIbtAUyN7hNLr1YXy8dy/pUSKJpS/zp7dYQ4JHIvVPUUXSEK57l74XIgwnokefhayHAihx0mjs4UZa9iI3sUpVnd+6oLbEHWyle6TSFxG7aGmYh+BEWM3vwVWGolfOqIB4xTZ0UIsWQEN8XoAuNcIXBPvWGJbE2H+jI7psBjU6Jig4kEbKYmbM6cvlq/+R7+sE0wu7RwcHNfdnyxY79gCLf+V7Ir3eIgLB4AZU474i1Y28aOkA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=windriver.com; Received: from IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) by MW4PR11MB8292.namprd11.prod.outlook.com (2603:10b6:303:20c::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.27; Thu, 1 Oct 2026 12:04:54 +0000 Received: from IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c]) by IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c%4]) with mapi id 15.21.0472.015; Thu, 1 Oct 2026 12:04:54 +0000 From: Abhishek Bachiphale To: openembedded-devel@lists.openembedded.org Cc: Shiva.Komati@windriver.com Subject: [meta-networking][wrynose][PATCH 06/11] strongswan: fix CVE-2026-78130 Date: Thu, 1 Oct 2026 17:34:12 +0530 Message-Id: <20261001120417.1280843-7-Abhishek.Bachiphale@windriver.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> References: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> X-ClientProxiedBy: TYCP301CA0020.JPNP301.PROD.OUTLOOK.COM (2603:1096:400:381::13) To IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR11MB8399:EE_|MW4PR11MB8292:EE_ X-MS-Office365-Filtering-Correlation-Id: bc961cd7-5a7c-45e7-f824-08df1fb43490 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|52116014|376014|366016|23010399003|260925022911599003|260925021911599003|260925021311599003|10067099003|11063799006|56012099006|3023799007|12006099003|6133799003|22082099003|18002099003|13003099007|38350700014; X-Microsoft-Antispam-Message-Info: 6U0ladHBtCNyoOJEBDvDvFNrCB8j/sYR9fHCv5qx3fKmPfwqolYywzwqk8LXDioRcEv0tstvdsdRa0r5/ieQf8sMEy0Qp5B/T7oEGUXAZLSdagaDL1Cl/rzkWH5EF9r9wV6DucelU/P3rf1u2ZYZ5JYJfDjFv+JA1uhIK+WCacS2COS1TJseKE7exBHt/DjLvtXOzv4mipeJCLQBkWr/VwIxKlvoZxg6ypi+v45KRB7g+hdXLYUExbYg/3YpEy9flKtA9Zn6aNQ+vCtkpBo4lW8wnSc2YvLtILIjBn9vMxGQoXYOGAyGvz/y8RTHCxC3GMHaj3GqA/+V6+j4KedhG7g+K7krxnt562IvscWZOghkzhyStztBdi4eAODalfeJQ9YeUk1+eAaxgXXcr8g1pxo42HmYj4r6k+O95CuMQCWGSb519WNCiaH6qKfRF8lRNV3ivX6Clioa6LOZE9NY59I1lN0gAcmJ9qVjF/ZNtwEOrqJFGQpDXDhJhW/C5pjdW5IhO6FBFeykqZFXTSDsNw9HSYxvcGQdIaABPA90vLHa+aLZ+TP67MPQpeYF5ftYyCqhRypTEF8CC4m0tEOWXC18/proEqhBSSPgSNAL5nb4XAiqVOQiCm4Br6y0+TP4n0uGYYTtcSMx/3Qec43+K/Pw0Y5LUvP7TCnXZgssNhw= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR11MB8399.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(52116014)(376014)(366016)(23010399003)(260925022911599003)(260925021911599003)(260925021311599003)(10067099003)(11063799006)(56012099006)(3023799007)(12006099003)(6133799003)(22082099003)(18002099003)(13003099007)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: gK13Q5nwJp7ppgL9UUuF1V3cOvccnPOtxkkQU28sinEWx0FyGsEXy6LfJp84HUDvb/ni6r5+tAS9NEAXIeKmtxgbVAgIt2cEXvChYpKL2fBH1OCmyAhjCrCEjQFs+deH8qQpXQ/YMbm4W5zl7wuWeej3tkjafAJD1f9LekYuKwYEobXSKTItAltLUI6AOtRQ0yOMQrXJaBMkeExS/sPtee5G5X/B5SCpay0hEUnIgTXx+yCE+Hu3po6A4q4bA/w7lA13BByIAtgCeRgrINmGAHWUIyQZTGObykVHOg+aZgTdMptY4AAJkDggCGrNZ+3tqTbw/n5m+SRp6XpYk+XSng2hBeMaQDFFtBxpaJgvB9cEtGeZR1C9L8m3ajen71sgFiQ2mkAFL4Wuc3Cgx0t3TB5iVFGvR450w84yYgunQwi2a799m+kseJN9c+SczvnVclWJHLCDOHxIjI7hyBqC+ucCg6Wk+KemPT70Al1d67PB3cbyhzojXCH5U2+55baCqs5ZnydEUwcn1tRPZBoP+HVwqr0ga7ARb540GIxw0Gz5+rjoJ1+9QKKU0ywjQKVTmh9J+hexuACsAu2XxaEm7rdbtm0fwjSPnJR51dgLQOA4H9PsfFVz4Ydp1Qs3mNXeweJmzapR0SfjI1uK1EEcU8VTmQgOyGMDonS7WgqlS+AIID+pgLx6wAH8MO7DA3UX2NSEy7s0QIzUIbvbqYxIzl++1dPS2nebVTu/qi3dgrw3Zxd6f1FDvlNWxt5m2my0e4ViZ1xwGIbLM+TKC4tItMREwwNevSZXhgu5o6YRqVsCBm/khTYpwGF+uHhP1so+jHulHfzgZ1Bz8hliqUe5by9M0l204aLRlBy/KUv4uFSO9zf3VNzr+v7W2gOteg91WpivrS1Uzj+9+RsKbQ/DwdcYVxchope17zFIDEByMKphEjVoJG4AjUbGgin6iwbHb9BQR00Q53xsBW0ud6FWaaaEyDM1O2bl1eb5eDeC9LqjMNNJa0Uxpc4A9wiY75w20xW2MD+2ULpTheWnQ/DmqtXgaYFQq7XF78QjLvz7pB7ppmamexMphDn0TqzI9XwV0rcEgA65jBHLZzkqZuWYYCz3wulXdWsRvTW0OK+wK+4qkEG1I2A79jxsYQyPlrpA9Xw8Kw8Opk+bhg/+IQGSC6ZqMXlQmLc4wudeR0rbMP5WJRgF3NwddfbWMmcIoSQIQoMucwsJ4neFm5IJxzR4FxRIycfNkgIOFabtSBsh5zIUr3cRMUEfTGU6r2kb3OBmeD4FCi6TKCBLtKOOjwAAYkssxJJSvZrs5tru3tUD3KkibxOYPUtdyR2ufIxhqyHzfg3WS7BkOwg/agT1aU8HwVnS562pQwpSo3T1p3ifPh1Mll+0TLFXj0ikntCiJecc89v7ihUbIvKYDi6dS4Ki/a8dbapPz3xGsYTSWXjYCojUj/Uix6EAFcMmF3TXbUhOH+EGaTa2v0al9AF5tuYIgibOzyLf1Kqthr/zRYCZwpvsHNRTWNxAAhYUI9FYztmcN5ks1LWtAZFlyBayp4yqvLdXjq/uOrwZRkARDiWeVrDmlOVUGaTi4YCHtaNldSsqIyi9h55eXcMDzz1LKdPPF/s9RLEWTLVEi+JyRHkjZzilZR7P+BC5IRklBr3wRNkXjzGoytFiW/LviXXsksQPpnwwtAZisRV/qw+eNa7PteIxIZOm+uD8YbU5UUMB6AkgtlzCyBO4eL6zeyPUtVeYEEMaOk2ipdD+N7xtnraCzqKzlXqLNVwL5dtFOd5ouoO4 X-Exchange-RoutingPolicyChecked: XUeDY255hOTF6EpOb3rxIIaRqda2hsmGFJsqfrdjp+US8YeJfeTT3AN0M2W/5ZzuXYZvmwlYCJM8zeZ7x+ITb3XwnADEUBULDLKlIAsZOKnsfG7UtlzZVZ/GzvMlsFT6ut9tLk/blaI/7OaTplTPK990cH/B2hK+34oK1C7m08EwjvrtEW5VgyZhdLOloxsIH4WeM6YR/stZwkAUU53i60XbCRPNeGH905zX0YBl7EeRXHgF8FGrCpxOEAESNt69oOmNpTQfRykuJ6iClYHreKnVzRe2C01X8G8R9bQWiRO1/Yt713VIa5iFJ5UgiAJ1aO+uyYrawvUcbhzbXnxuMA== X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: bc961cd7-5a7c-45e7-f824-08df1fb43490 X-MS-Exchange-CrossTenant-AuthSource: IA0PR11MB8399.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Oct 2026 12:04:54.8212 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: q1oWkUWjrPAWfkNINlH9qEOI4R+fh/g9/amLEpJB1eDE7mNSOATjC0xbMF7CBAhNPi2VAMHXUMA2x3lf8ivaTDUbDHcBMe83TeeoNdJi7+H/fhdvk51qg91/iptFDkbP X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR11MB8292 X-Authority-Analysis: v=2.4 cv=c8Q+0h9l c=1 sm=1 tr=0 ts=6abe4c7c cx=c_pps a=rDyEm/81vvKQCy/iKDMZrQ==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=bi6dqmuHe4P4UrxVR6um:22 a=iKiJcTA2PjBS6x5JeXcw:22 a=PYnjg3YJAAAA:8 a=KiMCiSwjAAAA:8 a=xNf9USuDAAAA:8 a=t7CeM3EgAAAA:8 a=w4HlngbNAmabE5WA5hYA:9 a=sPCYT0qwnquSfqsKqTDE:22 a=FdTzh2GWekK77mhwV6Dw:22 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfX5iHGNMY8wLOI ZdbLlfqUy53hETtTv9xheEa8IITC11gSKUtv2JQONPXMgMXuXOnSLA/xNk1FQbs4mPr8Q1BIO/J jz2cfbx1ScA8aLudPslo7BpURC758S6I/ISYEn9pWW6Oe5qJk1RP X-Proofpoint-ORIG-GUID: qGVrrNUdCRCe6Otv22W58zJ5rLC3F_LY X-Proofpoint-GUID: qGVrrNUdCRCe6Otv22W58zJ5rLC3F_LY X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfX/L8PLNT+5s9U 8N7nr1+rR+M4ttcvG3SzjtzocYqTrF3Recoz+YjLcylszDCTNwD676yYp9c6KGnh5ilTNQ0qJgH ehs3JpI/2uNPAo8F59FL2bevbvWZbLulTrb8Guf6D6iPr/GaoWUHnEAkcyLJH9XAAoAGpixEDVM zL9Cgstqvd0c4ZftD5yreX+xQjpR2UlCJWnLC4w47RcD15WiKrXyEjnIAmRH9tZYXphUAG1RDm6 sSgP7xftgVu8BQ7hrI0ewdhYxFdY51Q1Bv+5LV/r42EFpkaSJD4j4srO9olWeHfGjATOq14ZKQl pFbdxjidkT92a0Wcuv/jpV2Mmy7HNCD2oBSxx6K0SXXTbuzSbbQwxM/qOcqT22Qknc5f1USxmUz UMGeMmukcdHhY4dRJXiv6SUH4jtFQZz7FUSbZhaQ8KeINktwqTgrvk2zH4EnoV5fJCE6TuwlUbu XNjE0WLyLtJxtP5JImA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-01_03,2026-09-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 clxscore=1015 malwarescore=0 phishscore=0 lowpriorityscore=0 suspectscore=0 impostorscore=0 priorityscore=1501 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610010047 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 01 Oct 2026 12:05:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130583 strongSwan (since 4.2.0, through 6.0.7) allows a denial of service in the x509 plugin related to the verification of X.509 attribute certificates. Reference: [https://nvd.nist.gov/vuln/detail/cve-2026-78130] [https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78130).html] [https://security-tracker.debian.org/tracker/CVE-2026-78130] Upstream Patch: [https://download.strongswan.org/security/CVE-2026-78130/] Signed-off-by: Abhishek Bachiphale --- .../strongswan/CVE-2026-78130.patch | 51 +++++++++++++++++++ .../strongswan/strongswan_6.0.6.bb | 1 + 2 files changed, 52 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch new file mode 100644 index 0000000000..92768c2bb3 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch @@ -0,0 +1,51 @@ +From 4dae392b32a2c56441fd7ca50ad32a0874455995 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Fri, 19 Jun 2026 11:57:48 +0200 +Subject: [PATCH] x509: Avoid NULL-pointer dereference if issuerName is missing + in attribute certificate + +If neither authoritiyKeyIdentifier nor issuerName are encoded in an +attribute certificate, the validation in `acert_validator.c:verify()` +will cause a NULL-pointer dereference via `issued_by()` (the lookup +with NULL identity will enumerate all trusted certificates). + +Fixes: 26930a8c3e42 ("certificate factory can load certs from file") +Fixes: CVE-2026-78130 +CVE: CVE-2026-78130 +Upstream-Status: Backport [https://download.strongswan.org/security/CVE-2026-78130/] +Signed-off-by: Abhishek Bachiphale + +--- + src/libstrongswan/plugins/x509/x509_ac.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c +index 4fa9f6d0a3e0..4436bc4debef 100644 +--- a/src/libstrongswan/plugins/x509/x509_ac.c ++++ b/src/libstrongswan/plugins/x509/x509_ac.c +@@ -897,7 +897,11 @@ METHOD(certificate_t, has_issuer, id_match_t, + { + return ID_MATCH_PERFECT; + } +- return this->issuerName->matches(this->issuerName, issuer); ++ if (this->issuerName) ++ { ++ return this->issuerName->matches(this->issuerName, issuer); ++ } ++ return ID_MATCH_NONE; + } + + METHOD(certificate_t, issued_by, bool, +@@ -934,7 +938,8 @@ METHOD(certificate_t, issued_by, bool, + } + else + { +- if (!this->issuerName->equals(this->issuerName, ++ if (!this->issuerName || ++ !this->issuerName->equals(this->issuerName, + issuer->get_subject(issuer))) + { + return FALSE; +-- +2.43.0 + diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb index 06668fb19a..d0b015f741 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb @@ -15,6 +15,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78126.patch \ file://CVE-2026-78127.patch \ file://CVE-2026-78129.patch \ + file://CVE-2026-78130.patch \ " SRC_URI[sha256sum] = "07df7cedae56a7f3bb07e66d21a1f9f87e961db70e99184e11d3819413e4f87c" From patchwork Thu Oct 1 12:04:13 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Abhishek Bachiphale X-Patchwork-Id: 99817 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BF182CA5FCB for ; Thu, 1 Oct 2026 12:05:28 +0000 (UTC) Received: from mx0a-0064b401.pphosted.com (mx0a-0064b401.pphosted.com [205.220.166.238]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9563.1790856319677132753 for ; Thu, 01 Oct 2026 05:05:19 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@windriver.com header.s=PPS06212021 header.b=Lz039Brd; spf=permerror, err=parse error for token &{10 18 %{ir}.%{v}.%{d}.spf.has.pphosted.com}: invalid domain name (domain: windriver.com, ip: 205.220.166.238, mailfrom: prvs=473490b304=abhishek.bachiphale@windriver.com) Received: from pps.filterd (m0250809.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6918Ecf0955562 for ; Thu, 1 Oct 2026 05:05:19 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriver.com; h=cc:content-transfer-encoding:content-type:date:from :in-reply-to:message-id:mime-version:references:subject:to; s= PPS06212021; bh=/6xP4Qv/DMcea83CQnazb0aKCbw6jq5XWLO26nG4I7E=; b= Lz039BrdIhT4NUw7LZP6inKGQ4/g66iWLt7ash9xjtlQQZBw7wk4FhcjLjC6XtFs Z+SdgWqeblCtXF2lqDrKnI4SeSwdkL9nIuehq85iG+TforrFQTN0egCyRojM4PxQ SesPDipvAkUgA5eqysNNilU3hSTM+XN66NJ/DtnB2MWMqywnXxgSNM5aN5c534SD sEzKCzMwelzhmjW6mspaWEtE1v9H2gHCZ3sjegw9zRHp8UoDyE46y8YB53ceNGPY SqZGJtvds93fcvO3CNFHLd1KIoJG2HTen1uXobhc2UiK7IroMmUNizvhyEwL2MhS Yt9XLwxGH5TqPLEVgSlI4w== Received: from dm5pr21cu001.outbound.protection.outlook.com (mail-centralusazon11021080.outbound.protection.outlook.com [52.101.62.80]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 4h1ku8gaqw-3 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Thu, 01 Oct 2026 05:05:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=dMpbcD5GLaERThrw4oXlxiGePaQxFoV9qnoByfiE6V02ubWFqU1VAQuvAWYVvc/Tt9y8JQG99pSCofsc4MUWJ4q0xcu6G8siCFeAYz8Etg6bSex7J2/na0LWsX5XKbrYoT6X5QzfnVS3sK4fIpye1i/AvF2b84rTr+Eyu0D6Gm9vCKkUwK0letvw+X8HUsN9wnsLTVhEOeUNp7ORI16PX0QvJp7ORCKsQ1g7+TXhUakA88GCBOpNAPjTgbOKg6aZkfr6ghkTYtbXSLt4LggjKigdo9pj5UjrdVXIMdUy+CVvtOuQgR2b3ONTcRl2LlJUvQvCJ36HdA3M7Te/4xRYoA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=/6xP4Qv/DMcea83CQnazb0aKCbw6jq5XWLO26nG4I7E=; b=JDZmtNd1rsZHk8jHOVx310crSw9/MtDVKovwZHO9RAsp3VjdkZ8nytd7cdWHK+Yf0oKJAU6G+q0q1hFQIZoCMxM1+ZtlJB8pGuBIvBZsAYIk/3Wg+obB5Vo5vbvbYDqNQGUPCEm7zhCsp3dRxtJqWlnZQo+hGUmSgYYKk/Rrzx4WFHu7UvjADbNX5mS+4Brb5xoY/SU1JfHxd8y++tJXZMgutpyFWsCVG/PbQsNgqN54JH57v874vvTb1ZgUTI/6+CbjbVDfmcMq+SEeVDae4Y2LOuzdhAJniP4QGt/DEmpfxzjt6+Ptuoxp1wESYF5SmDQB9ewDFrjkMpOfpUrAqQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=windriver.com; Received: from IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) by MW4PR11MB8292.namprd11.prod.outlook.com (2603:10b6:303:20c::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.27; Thu, 1 Oct 2026 12:04:58 +0000 Received: from IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c]) by IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c%4]) with mapi id 15.21.0472.015; Thu, 1 Oct 2026 12:04:56 +0000 From: Abhishek Bachiphale To: openembedded-devel@lists.openembedded.org Cc: Shiva.Komati@windriver.com Subject: [meta-networking][wrynose][PATCH 07/11] strongswan: fix CVE-2026-78131 Date: Thu, 1 Oct 2026 17:34:13 +0530 Message-Id: <20261001120417.1280843-8-Abhishek.Bachiphale@windriver.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> References: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> X-ClientProxiedBy: TYCP301CA0020.JPNP301.PROD.OUTLOOK.COM (2603:1096:400:381::13) To IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR11MB8399:EE_|MW4PR11MB8292:EE_ X-MS-Office365-Filtering-Correlation-Id: e64d5573-eecd-409c-6955-08df1fb43590 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|52116014|376014|366016|23010399003|260925022911599003|260925021911599003|260925021311599003|10067099003|11063799006|56012099006|3023799007|12006099003|6133799003|22082099003|18002099003|13003099007|38350700014; X-Microsoft-Antispam-Message-Info: tKd4FjhS/CqhwIzbYKGzecwDZKhw8UCsYLLaBJP/pmxZTs8KQ9EAfO9OsSqT2w+NE3amzY86eieDkb9eW7QPmCDYywj/EfaXmzJ301a2wC/91jJnYDspEoxjo8oBlBBYNBP6keYjNh1iVpC3H2Gra3jVqMcM6B7G76LH1ygvA27ddYEt5V4QgXWeYNkQRznDvQ+ArInVAOne8+A3BIuD8i0B3DE6fOfUVV4cbWpdp5GR4ZpPtG1YVyWUjfYJDyExUULrOqFqY9hvmlkJX6BKCdyz0ywvMx9uxKDTmylZz51DR3hGsWC/UI2NgoApv4s/TuXL9t51cZeyEzypezK5GySDK/PB0aaInonH/gT/QodtfuSa2xnciCPKX9taCyKRIYqBm9TCxjKES8MN/vZtmNDPT8gkvrqWPWt2QjQo8q5yu95hHk2Y47VbA7eNeuGfuqAMnMs7gY8drgOoslexKF3yd0b4SAihdRflVN9OsB3e1ktIwdkYCvoR1sx5VtAjkCnZMd5Dqy1tUeLhVJTJFqw8y2NuXoDdqY/ohaBvDluaPkrBF2v61bl0Yf2eBmHL3/X1irXE7+JPY3RcYqdaXkwCnxJvvRETShsubW3410jqei74ffrH7X4oWywS/yhw0p0xr9O/3f88zYZwRUDg3z1wR9n6u2Sdjy/XUJITwGk= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR11MB8399.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(52116014)(376014)(366016)(23010399003)(260925022911599003)(260925021911599003)(260925021311599003)(10067099003)(11063799006)(56012099006)(3023799007)(12006099003)(6133799003)(22082099003)(18002099003)(13003099007)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: QtW1BYNFkdzs7gPc0QuoNjnFoDAZxaCfRibHBj9RquLMMJl5rTXANDSwVcj2aIAj//D0CgYSoDjR4WtCFfM8QfvBWwQ0MgfBQdiOmPBxdTlNCPQObpU7/zKujzs8MauzUr4AfUuJ2QBeQ9rICEwlLiLw4jqeUWVCtQ7GHPiKS3R+yKNjLROsD6VRG1QG6QuI6ujvzDsrstMXz6lmAbfQgZNHacI9ekADT9zCI8kJ+gMnREcVq9rEREIJ+dqMcIXBJnsU8B9ftoTbKI4j4h3LvhnYTEpgxakPbXBLrYS+F3lBOf3Qv1z+9LDxARpTOcrdqLq6riczxhfthf5UYZsjt7xsvN34btNP02KrFCTD1q+0rM43tQ60L/2ts0hShxjDArOOIb9TKVoKpijRxs019U4aMrKhgrpwPBvLDuCXkDh7jZTgrr/QR7X8oXHb1Js70Hra7JsOQCMye1zTXZF30+BDwNVdB5O4goQGhI37BcfnHKQQkPMQwFIaRN0WY9pdg0OhsUbz2HqOLg4z/pbJBRxLXoPxnCuR5eYF2JERScw6zKovyeSJH1G6CKY8XOYK5SVuiMB3hg4vcp05F2IND1QVWFpMSa8bIFURqffhmu9wIhCfhKWQhJsYDS1tET2VKvI9LV/t16ByBYIdGlTV3B3h7WMU7KQlw8HZsofZKNh/riR+W7qC9GlZNFrMKBwQIiYZOxBFEFlFFjS/bkLephCsJ3xkspjunM0ce/bBqrlD0HfHn/q4hR3qvgzBnGQfk7EoAJxfe9FD2YEDkUSqMJucUuxxEo81wIhoOt1UJGdhTA+j1GieEBa+w4Vt7Lcx2opoaMuSXyRac6zpbV5MfIfSdd6LrhiEySw+zZ0WfzfVAiVZp3RbbQ7PptONMoDuu9GSxgYzaq3S+Yt5n/6yb814hwy69Ws8XxvbxoyXrdJFUNgsOJY/KsRV52exnZMaAgIJLZ6NO8QBNps6y0DlYH3eSGFelSuZhda0+YXC6exO7Qj7/LO0dIR2B2T9eCDv5UpZvtChqDYGn58WH37ArYQe23Smc499lXmzV5MPbfWXJ2ZvQJYWFs6NFX4Wg01jeKgO0bdMwiM5tJoTA5LOty/rm0NMOCTwe4ii+c78ifUw0ci761muTVvKoh6GVkek5xM5zLd322yS3GAJvzs8fGJ1CRyWAtWKCZv8CBrAmsHDPe3O2CeNNrv4AjCoGKkmLXwdxEEnsUV1FAnJt1uCRLK8bJmA+cFQWRygJgwQ9fS0YiyLKuPtC3lDLF47FyPI1Zgy0pNeBLRHZcGqBWHs/uzKpi0V/URtV43qeGDeQV18IEmhb7KWDnUPaGzsspiP7q2mgscSdhF5BewDttS5iDP84tReGb5d04t1E556y/e65nHKvwVxnIwmZlMgSobcdL04fIPjg8Fz82vlPDjzYUoLzDsMbmA9zBw0DAP+ZL6VEN5yopbWlU4EBz+mAszQxgJsrybmBet1Y4T4HDeWKGBQhOHYYpqITQk6RAmYV228xkyox8qJcNOcKr5C0jcRQGSQawkEkICoJokVvh7zmKAgwk0+0R3msZmNj4Bi+30C+lio2S8kMCgHcX8BLbwlYfy2dhXqtG6THj17gxnjoRWFCg75V1OukMLzQgf0U1ZNl255Ik1QsS9Xc4FqUNER64at+fh9Q6P6Eb4gLIXU+dORnWbBvegD5xVo0ovGxgOnzF09ugDz918hicGe1/xWPEDmvPM+Eix0jIthcux/oGNxzLfVRiaPyqUF+jpwoj8hpRpQokytD8S1+p/n9oXt X-Exchange-RoutingPolicyChecked: du/yV1JP86KwVRRgI3cb5FN40GC16heNApR5IkrBctUXbs9sTD8VWeh7AWYLw2l2wGr3rweI1Y/ktgxhRnqdVFn7bjKCRGjgshkuipIbYmhvqSPk91nxlmoRhVl2ytLrRjruwLP8WusT4Q4eY9OtFDHpl4R0hq+KoU6dZpVkL7dgP5CXwI7/vWEmulKBk6VWyTFzy8wM1h/Y1PiIQCcrgSwMU7OGNRBOLfkcISgNAG/INaIcqyH3GNeAkQwXhxPQ8LTd1CHZoNX+4ps6ZKMuYDC6UdivWxSnF4T1FoSoqiW+1dsFSAdjJT+3Ay5/yuhPAaXp+cZ8zwvb3wrlCYcOBg== X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: e64d5573-eecd-409c-6955-08df1fb43590 X-MS-Exchange-CrossTenant-AuthSource: IA0PR11MB8399.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Oct 2026 12:04:56.5175 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 7SD/TbGDRUL0/mPewkJUKquU+ai8lK5rrjefY9RCDr7dPYoRZ10JzcFqpJ8kX/DinquCTRV2OUA51cmsXw/IRUMCfB6ghHP5Pawr7BVozWvxzjTIfFSTdmhx7tFd/8Gk X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR11MB8292 X-Authority-Analysis: v=2.4 cv=c8Q+0h9l c=1 sm=1 tr=0 ts=6abe4c7f cx=c_pps a=rDyEm/81vvKQCy/iKDMZrQ==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=bi6dqmuHe4P4UrxVR6um:22 a=iKiJcTA2PjBS6x5JeXcw:22 a=PYnjg3YJAAAA:8 a=KiMCiSwjAAAA:8 a=xNf9USuDAAAA:8 a=t7CeM3EgAAAA:8 a=4UBERAe6OaQNjufR30oA:9 a=sPCYT0qwnquSfqsKqTDE:22 a=FdTzh2GWekK77mhwV6Dw:22 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfX9yHUSEb1g+YY dwlQ5A/mwAIe5H4myfolEsk5O2kaZtAAB0sZhvdeZ4ozkMqfoTLMNzdm3vl57msztuB4EO8oOdE vnYsnxgSYJHSqUFrsjZtxHmRIgOYdkoAPMUWtN2j5n4XmHR4YtUh X-Proofpoint-ORIG-GUID: e0th-8GX3IMmdjsxTd0JJn-suAqjaPqE X-Proofpoint-GUID: e0th-8GX3IMmdjsxTd0JJn-suAqjaPqE X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfX5yJGPSvcNnXb QdwYiQHKYhq40KDhRtiu5AXtrtfh4jnLgQZcXwZTVmXewYrFFdGeovwlvbDU9dJrhsg81JBDyng PjOyAoLF82KSmmJ3KRbJev860zoSBC1kw+ovKsV8ca2CCzcgiBIKbpIJtqEc7YdTXkwSF45J4r0 mnI5qX93ZSTPpOj2Rm1szC2v7JFZYmCOxSLxsLPT25VnzJESvYsh9JDzk/FGDXNDgzJew2O/Acu RS0vO4hezfC4DWWOXT2VeOOjRRCDTjflyJ4QjpJc/dq7xLJQ20TresPrch7cXc73q39BN5rarsX N25sWYOan1WAe1Z3HvIow9pC7IsPZeP4HU4MVttE/CpX5zLk5MDEnEGvIwQC+EUxWu9dc/NBh+O QaJ7d5N0Vq7Alc+2CYdWaiBEuK8c6JsA7kHuumIMrFDetIcJgEBlj3YATON60Yqw74rlhpvL9f+ YnytM3QxIgQJIQFTKUw== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-01_03,2026-09-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 clxscore=1015 malwarescore=0 phishscore=0 lowpriorityscore=0 suspectscore=0 impostorscore=0 priorityscore=1501 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610010047 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 01 Oct 2026 12:05:28 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130584 strongSwan (since 4.2.0, through 6.0.7) allows a denial of service via memory exhaustion in the x509 plugin related to the parsing of identities in X.509 attribute certificates. Reference: [https://nvd.nist.gov/vuln/detail/cve-2026-78131] [https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78131).html] [https://security-tracker.debian.org/tracker/CVE-2026-78131] Upstream Patch: [https://download.strongswan.org/security/CVE-2026-78131/] Signed-off-by: Abhishek Bachiphale --- .../strongswan/CVE-2026-78131.patch | 85 +++++++++++++++++++ .../strongswan/strongswan_6.0.6.bb | 1 + 2 files changed, 86 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78131.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78131.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78131.patch new file mode 100644 index 0000000000..322cd520fb --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78131.patch @@ -0,0 +1,85 @@ +From 7012f6263df493b62268954675b0311248780309 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Fri, 12 Jun 2026 15:55:43 +0200 +Subject: [PATCH] x509: Fix memory leaks when parsing attribute certificates + +This can be triggered by an attribute certificate with lots of GeneralName +entries or AuthorityKeyIdentifier extensions. There is no verification +before the certificate is parsed. + +Fixes: 3134379ac7f1 ("x509: Fix some whitespaces and do some minor style cleanups in acert") +Fixes: 26930a8c3e42 ("certificate factory can load certs from file") +Fixes: CVE-2026-78131 +CVE: CVE-2026-78131 +Upstream-Status: Backport [https://download.strongswan.org/security/CVE-2026-78131/] +Signed-off-by: Abhishek Bachiphale + +--- + src/libstrongswan/plugins/x509/x509_ac.c | 33 +++++++----------------- + 1 file changed, 9 insertions(+), 24 deletions(-) + +diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c +index 3fc5de2f1186..68b7cf927dbf 100644 +--- a/src/libstrongswan/plugins/x509/x509_ac.c ++++ b/src/libstrongswan/plugins/x509/x509_ac.c +@@ -186,41 +186,25 @@ extern bool x509_parse_generalNames(chunk_t blob, int level0, bool implicit, + static bool parse_directoryName(chunk_t blob, int level, bool implicit, + identification_t **name) + { +- identification_t *directoryName; +- enumerator_t *enumerator; +- bool first = TRUE; + linked_list_t *list; + + list = linked_list_create(); + if (!x509_parse_generalNames(blob, level, implicit, list)) + { +- list->destroy(list); ++ list->destroy_offset(list, offsetof(identification_t, destroy)); + return FALSE; + } +- +- enumerator = list->create_enumerator(list); +- while (enumerator->enumerate(enumerator, &directoryName)) +- { +- if (first) +- { +- *name = directoryName; +- first = FALSE; +- } +- else +- { +- DBG1(DBG_ASN, "more than one directory name - first selected"); +- directoryName->destroy(directoryName); +- break; +- } +- } +- enumerator->destroy(enumerator); +- list->destroy(list); +- +- if (first) ++ if (list->remove_first(list, (void**)name) != SUCCESS) + { + DBG1(DBG_ASN, "no directoryName found"); ++ list->destroy(list); + return FALSE; + } ++ if (list->get_count(list)) ++ { ++ DBG1(DBG_ASN, "more than one directory name - first selected"); ++ } ++ list->destroy_offset(list, offsetof(identification_t, destroy)); + return TRUE; + } + +@@ -539,6 +523,7 @@ static bool parse_certificate(private_x509_ac_t *this) + DBG2(DBG_ASN, " need to parse crlDistributionPoints"); + break; + case OID_AUTHORITY_KEY_ID: ++ chunk_free(&this->authKeyIdentifier); + this->authKeyIdentifier = + x509_parse_authorityKeyIdentifier(object, + level, &this->authKeySerialNumber); +-- +2.43.0 + diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb index d0b015f741..8e3765ae5e 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb @@ -16,6 +16,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78127.patch \ file://CVE-2026-78129.patch \ file://CVE-2026-78130.patch \ + file://CVE-2026-78131.patch \ " SRC_URI[sha256sum] = "07df7cedae56a7f3bb07e66d21a1f9f87e961db70e99184e11d3819413e4f87c" From patchwork Thu Oct 1 12:04:14 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Abhishek Bachiphale X-Patchwork-Id: 99820 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 75C71CA5FD5 for ; Thu, 1 Oct 2026 12:05:29 +0000 (UTC) Received: from mx0a-0064b401.pphosted.com (mx0a-0064b401.pphosted.com [205.220.166.238]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9564.1790856320375943255 for ; Thu, 01 Oct 2026 05:05:20 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@windriver.com header.s=PPS06212021 header.b=eUDdFKbo; spf=permerror, err=parse error for token &{10 18 %{ir}.%{v}.%{d}.spf.has.pphosted.com}: invalid domain name (domain: windriver.com, ip: 205.220.166.238, mailfrom: prvs=473490b304=abhishek.bachiphale@windriver.com) Received: from pps.filterd (m0250809.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6918Ecf2955562 for ; Thu, 1 Oct 2026 05:05:20 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriver.com; h=cc:content-transfer-encoding:content-type:date:from :in-reply-to:message-id:mime-version:references:subject:to; s= PPS06212021; bh=dW0YC9561xFayE2a7/+iyCWhUbVjmnO60XxIXtCVXbs=; b= eUDdFKbolBRn6mnHeWjBLAUYEOqZofpX4St4rEoU4g/DPzg+qg1Ngz/mFD/IKBwg 2IrVB3dpuD03npMqnpkXGUo2U1UVhvtjGloJNQ+0XvwPeLlfrEssFWeGJso5qJVd k48jwCOq0XZKU3ZI1UwixerD+6Rhx9VJHiJSIvTAL6qEixpbCuV8VVvOdav2qEhZ mBwWoGWW+EMv4/bqM8o/d8pndVrco+EEAU8Avz3rx5fgLii3/Cp96HO2wcJlojJB XMhaqgOuHhyYMxC9ZyUlZaip4tlG9k8D/2oxYUZZ1Jh+qGRt5P7x93QShPgH7pEL sJ4RZ96NnPbmMkcH6ofStA== Received: from dm5pr21cu001.outbound.protection.outlook.com (mail-centralusazon11021080.outbound.protection.outlook.com [52.101.62.80]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 4h1ku8gaqw-4 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Thu, 01 Oct 2026 05:05:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Ii0i52u5Sbk4uLY/mgXTwy4mtqhUt9m1oDt5/K1Eil99pqYqL+w9qcGRVkRP01r4IxUju1jFBEfuB3AnC3RzEIqIg06sqtGecv+wh1+r9EdUGnTF1TETKTli0dasowoHKYCBDn/9doY7TmX2lhs1tPoZ7hhF0vyu2NUfbNhTS1wcwv2085EgLit+CfJrdwSS/qJGOAr3xZrfESdupMGken9PB2JCDxTJvyfl6osLO6PzmhoZ6es1xyRYVSka3MrWLSBzwyk5YjuDGBmpmdUxxbkxoSB44kzb/BgpMr/ruGrBYw+sRHApO3/4VT8xnn7zwKnma55w0fsBGwuXSAdvPg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=dW0YC9561xFayE2a7/+iyCWhUbVjmnO60XxIXtCVXbs=; b=rQauynTrKSAvbkgyD3plRkTF7VymKHalm7bu0Eajgm2SRKP6kSbIHerWQlxUOan/gINUOCsvuW/wmc4kp0wDEplNat3MJw1LdsLGJM6Wf7P5WQXQSeiHT57yBMkBCF9M7E8/CCkEfGSz4JpoCoosYm7qHZZcQxKeXf5PZwbVhlbF+xErxBJl3J8adIMYXmSzynw7rC6hUcoaTeuA6CRYdluLUEQe+OPnJq3etw1kcvCNzlbYIKFtJM9rKBsPPG/DjW04aCePO0Ievlg+boHcQWqax8bqWBo/+OYwbMnq9/8ICd8k799Odj/ByPZEJHMaszQLuIYez82Z4GR82rw7rw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=windriver.com; Received: from IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) by MW4PR11MB8292.namprd11.prod.outlook.com (2603:10b6:303:20c::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.27; Thu, 1 Oct 2026 12:05:00 +0000 Received: from IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c]) by IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c%4]) with mapi id 15.21.0472.015; Thu, 1 Oct 2026 12:05:00 +0000 From: Abhishek Bachiphale To: openembedded-devel@lists.openembedded.org Cc: Shiva.Komati@windriver.com Subject: [meta-networking][wrynose][PATCH 08/11] strongswan: fix CVE-2026-78132 Date: Thu, 1 Oct 2026 17:34:14 +0530 Message-Id: <20261001120417.1280843-9-Abhishek.Bachiphale@windriver.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> References: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> X-ClientProxiedBy: TYCP301CA0020.JPNP301.PROD.OUTLOOK.COM (2603:1096:400:381::13) To IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR11MB8399:EE_|MW4PR11MB8292:EE_ X-MS-Office365-Filtering-Correlation-Id: e9d56787-1794-4928-5022-08df1fb436a5 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|52116014|376014|366016|23010399003|260925022911599003|260925021911599003|260925021311599003|10067099003|11063799006|56012099006|12006099003|6133799003|22082099003|18002099003|13003099007|38350700014; X-Microsoft-Antispam-Message-Info: 0rfO9hOlUb4wQWvXbqZnFnMsxnPhjYAs6dtu9+OKTOjxIkQKopN6qpJwbsLLbYyA1zXPvj7MxU620LqvugVB+m5A8RZ8JfYPBTVDKB6Il2nfJxT6kvGsgC1485+NpogbrgPJi+cme3O8f4n5fJYUXNf/ofYaO+kasfU0+fy/NurQCVd81n+Bw4cOO2+GvwQcvLFWq+vI0JEEFRTUv7zg4iFhcVOnTiTMZCyWVkIKfONMJ15TkSd0MMB2FzHcIN3MdDzB05rzX+MREcbEKunbN72tB6BdxSIr9KpqrEHA3ejMLXvwhnJUyfZpxvehpUt5GzdyvV//GsnoXtWbdZ97fSouGXcMbiWfENkPAhccXRmfAvqlFQ4FP8sxYKz9hlvN//h4keq8Ms80ek/+SQ4zMh6JVdpgiCiCfMBN3ogwcEa2ejcUDtg5ufBFfCyFe47VhIOr04BZzABItNCZnNjzaR3XqJtv1tP2Xt5whl3SKLWZh9OItJs4fqepYjFWlfL+rFnhrMU++Q9dz2ijgBYvuu5VvcWM2ez1eQGD917Oj3HU64TBNohDGOOUsO/1fMd1SJWRe/aUh3w6BQre+y32nBFBKmEoLDfSVew1Fj2yN+olF1MX/80LnRHwGkbvkscvE0yiddCg3HrmsQ8cPLsZikLwp0GeqcsuGhXj5bcNp+w= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR11MB8399.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(52116014)(376014)(366016)(23010399003)(260925022911599003)(260925021911599003)(260925021311599003)(10067099003)(11063799006)(56012099006)(12006099003)(6133799003)(22082099003)(18002099003)(13003099007)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: WwnSlwdRS8LnPxgcwT7UtUl3Ycfe+GropMe8I8JzgbQ/vrFXXibrzRimcWcpC1YtMYtx+VZOZr3QTmRyOz/cqK96JjxHSk+veFaK3daOcZZ1jnBJve3MOEEw/FNVXWpcsQvXvznZqpQdhjNF2kefzkkdtjxORSK3aBOdsZ2nOHRcmd49W8xcUpeMGIQWgO1bUfuO2PPKG3IG7cCTOH9hwM9/QkIaTgIT3OoCIkp6arLBTgmMdJZNqwzLAL6WvoH5h2miu/zEn58VlvowTC9QLW8pgNGCHsif9CHe4ShaJYakNSvx64aeqeGR9CPMaaE21z/r7lGxpajakOLW/wcFx1sMZrF9iMLVcgiVcA4JQ4pZCBFfw8/qy2CwBm+ePiMgaoAEjLjjonvPyWVObTmWU9LBcXk9hBTs6lM9wgVa/Mp+3PqnlXdwQGvO96kLVZORX20ooWWmAlYE54WsV+Dv0tzkKkvuPId55Dw49poKvGwqxl1iehpA7J4xud3Zh+SW3jjq03WGrbzLnf4K0RA/9Ng2usUGNFNKQduMiNr6KdyoozR9KkPhv1obi/J8GWXWBeaYmJJqebT2a0yv1JqfgKnbYtMC6+PRJ9AQnzgvNsbe6D2vlFCrmiuh6ROBw7F0scfCRIiGtuPbZnEEh/Lr5MI/VUYBSz95rY+EZA/YMd3nZ7BIjLZOxFle58rY+4zoTbxcn2J/5nDjvjvCzUeNEGNMi8eXDCNdTPMODZv8hYianS4bqrKkWtuKCBeSSkKdUh91aaqwoAfJ1rQjzNS1rkgzVxyFPkDZ4OqxZZ3HxCUldSpSiSCE8oPQUpFguKwOK337H1+6VXLwm4t389NxNdaITTqKKLY+rXmBy/rCpYX0Sh1bM5Wa/hlT8USntQzkayr5JuVw2SVF1z0P0C3OnPzAYlOv03cem5WbD8UP+pfRtj3NjTyNstJiv8EWJPcAAjXnL3LYvNzhDn/bZOC5Dfc9+XcZOM4C/Zm6Dr9a5GFMgkMjeCboP1T5Om2d3VxvoYOUsmnZvngTYzABaiwzt82nuClaEVQAZ2yajSDD/GO+lZY1gPpNTxMuVzu5y+bJuBC+eubuELOVIiuXetfd3rl5EG8kzP1aMg4fdt2OgoPj7VdLVNaJJAk1kT7hEG0qcvmPbMBZVciez7DU39njmo9BYggr0S9bFlN4OisaeT+KK0vudGkHQH1jwE/C4fBqmNaqi0z8yTOVVLplHxFTxjYTtg5n4ZaRo6Qwc2YvVMj4FTR22QqnxUlZfvkt7gHi1cHadQCAh5XU6ji380SOP6INxKtT6vuEm0Os9TXTcStHMLIgJF00VRH4o5uUvXKQ3EDgLGARXRngUlVfeht4n0Vovfe9qOSSGFyr3H3bmbNwoZcUIaJLtxtD2om1BfEOyjVpihjy2PX1FP3WA2hxbiqmYjpvtAKo/ZLB3VGW8dpH1UcVg4hla+WX3g9vuaMXRcAAPSnWac0fYZT9IyP8Sm4hk3FrxuJBbQJ3pPLcnApda49LaACb+L3A4nap0bet/2pQWT4sff3N3fKlzJ8L6GXPFwXzJuEVvegsc3dUNp7ATClaUgsB4zDJ++kTUB/52xIGyCPaX6sXMrCNYZGD/2gy+NoDTHUqzP8xRa8Qrd2qpgYySPBKgQDPbUZNjvFZhLsoPLeFjEVs4vCCgeMmLdNgjXbe0ee+W41umxzdhjO2pfvE/rl+8DEzLfuWtfCHLgI15YBU8UFC6YsdrN8BV5SX/F3QbuDnutoHHm5rBYrXiwdOOmVgKXwXlp6QEdVt X-Exchange-RoutingPolicyChecked: gUy+i3FPkX3UtzVVsDa0jdFkt3ZhFbUYYoF9Q89uKDjty67ELINYUtLBRAWig3YaDVn+gKDnJV7Ew4LgeBaMgidxdwZ4BjWealn/ZPRwqnXQowgnKS+B9Fn27moJSgqpEIur35+kJhdmMeePO1pYIFR4QU6vJvx1lCENaGmJ+Ml8AgrCg2kes9QNtks54WoXtSaK+2Q64+9v6za29ny1s694r3x97K3bXuh508G/1Up93EpFrwofWQCyfy/NcNtNssu9lrWjk66263he3IlfdHgg2KhLmxs/frLO7PuZaOUvFcJMcJevx+fO4J1qda/9kK4sT1mqGh4V8VTSqaqrhg== X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: e9d56787-1794-4928-5022-08df1fb436a5 X-MS-Exchange-CrossTenant-AuthSource: IA0PR11MB8399.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Oct 2026 12:04:58.3833 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: mHP0njI8RZMkk6a+CVYmx8s9mbvOR+I4BeZiSc8gi0eZaM9gTw6wijXPjsRHnlDQQfe/aHjwF+CF/hbJSjQo1NaD/OvTYfl2f6UsaspxfS/wcJaT4qPbilvyzSEJy1Z7 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR11MB8292 X-Authority-Analysis: v=2.4 cv=c8Q+0h9l c=1 sm=1 tr=0 ts=6abe4c7f cx=c_pps a=rDyEm/81vvKQCy/iKDMZrQ==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=bi6dqmuHe4P4UrxVR6um:22 a=iKiJcTA2PjBS6x5JeXcw:22 a=PYnjg3YJAAAA:8 a=KiMCiSwjAAAA:8 a=xNf9USuDAAAA:8 a=t7CeM3EgAAAA:8 a=zAYA0XYkj0k-cts__vUA:9 a=sPCYT0qwnquSfqsKqTDE:22 a=FdTzh2GWekK77mhwV6Dw:22 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfXxkcS3+c5epA4 bniU2sdK0fm4XfW4o7EMvJydtUs1Gk0cnQeQIP7qw5Qz2i98eTceGXmITUtDXcKHTwlCR1Y5jNY dhRN99PQNdXIgC9gh4YLk6Z72FmIBaSq+08+E3JDZ1MnvnD2JMIP X-Proofpoint-ORIG-GUID: X5QMZO1avqRebf2ZMf9ta7sEPF5rHuhq X-Proofpoint-GUID: X5QMZO1avqRebf2ZMf9ta7sEPF5rHuhq X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfXzJdrGptxCPNE 4h7PWcHcLn1H2so7aW/FLafB50Pf2bw0gv2JWnANrs85AzkNOJvyydxiYevULCYAXLcLuhyhDS2 mNDMV4tM7qj097bZfYvBvo2ik0VXeQACow4N+sO6RE5QGfkB39VpAOHQYMG8M7oXlgg3MJovL1X NOsnoEemn3Z4L70XHl6Jf8Vp0w8M3KK/QoX5M8zEd2/hbCk5fnK07ZbqiJjRLYHDN2KxOv7/MVc yRkG2nwUGYkI38oseGaYn6gbmaNGbHhRv0MDZ97S7RFK9uKYwvqm89wmdq51hVq+A3UF8AMTamT M0pgiMdKD4d8k1e9ZYl3bgEdPBJielpzXwCn5MfSIIRXVidgmG04QLVQGOFmgaRglMd2hObueCe eF65lf9dImfBhWu+mX+/Zw9LVgSUQut57vIaYXzK6rYTXmL4tUJJRRHuNxawu49+TJt+iqqminT 4v0XI02xKSE4e7+97Ng== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-01_03,2026-09-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 clxscore=1015 malwarescore=0 phishscore=0 lowpriorityscore=0 suspectscore=0 impostorscore=0 priorityscore=1501 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610010047 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 01 Oct 2026 12:05:29 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130585 strongSwan (since 5.1.3, through 6.0.7) allows a denial of service in the x509 plugin related to the parsing of the ietfAttrSyntax ASN.1 type in X.509 attribute certificates. Reference: [https://nvd.nist.gov/vuln/detail/cve-2026-78132] [https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78132).html] [https://security-tracker.debian.org/tracker/CVE-2026-78132] Upstream Patch: [https://download.strongswan.org/security/CVE-2026-78132/] Signed-off-by: Abhishek Bachiphale --- .../strongswan/CVE-2026-78132.patch | 77 +++++++++++++++++++ .../strongswan/strongswan_6.0.6.bb | 1 + 2 files changed, 78 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78132.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78132.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78132.patch new file mode 100644 index 0000000000..2be5f666a6 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78132.patch @@ -0,0 +1,77 @@ +From d925e4625626a70611a979d4ab231c6e2d313e4a Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Wed, 1 Jul 2026 16:24:23 +0200 +Subject: [PATCH] x509: Prevent infinite loop when parsing ietfAttrSyntax in + attribute certificates + +This is the same issue that was fixed with 407fcca200fd ("asn1-parser: +Fix CHOICE parsing") for other CHOICE elements. This one was missed and +can be triggered pre-auth by sending an attribute certificate to a peer. +Since it's parsed before verifying it, the certificate doesn't have to +be valid. + +For versions older than 5.5.3, this patch requires prior application of +the fix for CVE-2017-9023, which introduced proper CHOICE handling in +the ASN.1 parser. + +Fixes: a17598bc6992 ("x509: Integrate IETF attribute handling, and obsolete ietf_attributes_t") +Fixes: CVE-2026-78132 +CVE: CVE-2026-78132 +Upstream-Status: Backport [https://download.strongswan.org/security/CVE-2026-78132/] +Signed-off-by: Abhishek Bachiphale + +--- + src/libstrongswan/plugins/x509/x509_ac.c | 36 +++++++++++------------- + 1 file changed, 17 insertions(+), 19 deletions(-) + +diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c +index 4436bc4debef..e8e34749a59c 100644 +--- a/src/libstrongswan/plugins/x509/x509_ac.c ++++ b/src/libstrongswan/plugins/x509/x509_ac.c +@@ -249,26 +249,24 @@ static void parse_roleSyntax(chunk_t blob, int level0) + */ + static const asn1Object_t ietfAttrSyntaxObjects[] = + { +- { 0, "ietfAttrSyntax", ASN1_SEQUENCE, ASN1_NONE }, /* 0 */ +- { 1, "policyAuthority", ASN1_CONTEXT_C_0, ASN1_OPT | +- ASN1_BODY }, /* 1 */ +- { 1, "end opt", ASN1_EOC, ASN1_END }, /* 2 */ +- { 1, "values", ASN1_SEQUENCE, ASN1_LOOP }, /* 3 */ +- { 2, "octets", ASN1_OCTET_STRING, ASN1_OPT | +- ASN1_BODY }, /* 4 */ +- { 2, "end choice", ASN1_EOC, ASN1_END }, /* 5 */ +- { 2, "oid", ASN1_OID, ASN1_OPT | +- ASN1_BODY }, /* 6 */ +- { 2, "end choice", ASN1_EOC, ASN1_END }, /* 7 */ +- { 2, "string", ASN1_UTF8STRING, ASN1_OPT | +- ASN1_BODY }, /* 8 */ +- { 2, "end choice", ASN1_EOC, ASN1_END }, /* 9 */ +- { 1, "end loop", ASN1_EOC, ASN1_END }, /* 10 */ +- { 0, "exit", ASN1_EOC, ASN1_EXIT } ++ { 0, "ietfAttrSyntax", ASN1_SEQUENCE, ASN1_NONE }, /* 0 */ ++ { 1, "policyAuthority", ASN1_CONTEXT_C_0, ASN1_OPT|ASN1_BODY }, /* 1 */ ++ { 1, "end opt", ASN1_EOC, ASN1_END }, /* 2 */ ++ { 1, "values", ASN1_SEQUENCE, ASN1_LOOP }, /* 3 */ ++ { 2, "value choice", ASN1_EOC, ASN1_CHOICE }, /* 4 */ ++ { 3, "octets", ASN1_OCTET_STRING, ASN1_OPT|ASN1_BODY }, /* 5 */ ++ { 3, "end choice", ASN1_EOC, ASN1_END|ASN1_CH }, /* 6 */ ++ { 3, "oid", ASN1_OID, ASN1_OPT|ASN1_BODY }, /* 7 */ ++ { 3, "end choice", ASN1_EOC, ASN1_END|ASN1_CH }, /* 8 */ ++ { 3, "string", ASN1_UTF8STRING, ASN1_OPT|ASN1_BODY }, /* 9 */ ++ { 3, "end choice", ASN1_EOC, ASN1_END|ASN1_CH }, /* 10 */ ++ { 2, "end choices", ASN1_EOC, ASN1_END|ASN1_CHOICE }, /* 11 */ ++ { 1, "end loop", ASN1_EOC, ASN1_END }, /* 12 */ ++ { 0, "exit", ASN1_EOC, ASN1_EXIT } + }; +-#define IETF_ATTR_OCTETS 4 +-#define IETF_ATTR_OID 6 +-#define IETF_ATTR_STRING 8 ++#define IETF_ATTR_OCTETS 5 ++#define IETF_ATTR_OID 7 ++#define IETF_ATTR_STRING 9 + + /** + * Parse group memberships, IETF attributes +-- +2.43.0 + diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb index 8e3765ae5e..ea92655270 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb @@ -17,6 +17,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78129.patch \ file://CVE-2026-78130.patch \ file://CVE-2026-78131.patch \ + file://CVE-2026-78132.patch \ " SRC_URI[sha256sum] = "07df7cedae56a7f3bb07e66d21a1f9f87e961db70e99184e11d3819413e4f87c" From patchwork Thu Oct 1 12:04:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Abhishek Bachiphale X-Patchwork-Id: 99822 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 16E09CA5FD2 for ; Thu, 1 Oct 2026 12:05:29 +0000 (UTC) Received: from mx0a-0064b401.pphosted.com (mx0a-0064b401.pphosted.com [205.220.166.238]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9568.1790856322467019141 for ; Thu, 01 Oct 2026 05:05:22 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@windriver.com header.s=PPS06212021 header.b=rYqtMu/d; spf=permerror, err=parse error for token &{10 18 %{ir}.%{v}.%{d}.spf.has.pphosted.com}: invalid domain name (domain: windriver.com, ip: 205.220.166.238, mailfrom: prvs=473490b304=abhishek.bachiphale@windriver.com) Received: from pps.filterd (m0250809.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6918Ecf5955562 for ; Thu, 1 Oct 2026 05:05:22 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriver.com; h=cc:content-transfer-encoding:content-type:date:from :in-reply-to:message-id:mime-version:references:subject:to; s= PPS06212021; bh=ljhZgMVY9jb7WDTZ1tYZArXHLs9c7au7k7XaDz9+GjQ=; b= rYqtMu/dZ6pAYycQfD4mqxP3DyMfnnfv3wZasYe5dDP1mJBUTWWKGGpC8g5ivw6z jaJwvWjH4Rs+J9lqcbVNkJc++736OdTicCvXrknrIDWX6kU2M/mESfZ1P+u1SlRO AquvFCUVS/jBSBuzLswLCXPC3e7+BuZfYF20MqV7BO2DyFpoRyW48PQzpXumOz7q JgxtFWRFzbkD3XbEk11cQNTZ5KTt+cf9RNK9McefDuHAJP7BH+lqe/kXFTRItH9e /lYuz6Q8MnkUIhDE/IsdzZh9l3C7aS8WH3VNr5xZRgQ3D260KJegLlgR0sFszafZ ABLF05Yz0p9+RQsxtxTbJw== Received: from dm5pr21cu001.outbound.protection.outlook.com (mail-centralusazon11021080.outbound.protection.outlook.com [52.101.62.80]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 4h1ku8gaqw-7 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Thu, 01 Oct 2026 05:05:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=qlfYvJKx0KADN3UkBHxlGPS/IUJGeYtmQfWA614+hhhOFtmczarrnz/ku5Fe2ushaMU2aySGO3mHok07J1GOQ9+BDXFqd0U4E4hZBWhbkA06PAM0N/f7Odaap1JaObwNc6kX+LhdpU1lzJy1aYpDr2U8wC5zqiW7BFfuxMqg4mMxRiiQ3E5VR6NdXU+lVwzwvr3XQX3APCJCTRj1RsYZHBx8Nd+FnJ3Dx+VtWBOVSsK7lq35hY54e5dK+FnlF44S6No6ZrKKsarRIkWpo6mJVe4UtmPm9ShgDlOOiHX8DFThYoihoyO+8XY0dqDnkXwBSuXwX4h/tptAQeNs/OKtzQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ljhZgMVY9jb7WDTZ1tYZArXHLs9c7au7k7XaDz9+GjQ=; b=qO6cJM+9tDqZnKc3eLxlOHAXcydlh3hS1STaIMYEyjU5zqjLD1euYx34o3hUQuaW9knH49ScAY3pMiklyS4+j8LfrDco42FsgpDBBscNQT0Qu7gEZK+yA1yOM/CDGnG37preeT8fuIe7kwijoqvQPSGljMpvrUUEz7+aCC541O6a6sRGmtyMgjDftDsk1BJVJhlpTTT0VQE7Im1FOh7IWzNvrL9Ca9JB/Jpk2f+GFNovJUa4Rb548MpfbV7CuFcxiMXEIDCWiniv0+FP1+fbzpL5pFz7TRfSZCNG/AJk2zrxE7459qVPTjHh49w8mH12AUeD/FgkdSEnAxZegJUFQw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=windriver.com; Received: from IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) by MW4PR11MB8292.namprd11.prod.outlook.com (2603:10b6:303:20c::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.27; Thu, 1 Oct 2026 12:05:03 +0000 Received: from IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c]) by IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c%4]) with mapi id 15.21.0472.015; Thu, 1 Oct 2026 12:05:03 +0000 From: Abhishek Bachiphale To: openembedded-devel@lists.openembedded.org Cc: Shiva.Komati@windriver.com Subject: [meta-networking][wrynose][PATCH 09/11] strongswan: fix CVE-2026-78133 Date: Thu, 1 Oct 2026 17:34:15 +0530 Message-Id: <20261001120417.1280843-10-Abhishek.Bachiphale@windriver.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> References: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> X-ClientProxiedBy: TYCP301CA0020.JPNP301.PROD.OUTLOOK.COM (2603:1096:400:381::13) To IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR11MB8399:EE_|MW4PR11MB8292:EE_ X-MS-Office365-Filtering-Correlation-Id: 6625bdae-42a7-4ace-7168-08df1fb437bb X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|52116014|376014|366016|23010399003|260925022911599003|260925021911599003|260925021311599003|10067099003|11063799006|56012099006|3023799007|12006099003|6133799003|22082099003|18002099003|13003099007|38350700014; X-Microsoft-Antispam-Message-Info: auZ8LzRjLDb3PCKAVsjtvH0vbIkShwmBHCQFW7Y/ISZ2e9w+wHOon1DpP6v+2aPdNMBndBJFDVRbDnGVh1mXSmt61Y4TMGE3Jz68clATTCQA91i4mg/2A2kYnTyfjtgE5ZKIxEcXh4ahNPDH/PvYigJZzSLsfB6XmIwDOovvCpeNTpmAF7wZFF/rUFkBZlQL/Ylm1ZhuEBUGaaw92zncGvvg3T4nEHY+N/TLwEL0mvdddtXiBzx/WI6QdNjCwtNvhtzGFIKKFdBxGDPZPmC3I8LbUQvYJy1WdIEylPOxU6pJFtc6WlHXREtCrlNYUUjb99t7nv1K8/q4eo8N1Fq7WpVddEPtvy0KweXysGeQnKvhsl6AvX9Qd+4O6SStzhGFOgxoXHIWNhlm/qrMiUq6Vzbx4rLWqOGfBlMRLQa9IOO7sEuVZhiyutGGpgT6km56COke1XKioI/epdlHheNEvhlRFpn1nUeodaYd/gw733eqCBdJZ7vVjcKSZXiOTJJTikGP6aydWOy7S7Dx1PhdmSpDr3APbNl8uUgek+k/yP0FV9nKJYL4vQMOQxm9IwD/eqyG/etBHPu5ZTUti2+xQrbdvHsR7UwL4xi/RYYPCqIX0kTr/8sVn5I/Wtj14LHpUL2ieLa3LWDwcddxx4NYGf43PbSAwGX0p+Bx5cuTgkI= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR11MB8399.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(52116014)(376014)(366016)(23010399003)(260925022911599003)(260925021911599003)(260925021311599003)(10067099003)(11063799006)(56012099006)(3023799007)(12006099003)(6133799003)(22082099003)(18002099003)(13003099007)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: PY2eHlzfWGCkISJAXk7EnUvs5fE1eAH5lIO5Q/aeqOZkXpGfOVDKOyXFIo0p3+/Hai7C2Vj+DJ/h2wR5CfwSrKiHD+DBaip4x5HjqkUH96luUohLA1BbykDbAF08B9BRklqrUtjFf+7+NLKKonP5ZnZ/lgMQ34RYdKvg88JA5IpqF94ubkrqcZABbzjCj9FVLj+o2ygmkZejYX5MGMgVRNSctb8dlvORkKOJyVEZkDf5P3dbUIcMYqP7LId8oi1P5gzj0vF91MQCGfOvuURnBAlv3mE3CUIovc/6DD1Pd/ATScVkn2UC5m6O0hzrs81HNhMHFgRvD2TPBai594F58dsVGLd26U6ti2w06sDeriDixYtFCZyQUx+v2DPNrZteWu4h/E83f21Sd52teLioR0LrsQDu+5Qzs0M4RuiXVtekZFphO2i/LdXQsxBXd9tJku9rBh/eixR4yjfpq7kmhNoCXVZNZYCbFPj9v5kzg6MxdJ8vfokXqAdUaJpqseK+Ml6BxFHylwaY/TsRM1zDPAYnVmQudiwtzmA5OQoW31acdFioMY0dVqDbK0X/6/vp2ypVX6GqWbE3f3sZQiMdqDLIJAIpN/YAk1ynXLhYwru76tPKuDxjSzW4+uATcPcJ8twi8lS2GAXInO9Aya20peAe0DGuqMQpvLSbabja+xzygO8NQubIMnyf/TUxXNLVBz25bDBkngwJp3x4HLaD8BwQe5IguDGd+3uTD+7wldhRwwp0NyVd89hSn+SYBhROB8xviBh0Xi64/GAXA9MlkrwH2IBYa+I2uzUOmiFn55EH2s3f/9BPQolMu2MUUjMTABCrF3mLoVWMW15xy9LDn9brp0p7nX2hSUqQKvf7nqbWkzshbcd6lcyIwvICYpkMwAh5HP588rFkp8cCaRetr9yAllE6lvuzUEikPv5XiHeUzT5hhDvFmaRLeytO+6ylbSN3ejebIhsl9B7OS/Odrt4kCTySIoQta3bxoq1r6AWr+ocBWt/5sfN9ymOzpEuUSwKkE1TNxvpsaaROXZaRhsUp7n9GEUS+HUvuluN+I7A+Sr3EurKVKACpQfrTZPw/Z0OmEDv/9tvLxtdxTYSh7gLMgVCsz0D8zG7ozFzq+M2j+ftcdu2854hhaECMGF0kbOyn7zEbFBznv0t/e9cppu9WxOG4PfELX7E/ekvLbq8WitTv4u6DytJv0EHpAz2rjzUk+q2fdVcAcCkUgjU93kNyfZt7RMKv0O6MahRMAX+iedXdGfAL9fhmk/X52qzmFOairdJAINldeSL57n6R1b+Vr9PruMtFodQz09CQtQbf6f6OP7BHNCbwUE4VNoVIRua4+GyVqYlOTdtM46E+H5gXbv73DsL8xEhCxPHnbE5oQkwAo7sBNSxJ+YlEoacnqh0qEsdXhf69nYH7RsUpJvfs7hTuFWK3Iw9uXGWFJfhLonEQnA8wBhx/t47xgUzs/zsh0sc4aytSkK3q75mLCtIjNZvcgJ8nVCg/hgV/jqg5r1eZDBP1yrr+D/kpavb0nA7Jj1T9hXInmm4Wv39ouxr4njXM0qME7tjJbxiP4Owr/nPV/m3SRn8lZ9vDemT1Fy0CrojjstNco390ZlAN+pR8UDNZgVWWzXxfDhf7BPkpMw4z5ZPolUJ1p8r3qEzodXjSrJD78mXrcP1Zzq4+VuyGT7/pSLDCAQpJm9ZDeqMZC3PVDj/w31fSN3WskxASR1K3Oj/lJFk6wNPEBrCq45+TJDuY45XS1rEm6db0p5uXvq6vT9C2gs/KzQ5U/Pd8 X-Exchange-RoutingPolicyChecked: w5wVnTNTyrYKfNz8BsFGUw88NCvTiUU717Srj8NzVm45NUekQfhtPh0x/Sse8gsYrZCF0mALSyB021x+OCB2KOczFhivTYKKgjgGY6E8DAzNvYJWsJryY2vbBTtWlV0MFzaIvTLPqS75Gvovpd1UbxJMllhjM10dNzZxm4dagNqmbDkP8emt/YVsbME78vyW6tul3FuKxyoqeupnQ/cRsD+PPJN8GlmmVOX/qat+rDNkwr3/6IXmZr+Ss++TkIbJFpJouZtYRVFAwSC0/AqUkEQfombMORGu2zgqbBLJtJwATXbja9XZ1mzfQJj1XyCP5tBv4vVeRw0oc6QXypf+Vw== X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6625bdae-42a7-4ace-7168-08df1fb437bb X-MS-Exchange-CrossTenant-AuthSource: IA0PR11MB8399.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Oct 2026 12:05:00.2032 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: t4VSp6M0JPUkbDwgG8mzeebouaDYZsH6RmYb2HcDgHX+5jVmhzrZ5g2iEF1iT2jkp3nenVLVkAr6a1oL2x/aUwePLnw/tm+cp75xkvNTRKh7OMQfg4p4oapEeJKRXlGJ X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR11MB8292 X-Authority-Analysis: v=2.4 cv=c8Q+0h9l c=1 sm=1 tr=0 ts=6abe4c81 cx=c_pps a=rDyEm/81vvKQCy/iKDMZrQ==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=bi6dqmuHe4P4UrxVR6um:22 a=iKiJcTA2PjBS6x5JeXcw:22 a=PYnjg3YJAAAA:8 a=KiMCiSwjAAAA:8 a=xNf9USuDAAAA:8 a=t7CeM3EgAAAA:8 a=2QDO3vGFiX4y1kXMoUIA:9 a=sPCYT0qwnquSfqsKqTDE:22 a=FdTzh2GWekK77mhwV6Dw:22 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfXyChlFAt4x/6v yuJ8yACbKII9W/qPhgfM1M2i4QnLTLCn0qxAnOhbBMiWVVjTim/iUsPRxdRumZjzzPvlijB5bv+ EkxqfHE9ML6Xxqqh7bte4otXTZkawxQeqth5d6U2CNEhTiL3xApG X-Proofpoint-ORIG-GUID: wnh3L9OycFa4dubNkPplPn2-Fs4P1-fq X-Proofpoint-GUID: wnh3L9OycFa4dubNkPplPn2-Fs4P1-fq X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfX9wdy+mmKnINr 1Okddln4hY+vaCEWXRPwOzAef1uITegnMzbNvGA8l+cpZ2UAQcnSrYrIYV6brOLxcYkuezefRPZ hAozFlhYTnfeucg6819CU978+mQKZAVRogD9ekKdYEEMVD62pPn9FasQMMYbgsIZs1w5tUUmx4N dMXIqbw9pxYEEB3+B6GweRfRM3dJ6eFUUrao0zaKUMuJ2btdGvoNNzteFe1bhbzty22d4zEFIz7 CYkgum3LZ6BHUDMswo7/WjwEbrjK/mSvta28oO5JdmHIa7LoQVe8v13ugaw8xLBcSORyeaQG6JT AIsDWPLD4D4uTeYTlukvrKuZUuHdkLguhP+Kfl3QeGI8IpWju0zS4vBViypnKXefJYGInKKZZod isXT+qNxkr333WZbeFpv+61cu4LLnhjfQRXR8/iG6eFBSTsGksJWwlg1oUB02WfvgaaOOcIBbiJ Cm0XzaAxwQ9GMm4zmSQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-01_03,2026-09-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 clxscore=1015 malwarescore=0 phishscore=0 lowpriorityscore=0 suspectscore=0 impostorscore=0 priorityscore=1501 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610010047 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 01 Oct 2026 12:05:29 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130588 libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling that can potentially lead to remote code execution. Reference: [https://nvd.nist.gov/vuln/detail/cve-2026-78133] [https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78133).html] [https://security-tracker.debian.org/tracker/CVE-2026-78133] Upstream Patch: [https://download.strongswan.org/security/CVE-2026-78133/] Signed-off-by: Abhishek Bachiphale --- .../strongswan/CVE-2026-78133.patch | 622 ++++++++++++++++++ .../strongswan/strongswan_6.0.6.bb | 1 + 2 files changed, 623 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78133.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78133.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78133.patch new file mode 100644 index 0000000000..688b407c41 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78133.patch @@ -0,0 +1,622 @@ +From f2b51e7c90ca8a0f0b10213ad581d950662b739b Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Fri, 5 Jun 2026 08:15:46 +0200 +Subject: [PATCH] ikev2: Prevent use-after-free during collision after passive + multi-KE rekeying failed + +During a multi-KE rekey collision, where the initial response to the +active rekeying is delayed (or withheld), the active task already keeps +track of the passive task to eventually resolve the collision (it can +only do so once all nonces are known). + +If the passive task then fails, e.g. due to a missing or invalid KE +payload, and completes with SUCCESS, `collide()` previously recognized +that the passive task is not yet complete returned FALSE, which caused +the task manager to destroy the task. However, the reference in the +active task would remain. So once the active rekeying progresses and +the collision is resolved, that dangling pointer would get dereferenced +for an indirect method call. This happens via the `get_lower_nonce` +function pointer of the `child_create_t` instance in the private task +struct. So besides having to be authenticated, an attacker has to get +two indirections right to exploit this flaw for a potential RCE. +Otherwise, the effects are a crash or basically undefined behavior +triggered by the method call. + +By passing whether the passive task is done (and would get destroyed), +the active tasks can properly clear the held reference. + +Note that this patch includes another fix for a state change during +Child SA rekeying that's included in 6.1.0 (4611f41b1e14 ("child-rekey: +Only reset state of SAs not actively rekeyed if passive rekeying +fails")). + +Fixes: d2b2e1b3fae8 ("ikev2: Make CHILD_SAs properly trackable during rekey collisions") +Fixes: ca3e6d2d144e ("ike-rekey: Support IKE_SA rekeying with multiple key exchanges") +Fixes: CVE-2026-78133 +CVE: CVE-2026-78133 +Upstream-Status: Backport [https://download.strongswan.org/security/CVE-2026-78133/] +Signed-off-by: Abhishek Bachiphale + +--- + src/libcharon/sa/ikev2/task_manager_v2.c | 13 +- + src/libcharon/sa/ikev2/tasks/child_rekey.c | 47 ++++-- + src/libcharon/sa/ikev2/tasks/child_rekey.h | 3 +- + src/libcharon/sa/ikev2/tasks/ike_rekey.c | 40 +++-- + src/libcharon/sa/ikev2/tasks/ike_rekey.h | 3 +- + src/libcharon/tests/suites/test_child_rekey.c | 136 ++++++++++++++++ + src/libcharon/tests/suites/test_ike_rekey.c | 147 ++++++++++++++++++ + 7 files changed, 361 insertions(+), 28 deletions(-) + +diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c +index 0f3b937fdd53..5a19ce85b331 100644 +--- a/src/libcharon/sa/ikev2/task_manager_v2.c ++++ b/src/libcharon/sa/ikev2/task_manager_v2.c +@@ -927,7 +927,8 @@ static status_t process_response(private_task_manager_t *this, + * Handle exchange collisions, returns TRUE if the given passive task was + * adopted by the active task and the task manager lost control over it. + */ +-static bool handle_collisions(private_task_manager_t *this, task_t *task) ++static bool handle_collisions(private_task_manager_t *this, task_t *task, ++ bool done) + { + enumerator_t *enumerator; + task_t *active; +@@ -951,7 +952,7 @@ static bool handle_collisions(private_task_manager_t *this, task_t *task) + if (type == TASK_IKE_REKEY || type == TASK_IKE_DELETE) + { + ike_rekey_t *rekey = (ike_rekey_t*)active; +- adopted = rekey->collide(rekey, task); ++ adopted = rekey->collide(rekey, task, done); + break; + } + continue; +@@ -959,7 +960,7 @@ static bool handle_collisions(private_task_manager_t *this, task_t *task) + if (type == TASK_CHILD_REKEY) + { + child_rekey_t *rekey = (child_rekey_t*)active; +- adopted = rekey->collide(rekey, task); ++ adopted = rekey->collide(rekey, task, done); + break; + } + continue; +@@ -1011,14 +1012,14 @@ static status_t build_response(private_task_manager_t *this, message_t *request) + case SUCCESS: + /* task completed, remove it */ + array_remove_at(this->passive_tasks, enumerator); +- if (!handle_collisions(this, task)) ++ if (!handle_collisions(this, task, TRUE)) + { + task->destroy(task); + } + break; + case NEED_MORE: + /* processed, but task needs another exchange */ +- if (handle_collisions(this, task)) ++ if (handle_collisions(this, task, FALSE)) + { + array_remove_at(this->passive_tasks, enumerator); + } +@@ -1029,7 +1030,7 @@ static status_t build_response(private_task_manager_t *this, message_t *request) + /* FALL */ + case DESTROY_ME: + /* destroy IKE_SA, but SEND response first */ +- if (handle_collisions(this, task)) ++ if (handle_collisions(this, task, FALSE)) + { + array_remove_at(this->passive_tasks, enumerator); + } +diff --git a/src/libcharon/sa/ikev2/tasks/child_rekey.c b/src/libcharon/sa/ikev2/tasks/child_rekey.c +index fb3ba2aafaf7..e984668c766e 100644 +--- a/src/libcharon/sa/ikev2/tasks/child_rekey.c ++++ b/src/libcharon/sa/ikev2/tasks/child_rekey.c +@@ -403,7 +403,7 @@ METHOD(task_t, build_r, status_t, + child_sa_t *child_sa, *old_replacement; + child_sa_state_t state = CHILD_INSTALLED; + uint32_t reqid; +- bool followup_sent = FALSE; ++ bool active, followup_sent = FALSE; + + if (!this->child_sa) + { +@@ -423,7 +423,8 @@ METHOD(task_t, build_r, status_t, + message->add_notify(message, TRUE, TEMPORARY_FAILURE, chunk_empty); + return SUCCESS; + } +- if (actively_rekeying(this, &followup_sent) && followup_sent) ++ active = actively_rekeying(this, &followup_sent); ++ if (active && followup_sent) + { + DBG1(DBG_IKE, "peer initiated rekeying, but we did too and already " + "sent IKE_FOLLOWUP_KE"); +@@ -483,8 +484,9 @@ METHOD(task_t, build_r, status_t, + /* like installing the outbound SA, we only trigger the child-rekey + * event once the old SA is deleted */ + } +- else if (this->child_sa->get_state(this->child_sa) == CHILD_REKEYING) +- { /* rekeying failed, reuse old child */ ++ else if (!active && ++ this->child_sa->get_state(this->child_sa) == CHILD_REKEYING) ++ { /* rekeying failed, reuse old child, unless we are actively rekeying */ + this->child_sa->set_state(this->child_sa, state); + } + return SUCCESS; +@@ -1127,8 +1129,22 @@ METHOD(child_rekey_t, handle_delete, child_rekey_collision_t, + return CHILD_REKEY_COLLISION_NONE; + } + ++/** ++ * Clear the colliding passive task if it did not complete successfully. ++ */ ++static void clear_collision(private_child_rekey_t *this, task_t *other) ++{ ++ if (this->collision == other) ++ { ++ DBG1(DBG_IKE, "colliding passive rekeying for CHILD_SA %s{%u} " ++ "failed", this->child_sa->get_name(this->child_sa), ++ this->child_sa->get_unique_id(this->child_sa)); ++ this->collision = NULL; ++ } ++} ++ + METHOD(child_rekey_t, collide, bool, +- private_child_rekey_t *this, task_t *other) ++ private_child_rekey_t *this, task_t *other, bool done) + { + private_child_rekey_t *rekey = (private_child_rekey_t*)other; + child_sa_t *other_child; +@@ -1142,16 +1158,25 @@ METHOD(child_rekey_t, collide, bool, + other_child = rekey->child_create->get_child(rekey->child_create); + if (!other_child) + { +- /* ignore passive tasks that did not successfully create a CHILD_SA */ ++ /* ignore passive tasks that did not successfully create a CHILD_SA, ++ * if we are already tracking it in the multi-KE case, clear it */ ++ clear_collision(this, other); + return FALSE; + } + if (other_child->get_state(other_child) != CHILD_INSTALLED) + { +- DBG1(DBG_IKE, "colliding passive rekeying for CHILD_SA %s{%u} is not " +- "yet complete", this->child_sa->get_name(this->child_sa), +- this->child_sa->get_unique_id(this->child_sa)); +- /* we do reference the task to check its state later */ +- this->collision = other; ++ if (done) ++ { /* passive task failed, clear it if necessary */ ++ clear_collision(this, other); ++ } ++ else ++ { ++ DBG1(DBG_IKE, "colliding passive rekeying for CHILD_SA %s{%u} is " ++ "not yet complete", this->child_sa->get_name(this->child_sa), ++ this->child_sa->get_unique_id(this->child_sa)); ++ /* we do reference the task to check its state later */ ++ this->collision = other; ++ } + return FALSE; + } + if (this->collision && this->collision != other) +diff --git a/src/libcharon/sa/ikev2/tasks/child_rekey.h b/src/libcharon/sa/ikev2/tasks/child_rekey.h +index a8daed743687..fef0bba8d071 100644 +--- a/src/libcharon/sa/ikev2/tasks/child_rekey.h ++++ b/src/libcharon/sa/ikev2/tasks/child_rekey.h +@@ -79,10 +79,11 @@ struct child_rekey_t { + * are going on and notifies the active task by passing the passive. + * + * @param other passive task ++ * @param done passive task is done and gets destroyed if not adopted + * @return whether the task was adopted and should be removed from + * the task manager's control + */ +- bool (*collide)(child_rekey_t* this, task_t *other); ++ bool (*collide)(child_rekey_t* this, task_t *other, bool done); + }; + + /** +diff --git a/src/libcharon/sa/ikev2/tasks/ike_rekey.c b/src/libcharon/sa/ikev2/tasks/ike_rekey.c +index c7e8ffbc8f02..f275d2da8f3f 100644 +--- a/src/libcharon/sa/ikev2/tasks/ike_rekey.c ++++ b/src/libcharon/sa/ikev2/tasks/ike_rekey.c +@@ -743,8 +743,23 @@ METHOD(ike_rekey_t, did_collide, bool, + return this->collision != NULL; + } + ++/** ++ * Clear the colliding passive task if it did not complete successfully. ++ */ ++static bool clear_collision(private_ike_rekey_t *this, ++ private_ike_rekey_t *other) ++{ ++ if (this->collision == other) ++ { ++ DBG1(DBG_IKE, "colliding passive rekeying failed, ignore"); ++ this->collision = NULL; ++ return TRUE; ++ } ++ return FALSE; ++} ++ + METHOD(ike_rekey_t, collide, bool, +- private_ike_rekey_t* this, task_t *other) ++ private_ike_rekey_t* this, task_t *other, bool done) + { + DBG1(DBG_IKE, "detected %N collision with %N", task_type_names, + TASK_IKE_REKEY, task_type_names, other->get_type(other)); +@@ -760,23 +775,30 @@ METHOD(ike_rekey_t, collide, bool, + + if (!rekey->ike_init) + { +- DBG1(DBG_IKE, "colliding exchange did not result in an IKE_SA, " +- "ignore"); +- if (this->collision == rekey) ++ if (!clear_collision(this, rekey)) + { +- this->collision = NULL; ++ DBG1(DBG_IKE, "colliding exchange did not result in an " ++ "IKE_SA, ignore"); + } + break; + } +- /* we keep track of the passive exchange in any case, if not +- * complete yet, this method might be called again later */ +- this->collision = rekey; ++ /* we keep track of the passive exchange, if not complete yet, this ++ * method might be called again later */ + if (rekey->flags & IKE_REKEY_DONE) + { ++ this->collision = rekey; + this->flags |= IKE_REKEY_ADOPTED_PASSIVE; + return TRUE; + } +- DBG1(DBG_IKE, "colliding passive exchange is not yet complete"); ++ else if (done) ++ { /* passive task failed, clear it if necessary */ ++ clear_collision(this, rekey); ++ } ++ else ++ { ++ DBG1(DBG_IKE, "colliding passive exchange is not yet complete"); ++ this->collision = rekey; ++ } + break; + } + default: +diff --git a/src/libcharon/sa/ikev2/tasks/ike_rekey.h b/src/libcharon/sa/ikev2/tasks/ike_rekey.h +index 5fab3491c1e2..e68fa622d8af 100644 +--- a/src/libcharon/sa/ikev2/tasks/ike_rekey.h ++++ b/src/libcharon/sa/ikev2/tasks/ike_rekey.h +@@ -54,10 +54,11 @@ struct ike_rekey_t { + * are going on and notifies the active task by passing the passive. + * + * @param other passive task ++ * @param done passive task is done and gets destroyed if not adopted + * @return whether the task was adopted and should be removed from + * the task manager's control + */ +- bool (*collide)(ike_rekey_t* this, task_t *other); ++ bool (*collide)(ike_rekey_t* this, task_t *other, bool done); + }; + + /** +diff --git a/src/libcharon/tests/suites/test_child_rekey.c b/src/libcharon/tests/suites/test_child_rekey.c +index 1c81e75e2bcd..4ef081a2495e 100644 +--- a/src/libcharon/tests/suites/test_child_rekey.c ++++ b/src/libcharon/tests/suites/test_child_rekey.c +@@ -2546,6 +2546,141 @@ START_TEST(test_collision_delayed_response_multi_ke) + } + END_TEST + ++/** ++ * Remove the KE payload from the IKE_FOLLOWUP_KE request ++ */ ++static bool remove_ke(listener_t *listener, ike_sa_t *ike_sa, ++ message_t *message, bool incoming, bool plain) ++{ ++ if (plain && incoming && ++ message->get_exchange_type(message) == IKE_FOLLOWUP_KE && ++ message->get_request(message)) ++ { ++ enumerator_t *enumerator = message->create_payload_enumerator(message); ++ payload_t *pld; ++ ++ while (enumerator->enumerate(enumerator, &pld)) ++ { ++ if (pld->get_type(pld) == PLV2_KEY_EXCHANGE) ++ { ++ message->remove_payload_at(message, enumerator); ++ pld->destroy(pld); ++ break; ++ } ++ } ++ enumerator->destroy(enumerator); ++ free(listener); ++ return FALSE; ++ } ++ return TRUE; ++} ++ ++#define remove_ke_from_ike_followup_ke() ({ \ ++ listener_t *_ke_listener; \ ++ INIT(_ke_listener, \ ++ .message = remove_ke, \ ++ ); \ ++ exchange_test_helper->add_listener(exchange_test_helper, _ke_listener); \ ++}) ++ ++/** ++ * This simulates an incorrect behavior by the peer. It triggers a collision by ++ * not responding to the initial CREATE_CHILD_SA and then sends an invalid ++ * IKE_FOLLOWUP_KE (in this case the KE payload is missing). The initiator ++ * has to correctly track and then untrack the passive rekey task. ++ * ++ * Peer A Peer B ++ * rekey ----\ /---- rekey ++ * \-----/----> detect collision and withhold response ++ * detect collision <---------/ ++ * ----------------> ++ * handle failure <---------------- send invalid additional KE ++ * handle rekey <---------------- send withheld response ++ */ ++START_TEST(test_collision_delayed_response_multi_ke_failure) ++{ ++ ike_sa_t *a, *b; ++ message_t *msg; ++ ++ assert_track_sas_start(); ++ ++ exchange_test_helper->establish_sa(exchange_test_helper, ++ &a, &b, &multi_ke_conf); ++ ++ /* make sure the responder wins the collision so it continues */ ++ exchange_test_helper->nonce_first_byte = 0x00; ++ initiate_rekey(a, 1); ++ assert_ipsec_sas_installed(a, 1, 2); ++ exchange_test_helper->nonce_first_byte = 0xff; ++ initiate_rekey(b, 2); ++ assert_ipsec_sas_installed(b, 1, 2); ++ ++ /* these should not get called as no SA goes down or gets rekeyed */ ++ assert_hook_not_called(child_updown); ++ assert_hook_not_called(child_rekey); ++ ++ /* CREATE_CHILD_SA { N(REKEY_SA), SA, Ni, [KEi,] TSi, TSr } --> */ ++ exchange_test_helper->nonce_first_byte = 0xff; ++ exchange_test_helper->process_message(exchange_test_helper, b, NULL); ++ assert_child_sa_state(b, 2, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED); ++ assert_ipsec_sas_installed(b, 1, 2); ++ ++ /* <-- CREATE_CHILD_SA { N(REKEY_SA), SA, Ni, [KEi,] TSi, TSr } */ ++ exchange_test_helper->nonce_first_byte = 0xff; ++ exchange_test_helper->process_message(exchange_test_helper, a, NULL); ++ assert_child_sa_state(a, 1, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED); ++ assert_ipsec_sas_installed(a, 1, 2); ++ ++ /* the responder is not responding */ ++ msg = exchange_test_helper->sender->dequeue(exchange_test_helper->sender); ++ ++ /* CREATE_CHILD_SA { SA, Nr, [KEr,] TSi, TSr } --> */ ++ exchange_test_helper->process_message(exchange_test_helper, b, NULL); ++ assert_num_tasks(b, 0, TASK_QUEUE_PASSIVE); ++ assert_num_tasks(b, 1, TASK_QUEUE_ACTIVE); ++ assert_child_sa_state(b, 2, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED); ++ assert_ipsec_sas_installed(b, 1, 2); ++ ++ /* remove the KE payload in the IKE_FOLLOWUP_KE request */ ++ remove_ke_from_ike_followup_ke(); ++ ++ /* <-- IKE_FOLLOWUP_KE { N(ADD_KE) } */ ++ assert_no_payload(IN, PLV2_KEY_EXCHANGE); ++ assert_single_notify(OUT, INVALID_SYNTAX); ++ exchange_test_helper->process_message(exchange_test_helper, a, NULL); ++ assert_child_sa_state(a, 1, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED); ++ assert_ipsec_sas_installed(a, 1, 2); ++ assert_num_tasks(a, 0, TASK_QUEUE_PASSIVE); ++ ++ /* <-- CREATE_CHILD_SA { SA, Nr, [KEr,] TSi, TSr } (delayed) */ ++ exchange_test_helper->process_message(exchange_test_helper, a, msg); ++ assert_num_tasks(a, 0, TASK_QUEUE_PASSIVE); ++ assert_num_tasks(a, 1, TASK_QUEUE_ACTIVE); ++ assert_child_sa_state(a, 1, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED); ++ assert_ipsec_sas_installed(a, 1, 2); ++ ++ /* drop the STATE_NOT_FOUND error message from the initiator */ ++ msg = exchange_test_helper->sender->dequeue(exchange_test_helper->sender); ++ msg->destroy(msg); ++ ++ /* since we explicitly forced the responder to win, it already removed ++ * the passive task it won't accept the request */ ++ ++ /* IKE_FOLLOWUP_KE { KEi, N(ADD_KE) } --> */ ++ assert_payload(IN, PLV2_KEY_EXCHANGE); ++ assert_notify(IN, ADDITIONAL_KEY_EXCHANGE); ++ exchange_test_helper->process_message(exchange_test_helper, b, NULL); ++ ++ /* child_rekey/child_updown */ ++ assert_hook(); ++ assert_hook(); ++ assert_track_sas(2, 2); ++ ++ call_ikesa(a, destroy); ++ call_ikesa(b, destroy); ++} ++END_TEST ++ + /** + * In this scenario one of the peers does not notice that there is a + * rekey collision: +@@ -4436,6 +4571,7 @@ Suite *child_rekey_suite_create() + tcase_add_loop_test(tc, test_collision_delayed_response, 0, 4); + tcase_add_loop_test(tc, test_collision_delayed_response_delete, 0, 4); + tcase_add_loop_test(tc, test_collision_delayed_response_multi_ke, 0, 4); ++ tcase_add_test(tc, test_collision_delayed_response_multi_ke_failure); + tcase_add_loop_test(tc, test_collision_delayed_request, 0, 6); + tcase_add_loop_test(tc, test_collision_delayed_request_more, 0, 3); + tcase_add_loop_test(tc, test_collision_delayed_request_more_delete, 0, 3); +diff --git a/src/libcharon/tests/suites/test_ike_rekey.c b/src/libcharon/tests/suites/test_ike_rekey.c +index c6691acf44aa..2c4102201d43 100644 +--- a/src/libcharon/tests/suites/test_ike_rekey.c ++++ b/src/libcharon/tests/suites/test_ike_rekey.c +@@ -1784,6 +1784,152 @@ START_TEST(test_collision_delayed_response_multi_ke) + } + END_TEST + ++/** ++ * Remove the ADDITIONAL_KEY_EXCHANGE notify payload from the IKE_FOLLOWUP_KE ++ * request ++ */ ++static bool remove_notify(listener_t *listener, ike_sa_t *ike_sa, ++ message_t *message, bool incoming, bool plain) ++{ ++ if (plain && incoming && ++ message->get_exchange_type(message) == IKE_FOLLOWUP_KE && ++ message->get_request(message)) ++ { ++ enumerator_t *enumerator = message->create_payload_enumerator(message); ++ payload_t *pld; ++ ++ while (enumerator->enumerate(enumerator, &pld)) ++ { /* we only expect one notify, so just remove the first */ ++ if (pld->get_type(pld) == PLV2_NOTIFY) ++ { ++ message->remove_payload_at(message, enumerator); ++ pld->destroy(pld); ++ break; ++ } ++ } ++ enumerator->destroy(enumerator); ++ free(listener); ++ return FALSE; ++ } ++ return TRUE; ++} ++ ++#define remove_notify_from_ike_followup_ke() ({ \ ++ listener_t *_ke_listener; \ ++ INIT(_ke_listener, \ ++ .message = remove_notify, \ ++ ); \ ++ exchange_test_helper->add_listener(exchange_test_helper, _ke_listener); \ ++}) ++ ++/** ++ * This simulates an incorrect behavior by the peer. It triggers a collision by ++ * not responding to the initial CREATE_CHILD_SA and then sends an invalid ++ * IKE_FOLLOWUP_KE (in this case by removing the ADDITIONAL_KEY_EXCHANGE ++ * notify). The initiator has to correctly track and then untrack the passive ++ * rekey task. ++ * ++ * Peer A Peer B ++ * rekey ----\ /---- rekey ++ * \-----/----> detect collision and withhold response ++ * detect collision <---------/ ++ * ----------------> ++ * handle failure <---------------- send invalid additional KE ++ * handle rekey <---------------- send withheld response ++ */ ++START_TEST(test_collision_delayed_response_multi_ke_failure) ++{ ++ ike_sa_t *a, *b; ++ message_t *msg; ++ ++ assert_track_sas_start(); ++ ++ exchange_test_helper->establish_sa(exchange_test_helper, ++ &a, &b, &multi_ke_conf); ++ ++ /* these should not get called as no SA goes down or gets rekeyed */ ++ assert_hook_not_called(ike_updown); ++ assert_hook_not_called(ike_rekey); ++ assert_hook_not_called(child_updown); ++ ++ /* make sure the responder wins the collision so it continues */ ++ exchange_test_helper->nonce_first_byte = 0x00; ++ initiate_rekey(a); ++ exchange_test_helper->nonce_first_byte = 0xff; ++ initiate_rekey(b); ++ ++ /* CREATE_CHILD_SA { SA, Ni, KEi } --> */ ++ exchange_test_helper->nonce_first_byte = 0xff; ++ exchange_test_helper->process_message(exchange_test_helper, b, NULL); ++ assert_ike_sa_state(b, IKE_REKEYING); ++ assert_child_sa_count(b, 1); ++ assert_ike_sa_count(0); ++ ++ /* <-- CREATE_CHILD_SA { SA, Ni, KEi } */ ++ exchange_test_helper->nonce_first_byte = 0xff; ++ exchange_test_helper->process_message(exchange_test_helper, a, NULL); ++ assert_ike_sa_state(a, IKE_REKEYING); ++ assert_child_sa_count(a, 1); ++ assert_ike_sa_count(0); ++ ++ /* the responder is not responding */ ++ msg = exchange_test_helper->sender->dequeue(exchange_test_helper->sender); ++ ++ /* simplify next steps by checking in original IKE_SAs */ ++ charon->ike_sa_manager->checkin(charon->ike_sa_manager, a); ++ charon->ike_sa_manager->checkin(charon->ike_sa_manager, b); ++ assert_ike_sa_count(2); ++ ++ /* CREATE_CHILD_SA { SA, Nr, KEr, N(ADD_KE) } --> */ ++ assert_notify(IN, ADDITIONAL_KEY_EXCHANGE); ++ exchange_test_helper->process_message(exchange_test_helper, b, NULL); ++ assert_num_tasks(b, 0, TASK_QUEUE_PASSIVE); ++ assert_num_tasks(b, 1, TASK_QUEUE_ACTIVE); ++ assert_ike_sa_state(b, IKE_REKEYING); ++ assert_ike_sa_count(2); ++ ++ /* remove the ADD_KE notify from the IKE_FOLLOWUP_KE request */ ++ remove_notify_from_ike_followup_ke(); ++ ++ /* <-- IKE_FOLLOWUP_KE { KEi } */ ++ assert_payload(IN, PLV2_KEY_EXCHANGE); ++ assert_no_notify(IN, ADDITIONAL_KEY_EXCHANGE); ++ assert_single_notify(OUT, STATE_NOT_FOUND); ++ exchange_test_helper->process_message(exchange_test_helper, a, NULL); ++ assert_ike_sa_state(a, IKE_REKEYING); ++ assert_child_sa_count(a, 1); ++ assert_ike_sa_count(2); ++ ++ /* <-- CREATE_CHILD_SA { SA, Nr, KEr } (delayed) */ ++ exchange_test_helper->process_message(exchange_test_helper, a, msg); ++ assert_num_tasks(a, 0, TASK_QUEUE_PASSIVE); ++ assert_num_tasks(a, 1, TASK_QUEUE_ACTIVE); ++ assert_ike_sa_state(a, IKE_REKEYING); ++ assert_child_sa_count(a, 1); ++ assert_ike_sa_count(2); ++ ++ /* drop the STATE_NOT_FOUND error message from the initiator */ ++ msg = exchange_test_helper->sender->dequeue(exchange_test_helper->sender); ++ msg->destroy(msg); ++ ++ /* since we explicitly forced the responder to win, it already removed ++ * the passive task it won't accept the request */ ++ ++ /* IKE_FOLLOWUP_KE { KEi, N(ADD_KE) } --> */ ++ assert_payload(IN, PLV2_KEY_EXCHANGE); ++ assert_notify(IN, ADDITIONAL_KEY_EXCHANGE); ++ exchange_test_helper->process_message(exchange_test_helper, b, NULL); ++ ++ /* ike_updown/rekey/child_updown */ ++ assert_hook(); ++ assert_hook(); ++ assert_hook(); ++ assert_track_sas(2, 2); ++ ++ charon->ike_sa_manager->flush(charon->ike_sa_manager); ++} ++END_TEST ++ + /** + * In this scenario one of the peers does not notice that there is a rekey + * collision because the other request is dropped: +@@ -2590,6 +2736,7 @@ Suite *ike_rekey_suite_create() + tcase_add_loop_test(tc, test_collision_ke_invalid_delayed_retry, 0, 3); + tcase_add_loop_test(tc, test_collision_delayed_response, 0, 4); + tcase_add_loop_test(tc, test_collision_delayed_response_multi_ke, 0, 4); ++ tcase_add_test(tc, test_collision_delayed_response_multi_ke_failure); + tcase_add_loop_test(tc, test_collision_dropped_request, 0, 3); + tcase_add_loop_test(tc, test_collision_delayed_request, 0, 3); + tcase_add_loop_test(tc, test_collision_delayed_request_and_delete, 0, 3); +-- +2.43.0 + diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb index ea92655270..ade8dd4696 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb @@ -18,6 +18,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78130.patch \ file://CVE-2026-78131.patch \ file://CVE-2026-78132.patch \ + file://CVE-2026-78133.patch \ " SRC_URI[sha256sum] = "07df7cedae56a7f3bb07e66d21a1f9f87e961db70e99184e11d3819413e4f87c" From patchwork Thu Oct 1 12:04:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Abhishek Bachiphale X-Patchwork-Id: 99821 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 96475CA5FD7 for ; Thu, 1 Oct 2026 12:05:29 +0000 (UTC) Received: from mx0a-0064b401.pphosted.com (mx0a-0064b401.pphosted.com [205.220.166.238]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9566.1790856321015994894 for ; Thu, 01 Oct 2026 05:05:21 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@windriver.com header.s=PPS06212021 header.b=kakE9dL+; spf=permerror, err=parse error for token &{10 18 %{ir}.%{v}.%{d}.spf.has.pphosted.com}: invalid domain name (domain: windriver.com, ip: 205.220.166.238, mailfrom: prvs=473490b304=abhishek.bachiphale@windriver.com) Received: from pps.filterd (m0250809.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6918Ecf3955562 for ; Thu, 1 Oct 2026 05:05:20 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriver.com; h=cc:content-transfer-encoding:content-type:date:from :in-reply-to:message-id:mime-version:references:subject:to; s= PPS06212021; bh=RkBvrhbP3GS5BxGxNayltpOONuvjtk7KgIzJFg0+huM=; b= kakE9dL+OXO7gU+oWUEMvp5XL5vqd6OprsUmmESIzMkGD/TfKd8kKGvdd8SH9EXl SkelWBw2CWRdGYWxeFLBR/XdyI+TpbuovYepyLTNWxsrercqv1A1z3syE0XNU7Fz PYreDyrVK9849T7ckY0WvViHgX/bT39u16cKpQCfI6DF4MkJ+e0rGl3w4X9gc+b7 8P5CWZNqv8vXuBEwLtHBRTWzuxnxznIS7l+dOydIvriGu9wjUB+gAn0lXvrrYm1m 6ZTGDeXYNIG3Nn9aJYihCZjOEdnBSoMEZ1Y4MYK9I6fjDpEYH0FRH1x3vH+mHVbA NMTQCd3p/Mqa4gnwPE45/Q== Received: from dm5pr21cu001.outbound.protection.outlook.com (mail-centralusazon11021080.outbound.protection.outlook.com [52.101.62.80]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 4h1ku8gaqw-5 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Thu, 01 Oct 2026 05:05:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=je8RB5EA5bxYqCrPF8mOW2RVPJyfXz7prFYQQcwzL4z6HBJMll01y//SDWlqpSb+GamN9RYdYDf4Gh/tBSIjdCtrPs6hVvz/w0Su7UOjm/izYVJ/LbRQe46mOpkL/6KpV2CuOK37vrscgwJZR8WREJqpDTf04iXJDnQOi9BP69a6YGxuiYwC+ywz/wB9hauDOgFYUebYh1kAIq3iR+UfBUqELWtCf8uEdfLe7GYxRpdSGWl6rTKJpmsVP0v6gr37/iX/hp6F3xrH5Cp/eZS58BIw40iNz/hKmOUA+cRjAhzhCg92DsHenOVIO5b205jfT90islF2RtmO9yj/eVsI+g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=RkBvrhbP3GS5BxGxNayltpOONuvjtk7KgIzJFg0+huM=; b=BaoFZrVsiZmPuE7HJmc+UqNOuepiRYsSbrB8PbjgiWbd64R09yH9V5xJofSF7KFJSwwswXKmc9G5OzFIVJWt2mEoR7i1azYQlP7aLgvOQ5Qvxv0sHYAazTFSh079tXIvqlePOlKxZ+00SF0XTjjR7Po6WCvMbOY3qspHmd5Kby3vKvdvKqH5zsEePXHWKtFKoXprbaQnBbDG5ts3VcUJlf3zfJf67gfnu0klgg6QaYjkkqS5vD40OUkbW8iLCqQRoRbCHz9QREqU+DKJSWdt5Bbe0Ov7IsZKvSNZcKegohHJuAzaYRSN488fw+m9qWWki3KsNt2l26VIGCjyFA3xnA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=windriver.com; Received: from IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) by MW4PR11MB8292.namprd11.prod.outlook.com (2603:10b6:303:20c::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.27; Thu, 1 Oct 2026 12:05:04 +0000 Received: from IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c]) by IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c%4]) with mapi id 15.21.0472.015; Thu, 1 Oct 2026 12:05:04 +0000 From: Abhishek Bachiphale To: openembedded-devel@lists.openembedded.org Cc: Shiva.Komati@windriver.com Subject: [meta-networking][wrynose][PATCH 10/11] strongswan: fix CVE-2026-78134 Date: Thu, 1 Oct 2026 17:34:16 +0530 Message-Id: <20261001120417.1280843-11-Abhishek.Bachiphale@windriver.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> References: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> X-ClientProxiedBy: TYCP301CA0020.JPNP301.PROD.OUTLOOK.COM (2603:1096:400:381::13) To IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR11MB8399:EE_|MW4PR11MB8292:EE_ X-MS-Office365-Filtering-Correlation-Id: d6ba6dd8-8bf3-43f3-876f-08df1fb438cc X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|52116014|376014|366016|23010399003|260925022911599003|260925021911599003|260925021311599003|10067099003|5023799004|11063799006|56012099006|3023799007|12006099003|6133799003|22082099003|18002099003|13003099007|38350700014; X-Microsoft-Antispam-Message-Info: e7HGawykhyTmDoHXDMhkojOibwuP+7kfZ3ry9Txl+i+AO0bp0sSTthRCCfamON+kRYgOVBw/K8xtxAZqgWRA74CwT/s3NPDPhOmmNrymF8XaBEGgL+gEu5TkfFk5v50heW3+Dm4Ql1HIkjj/QuIEhSHg+bEokggYb4+mZdE5RPM00N4iMptZnmADd8lhCHW41lb+BReq7nkqrCxTGtkIdJ/ScXupKKE5JLbipCGb4D5BtIB9GQtz0v9ligkIR2yWCqFfhp+ZLbsZRlJobLOm3cvvuSisDaR26Jl7JHEz2mzxS5V2fc0djH+Cj9uFXm0LxpHQuWFUR4VrIn13O/3Rg38iRkmXwQxNJJ9iCVPRq7q7wg+GKWnDcIyiArlyBw9RnmUA6gGIU2N61lT4bQ1D6P4aCFg0Z3Bo4rkUfHG/zfDNzyxQftxoqK3kBWuFbx/DJ0ybir+XEIc/H8GBeY6zabgb3lpTx25iD/nGPanJwqEUhpEp5Dzr94wfcYdjrHWd8TjJPA4kw7Yk8kFJZpRajHYEGDfP4zUGOenRDAHzJquZwuORD3Q8RQxbrytrVNOw4ujEpvObbcVtS0Sg1gCkz0WAIB3aurVx/jJ8YuBwkrCqwdBPPDRL+ir3DstHrJS0qns12CGDczOPu1660Pn1EwpMfjSfHMl+ddmepbva9xo= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR11MB8399.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(52116014)(376014)(366016)(23010399003)(260925022911599003)(260925021911599003)(260925021311599003)(10067099003)(5023799004)(11063799006)(56012099006)(3023799007)(12006099003)(6133799003)(22082099003)(18002099003)(13003099007)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: cPRHZZe6/bvMc+RW8GWve1soLLefSHxSlrcKGa0PkDTsHEGMZzzKQ5ybPn6kuQFOI95UxphG69UEZ2jRvW99oATPXthvsi4mHgY0WtLbRh2JPduJMeAJtfm8ipb/+wjX55nCbyj+959LX+T14/NJiFGm56I6Ds2hxgDHlee/9D807xS80WL6ctutQ20SZq7FnrteV5tgfpv6WJvmNmnzNUmzdUqFnO74yVc73Vt9JvgZ+o8FrZbl7UgkorfVEAT7nH+g5CuVoAoSoFpzUw08gl/JQDi2PCR2coG/bPmEj4p573vwF0eEeeyyQ1PzjKKE7A8bA/UjUeqMv5h+iG+MPymTF/hPK7VYwnVAx4HsGLEICIXWfmnhj7kCQpHtjG5RUlg5DWwp08AVFl6DG/tOO0kIrKJAPq8EWDPpXX2KKw88HV2xXNtznW/80kMHM9E2t2daggOYuUI9QiAHTcEdTge2sM/aKrvZSMpV0iyAlYjhioV+iZaYYFabDzhRdyEq3po/njlbh+O/gp/4N7S99C5k3qZeknSjr2CBpu205gCHmJkxxmNclNblyz72CiLvKGzfLagSuoKC+QIUGaBkvhPAuhesN/C7X6M1ZeZfB91cVe728tv3of/Y3aCRYh4mS3Q8kF7wI2MupOh7zfBVkOnBOay0NQ1SG2zbBukeA4HjqriksNim+vq1/3k9o+svJY9iKfR/lIDgfKD5m+nVNpIknBtOzE1iqLFQHo6ayBUsTRI7wjHPtamh2kEkgIZJhjXC+7cGGjtBhTMXJ/TutfJLhVRNxbkAfF27i7Z+Uft7sX3KZQugERICWXQJM6HRUXsq+xGMIZqQoHFF0D9tCLm81JKoiEbhCwZEG9telKNuFJLj2AyQJxjgxMfid2MyS+3PudH5cw4rgrM4TQ8kuHtw6S2WrXyBx4UsjzydKFYog5YaAA0LHJI2DPGWqGVVVtYKOgdfYsMCbfm89jMpg+okbp97W7D26Z7iBoAwR2BhqflH9QrnniCPWryaa1NPPYnQR4DloYHssDNJQ/Jyg+AXodqTO1+RGloLpplROyVEaz1ukW2Fd7l7LNJ5Ln3sbTNVBBEVuMukih7wA0IPT1kFb9N4Sq1WIl5e7PFoEVb2dcN2cNfrDPfvpM/3HXTme9ccsQcvroLZDD1YoZt7Sr+W4UKjd8llHk+SzEDfy56q+T2EllBPLBwYSd0KjuFaLgCotXFbkRGHA9Xe76Lh4DqfpqMRz59TXawFEoDLzboBRwrkJvp20jS5I+7iEPSFtFCyYb2BZyPuDoFJLWDVk/oLiX+TE5qHxE1kc1Ipk3BvnGv+g0k+ARPAXuFJT2a+RaZfa59PnEhnRujOgXMN5TZoSYBUEDCBpDe2JubCt79NpvVSGiDgE7V7QNdbi3mS+x3q+2O/PezXowMz+F3PckVwhQpI5JAFA9Pbb7RT63qogCJ+g1mElh+Uh2RcNtfQHvESOr+I4Fj6M6AZHOmvVFVmFOi+aIhqNz0qEeq1KIGALypLOYhBSY6Shz1r6RGyLot0kS0407ih4NVxlsRw/AsKF41SM1Ds4SkJI1q+zXad+IpcGJArv770+BVmNwv/Z9fk7HX20UvZJfs2OvwhYxbc51j5ieJTzeOWM6L/H4XtMIav3e77YNrEexKaBtkkQwROP/fo1JCp4w4P7/ZxnovYROFagkZPFzbr+dav5H/2skJ3fYjGuRvC/cG0FY63z91akt4C9xKE2/CpgPE5p/WNPFk7SFUU9vecYLwUq8mRvhPBPJ585RpsenN61lxV X-Exchange-RoutingPolicyChecked: 0eIK+wP4aOgxghMfbiNR+0fuN3IbUwSJbbduS1Heo5v0oxJErkinlBL/JdFxEv8No/NcWsDAmYyEeAbe/lBbrN4A6XSe6gVJ2IDLDROW1I5Le9l9F0DNg9sLvHbBdA6S+pAJIYNnHBrruTu5FpOCTHPilYBf43s5TOBoz+NUtWdSSgfGPC2Pl1giOm2IP/OnifvPis4jgWOFlERmghNZAu25bL7J5UPDwM0rfTmeS3n/15khKg0ADZZiz2a5RBdt/ygPNpTjtj6puQgRciQm/DO1oyl0YHq+UHmOaUfMpiqZUiEOVcr8LES5YQeygJGKAY/UeZ6kisFkjFAYoyOM/w== X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: d6ba6dd8-8bf3-43f3-876f-08df1fb438cc X-MS-Exchange-CrossTenant-AuthSource: IA0PR11MB8399.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Oct 2026 12:05:02.0909 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 0ZpCJj087Oan8v5HFvbWpJXTO0AzaFKGiqvj9iMYGZO1ajzhGxyzaAckJihE/5O177QSX1eCR1h0OI+N5Z3fXRVi/en0wQ0Jf/6AhwvI3/ILqp4qo2XGwLaOtIXJFKEv X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR11MB8292 X-Authority-Analysis: v=2.4 cv=c8Q+0h9l c=1 sm=1 tr=0 ts=6abe4c80 cx=c_pps a=rDyEm/81vvKQCy/iKDMZrQ==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=bi6dqmuHe4P4UrxVR6um:22 a=iKiJcTA2PjBS6x5JeXcw:22 a=PYnjg3YJAAAA:8 a=KiMCiSwjAAAA:8 a=xNf9USuDAAAA:8 a=t7CeM3EgAAAA:8 a=MMpcPSlh6HIoX9YATOkA:9 a=sPCYT0qwnquSfqsKqTDE:22 a=FdTzh2GWekK77mhwV6Dw:22 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfX6EBI5zbR7wmj VkqwR37e+u2ZOe66qcbs2RTacaQkrgjPI1teyWayd43/ZGHsDiAfhlk2AxB7KSYKTJA+zbZY/Z6 kner4hun9Brl0W8kscA87XwD/pKGGXvX9jFE6eiJBXi28LV4OGDz X-Proofpoint-ORIG-GUID: SSJoxAFJnSbpT4vd1d_koUpePLdzo26R X-Proofpoint-GUID: SSJoxAFJnSbpT4vd1d_koUpePLdzo26R X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfX/czwMqEhzg4+ tTGhW2to7RuwACOWhQsgO65BuZbJDHcse8w6obm+2uMzX5Zj0xDjmjcLMQbtnCtzW0Hu+oCVEfp 6KDGcASCtrRqqp2rcI0fRzkyjlEWIbyMqDIiknyBryHDWcBdYf2nyHzTZbuVsF5XpBHtdnN5cL8 GGmb/RlZfylLGWeOOw4FMzIVdlBRgcIQ1JTnyaipJK3rkWe/AytAXFRjWYI8bb8tPjvIDtk1EK+ x1rum0QKSu2M0CbzRD6ZJ3xu/tzwSOCwSd+Ems767F5SRz2BxzTMwEKxOfsSByRK5ke9NADr+al S7gCiYoldn298FWzxCzz6r4GeauvJTqNBWSoZh2myIC6842uoYsH7JFmNQPSYKYBYU8XABlq5o3 /mpICkFgXHT64XlR7CekJWqIzFgQAraa2hJLLnENZVkcVcBD6pb6ABANfqAFgt/XgPf6/rTk8w+ WmAOh/oXxj0h6L17b6A== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-01_03,2026-09-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 clxscore=1015 malwarescore=0 phishscore=0 lowpriorityscore=0 suspectscore=0 impostorscore=0 priorityscore=1501 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610010047 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 01 Oct 2026 12:05:29 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130586 strongSwan (since 4.5.0, through 6.0.7) mishandles the propagation of authentication details from inner EAP methods in the eap-peap and eap-ttls plugins, which can result in incorrect identity binding and potential authorization bypass. Reference: [https://nvd.nist.gov/vuln/detail/cve-2026-78134] [https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78134).html] [https://security-tracker.debian.org/tracker/CVE-2026-78134] Upstream Patch: [https://download.strongswan.org/security/CVE-2026-78134/] Signed-off-by: Abhishek Bachiphale --- .../strongswan/CVE-2026-78134.patch | 711 ++++++++++++++++++ .../strongswan/strongswan_6.0.6.bb | 1 + 2 files changed, 712 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78134.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78134.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78134.patch new file mode 100644 index 0000000000..bf80457f4e --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78134.patch @@ -0,0 +1,711 @@ +From 93ec5642432392fa183f1490ac391d0adde0b035 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Mon, 27 Jul 2026 15:05:45 +0200 +Subject: [PATCH] eap-ttls/peap: Return auth-cfg with details on TLS and inner + EAP method + +This fixes several issues with binding identities to the IKE SA. + +If the client is authenticated with a certificate, the previous code still +used the client's proclaimed inner EAP-Identity when starting the EAP-TNC +method. So that method would potentially operate on an unverified +identity. + +Second, if the inner EAP method overrides the client identity (the only +one is currently EAP-MSCHAPV2), the missing merge meant that the outer +IKE/EAP identity could potentially be unconfirmed. + +For inner methods that don't override the identity (e.g. EAP-MD5), not +propagating the inner EAP-Identity could potentially have the same +effect. + +While the EAP-TTLS implementation returned the auth-cfg of the TLS +exchange since the first referenced commit, this was mainly intended to +enforce public key constraints. So it didn't cover the phase 2 EAP +methods. For some reason EAP-PEAP did not get that method at all in that +changeset, so we'll add that now. + +Additionally, the EAP-PEAP implementation now forwards the phase 2 EAP +method type to EAP-TNC like the EAP-TTLS implementation already did, +which allows a more informed decision on the client's identity. + +Fixes: 0864a31d13ff ("eap-ttls: Support EAP auth information getter in EAP-TTLS") +Fixes: 79f2102cb442 ("implemented server side support for EAP-TTLS") +Fixes: 2a421163bf4f ("make TNC client authentication type available to IMVs") +Fixes: 1be296dfb2af ("implemented the PEAP tunneling protocol as an EAP plugin") +Fixes: CVE-2026-78134 +CVE: CVE-2026-78134 +Upstream-Status: Backport [https://download.strongswan.org/security/CVE-2026-78134/] +Signed-off-by: Abhishek Bachiphale + +--- + src/libcharon/plugins/eap_peap/eap_peap.c | 49 ++++++++++- + .../plugins/eap_peap/eap_peap_peer.c | 20 +++++ + .../plugins/eap_peap/eap_peap_peer.h | 7 ++ + .../plugins/eap_peap/eap_peap_server.c | 81 ++++++++++++++++--- + .../plugins/eap_peap/eap_peap_server.h | 7 ++ + src/libcharon/plugins/eap_ttls/eap_ttls.c | 43 +++++++++- + .../plugins/eap_ttls/eap_ttls_peer.c | 19 +++++ + .../plugins/eap_ttls/eap_ttls_peer.h | 7 ++ + .../plugins/eap_ttls/eap_ttls_server.c | 56 +++++++++++-- + .../plugins/eap_ttls/eap_ttls_server.h | 7 ++ + 10 files changed, 278 insertions(+), 18 deletions(-) + +diff --git a/src/libcharon/plugins/eap_peap/eap_peap.c b/src/libcharon/plugins/eap_peap/eap_peap.c +index 3573cba7c6eb..cd942f135dee 100644 +--- a/src/libcharon/plugins/eap_peap/eap_peap.c ++++ b/src/libcharon/plugins/eap_peap/eap_peap.c +@@ -40,6 +40,25 @@ struct private_eap_peap_t { + * TLS stack, wrapped by EAP helper + */ + tls_eap_t *tls_eap; ++ ++ /** ++ * Role ++ */ ++ bool is_server; ++ ++ /** ++ * Actual server/client implementation ++ */ ++ union { ++ tls_application_t *application; ++ eap_peap_server_t *server; ++ eap_peap_peer_t *client; ++ } impl; ++ ++ /** ++ * Cached auth data for TLS and inner EAP methods ++ */ ++ auth_cfg_t *auth; + }; + + /** Maximum number of EAP-PEAP messages/fragments allowed */ +@@ -113,10 +132,34 @@ METHOD(eap_method_t, is_mutual, bool, + return TRUE; + } + ++METHOD(eap_method_t, get_auth, auth_cfg_t*, ++ private_eap_peap_t *this) ++{ ++ if (!this->auth) ++ { ++ auth_cfg_t *inner; ++ ++ this->auth = auth_cfg_create(); ++ this->auth->merge(this->auth, ++ this->tls_eap->get_auth(this->tls_eap), FALSE); ++ if (this->is_server) ++ { ++ inner = this->impl.server->get_auth(this->impl.server); ++ } ++ else ++ { ++ inner = this->impl.client->get_auth(this->impl.client); ++ } ++ this->auth->merge(this->auth, inner, FALSE); ++ } ++ return this->auth; ++} ++ + METHOD(eap_method_t, destroy, void, + private_eap_peap_t *this) + { + this->tls_eap->destroy(this->tls_eap); ++ DESTROY_IF(this->auth); + free(this); + } + +@@ -135,6 +178,7 @@ static private_eap_peap_t *eap_peap_create_empty(void) + .get_type = _get_type, + .is_mutual = _is_mutual, + .get_msk = _get_msk, ++ .get_auth = _get_auth, + .get_identifier = _get_identifier, + .set_identifier = _set_identifier, + .destroy = _destroy, +@@ -147,7 +191,7 @@ static private_eap_peap_t *eap_peap_create_empty(void) + /** + * Generic private constructor + */ +-static eap_peap_t *eap_peap_create(private_eap_peap_t * this, ++static eap_peap_t *eap_peap_create(private_eap_peap_t *this, + identification_t *server, + identification_t *peer, bool is_server, + tls_application_t *application) +@@ -157,6 +201,9 @@ static eap_peap_t *eap_peap_create(private_eap_peap_t * this, + bool include_length; + tls_t *tls; + ++ this->is_server = is_server; ++ this->impl.application = application; ++ + if (is_server && !lib->settings->get_bool(lib->settings, + "%s.plugins.eap-peap.request_peer_auth", FALSE, + lib->ns)) +diff --git a/src/libcharon/plugins/eap_peap/eap_peap_peer.c b/src/libcharon/plugins/eap_peap/eap_peap_peer.c +index 95213a3286e5..f6c087ab2b90 100644 +--- a/src/libcharon/plugins/eap_peap/eap_peap_peer.c ++++ b/src/libcharon/plugins/eap_peap/eap_peap_peer.c +@@ -52,6 +52,11 @@ struct private_eap_peap_peer_t { + */ + eap_method_t *ph2_method; + ++ /** ++ * Auth data for phase 2 methods ++ */ ++ auth_cfg_t *auth; ++ + /** + * Pending outbound EAP message + */ +@@ -166,6 +171,12 @@ METHOD(tls_application_t, process, status_t, + switch (status) + { + case SUCCESS: ++ if (this->ph2_method->get_auth) ++ { ++ this->auth->merge(this->auth, ++ this->ph2_method->get_auth(this->ph2_method), ++ FALSE); ++ } + this->ph2_method->destroy(this->ph2_method); + this->ph2_method = NULL; + /* fall through to NEED_MORE */ +@@ -220,11 +231,18 @@ METHOD(tls_application_t, build, status_t, + return INVALID_STATE; + } + ++METHOD(eap_peap_peer_t, get_auth, auth_cfg_t*, ++ private_eap_peap_peer_t *this) ++{ ++ return this->auth; ++} ++ + METHOD(tls_application_t, destroy, void, + private_eap_peap_peer_t *this) + { + this->server->destroy(this->server); + this->peer->destroy(this->peer); ++ this->auth->destroy(this->auth); + DESTROY_IF(this->ph2_method); + DESTROY_IF(this->out); + this->avp->destroy(this->avp); +@@ -247,10 +265,12 @@ eap_peap_peer_t *eap_peap_peer_create(identification_t *server, + .build = _build, + .destroy = _destroy, + }, ++ .get_auth = _get_auth, + }, + .server = server->clone(server), + .peer = peer->clone(peer), + .ph1_method = eap_method, ++ .auth = auth_cfg_create(), + .avp = eap_peap_avp_create(FALSE), + ); + +diff --git a/src/libcharon/plugins/eap_peap/eap_peap_peer.h b/src/libcharon/plugins/eap_peap/eap_peap_peer.h +index 53c25cdd6bdf..7d169574321e 100644 +--- a/src/libcharon/plugins/eap_peap/eap_peap_peer.h ++++ b/src/libcharon/plugins/eap_peap/eap_peap_peer.h +@@ -38,6 +38,13 @@ struct eap_peap_peer_t { + * Implements the TLS application data handler. + */ + tls_application_t application; ++ ++ /** ++ * Get authentication details of this EAP method and its inner method(s). ++ * ++ * @return auth method, internal data ++ */ ++ auth_cfg_t *(*get_auth)(eap_peap_peer_t *this); + }; + + /** +diff --git a/src/libcharon/plugins/eap_peap/eap_peap_server.c b/src/libcharon/plugins/eap_peap/eap_peap_server.c +index 29ab9b4512aa..388c3c6b40b9 100644 +--- a/src/libcharon/plugins/eap_peap/eap_peap_server.c ++++ b/src/libcharon/plugins/eap_peap/eap_peap_server.c +@@ -20,6 +20,8 @@ + #include + #include + ++#include ++ + typedef struct private_eap_peap_server_t private_eap_peap_server_t; + + /** +@@ -77,6 +79,16 @@ struct private_eap_peap_server_t { + */ + eap_method_t *ph2_method; + ++ /** ++ * Type of the completed phase 2 EAP method ++ */ ++ eap_type_t phase2_type; ++ ++ /** ++ * Auth data for phase 2 method ++ */ ++ auth_cfg_t *auth; ++ + /** + * Pending outbound EAP message + */ +@@ -132,8 +144,11 @@ static status_t start_phase2_auth(private_eap_peap_server_t *this) + /** + * If configured, start EAP-TNC protocol + */ +-static status_t start_phase2_tnc(private_eap_peap_server_t *this) ++static status_t start_phase2_tnc(private_eap_peap_server_t *this, ++ eap_type_t auth_type) + { ++ eap_inner_method_t *inner_method; ++ + if (this->start_phase2_tnc && lib->settings->get_bool(lib->settings, + "%s.plugins.eap-peap.phase2_tnc", FALSE, lib->ns)) + { +@@ -145,6 +160,8 @@ static status_t start_phase2_tnc(private_eap_peap_server_t *this) + DBG1(DBG_IKE, "%N method not available", eap_type_names, EAP_TNC); + return FAILED; + } ++ inner_method = (eap_inner_method_t *)this->ph2_method; ++ inner_method->set_auth_type(inner_method, auth_type); + this->start_phase2_tnc = FALSE; + + /* synchronize EAP message identifiers of inner protocol with outer */ +@@ -218,9 +235,13 @@ METHOD(tls_application_t, process, status_t, + DBG1(DBG_IKE, "received tunneled EAP-PEAP AVP [EAP/%N]", + eap_code_short_names, code); + in->destroy(in); +- /* if EAP_SUCCESS check if to continue phase2 with EAP-TNC */ +- return (this->phase2_result == EAP_SUCCESS && code == EAP_SUCCESS) ? +- start_phase2_tnc(this) : FAILED; ++ if (this->phase2_result == EAP_SUCCESS && code == EAP_SUCCESS) ++ { ++ /* only accept SUCCESS once after a successful inner method */ ++ this->phase2_result = EAP_FAILURE; ++ return start_phase2_tnc(this, this->phase2_type); ++ } ++ return FAILED; + } + + if (this->ph2_method) +@@ -245,6 +266,10 @@ METHOD(tls_application_t, process, status_t, + if (!received_vendor && received_type == EAP_IDENTITY) + { + chunk_t eap_id; ++ bool peer_auth; ++ ++ peer_auth = lib->settings->get_bool(lib->settings, ++ "%s.plugins.eap-peap.request_peer_auth", FALSE, lib->ns); + + if (this->ph2_method == NULL) + { +@@ -271,9 +296,22 @@ METHOD(tls_application_t, process, status_t, + + if (this->ph2_method->get_msk(this->ph2_method, &eap_id) == SUCCESS) + { +- this->peer->destroy(this->peer); +- this->peer = identification_create_from_data(eap_id); +- DBG1(DBG_IKE, "received EAP identity '%Y'", this->peer); ++ identification_t *id; ++ ++ id = identification_create_from_data(eap_id); ++ if (peer_auth && !id->equals(id, this->peer)) ++ { ++ DBG1(DBG_IKE, "received tunneled EAP identity '%Y', keeping " ++ "certificate-authenticated identity '%Y'", id, this->peer); ++ id->destroy(id); ++ } ++ else ++ { ++ DBG1(DBG_IKE, "received EAP identity '%Y'", id); ++ this->auth->add(this->auth, AUTH_RULE_EAP_IDENTITY, id); ++ this->peer->destroy(this->peer); ++ this->peer = id->clone(id); ++ } + } + + in->destroy(in); +@@ -281,10 +319,9 @@ METHOD(tls_application_t, process, status_t, + this->ph2_method = NULL; + + /* Start Phase 2 of EAP-PEAP authentication */ +- if (lib->settings->get_bool(lib->settings, +- "%s.plugins.eap-peap.request_peer_auth", FALSE, lib->ns)) ++ if (peer_auth) + { +- return start_phase2_tnc(this); ++ return start_phase2_tnc(this, EAP_TLS); + } + else + { +@@ -305,11 +342,26 @@ METHOD(tls_application_t, process, status_t, + switch (status) + { + case SUCCESS: ++ if (this->ph2_method->get_auth) ++ { ++ identification_t *id; ++ auth_cfg_t *auth; ++ ++ auth = this->ph2_method->get_auth(this->ph2_method); ++ id = auth->get(auth, AUTH_RULE_EAP_IDENTITY); ++ if (id) ++ { ++ this->peer->destroy(this->peer); ++ this->peer = id->clone(id); ++ } ++ this->auth->merge(this->auth, auth, FALSE); ++ } + DBG1(DBG_IKE, "%N phase2 authentication of '%Y' with %N successful", + eap_type_names, EAP_PEAP, this->peer, + eap_type_names, type); + this->ph2_method->destroy(this->ph2_method); + this->ph2_method = NULL; ++ this->phase2_type = type; + + /* EAP-PEAP requires the sending of an inner EAP_SUCCESS message */ + this->phase2_result = EAP_SUCCESS; +@@ -407,11 +459,18 @@ METHOD(eap_peap_server_t, set_tls, void, + this->tls = tls; + } + ++METHOD(eap_peap_server_t, get_auth, auth_cfg_t*, ++ private_eap_peap_server_t *this) ++{ ++ return this->auth; ++} ++ + METHOD(tls_application_t, destroy, void, + private_eap_peap_server_t *this) + { + this->server->destroy(this->server); + this->peer->destroy(this->peer); ++ this->auth->destroy(this->auth); + DESTROY_IF(this->ph2_method); + DESTROY_IF(this->out); + this->avp->destroy(this->avp); +@@ -435,10 +494,12 @@ eap_peap_server_t *eap_peap_server_create(identification_t *server, + .destroy = _destroy, + }, + .set_tls = _set_tls, ++ .get_auth = _get_auth, + }, + .server = server->clone(server), + .peer = peer->clone(peer), + .ph1_method = eap_method, ++ .auth = auth_cfg_create(), + .start_phase2 = TRUE, + .start_phase2_tnc = TRUE, + .start_phase2_id = lib->settings->get_bool(lib->settings, +diff --git a/src/libcharon/plugins/eap_peap/eap_peap_server.h b/src/libcharon/plugins/eap_peap/eap_peap_server.h +index 3abe88bea68d..8080e9f23b05 100644 +--- a/src/libcharon/plugins/eap_peap/eap_peap_server.h ++++ b/src/libcharon/plugins/eap_peap/eap_peap_server.h +@@ -47,6 +47,13 @@ struct eap_peap_server_t { + * @param tls TLS connection + */ + void (*set_tls)(eap_peap_server_t *this, tls_t *tls); ++ ++ /** ++ * Get authentication details of this EAP method and its inner method(s). ++ * ++ * @return auth method, internal data ++ */ ++ auth_cfg_t *(*get_auth)(eap_peap_server_t *this); + }; + + /** +diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls.c b/src/libcharon/plugins/eap_ttls/eap_ttls.c +index d8ad781f0994..3df78bba4b58 100644 +--- a/src/libcharon/plugins/eap_ttls/eap_ttls.c ++++ b/src/libcharon/plugins/eap_ttls/eap_ttls.c +@@ -40,6 +40,25 @@ struct private_eap_ttls_t { + * TLS stack, wrapped by EAP helper + */ + tls_eap_t *tls_eap; ++ ++ /** ++ * Role ++ */ ++ bool is_server; ++ ++ /** ++ * Actual server/client implementation ++ */ ++ union { ++ tls_application_t *application; ++ eap_ttls_server_t *server; ++ eap_ttls_peer_t *client; ++ } impl; ++ ++ /** ++ * Cached auth data for TLS and inner EAP methods ++ */ ++ auth_cfg_t *auth; + }; + + /** Maximum number of EAP-TTLS messages/fragments allowed */ +@@ -116,13 +135,31 @@ METHOD(eap_method_t, is_mutual, bool, + METHOD(eap_method_t, get_auth, auth_cfg_t*, + private_eap_ttls_t *this) + { +- return this->tls_eap->get_auth(this->tls_eap); ++ if (!this->auth) ++ { ++ auth_cfg_t *inner; ++ ++ this->auth = auth_cfg_create(); ++ this->auth->merge(this->auth, ++ this->tls_eap->get_auth(this->tls_eap), FALSE); ++ if (this->is_server) ++ { ++ inner = this->impl.server->get_auth(this->impl.server); ++ } ++ else ++ { ++ inner = this->impl.client->get_auth(this->impl.client); ++ } ++ this->auth->merge(this->auth, inner, FALSE); ++ } ++ return this->auth; + } + + METHOD(eap_method_t, destroy, void, + private_eap_ttls_t *this) + { + this->tls_eap->destroy(this->tls_eap); ++ DESTROY_IF(this->auth); + free(this); + } + +@@ -153,6 +190,10 @@ static eap_ttls_t *eap_ttls_create(identification_t *server, + .destroy = _destroy, + }, + }, ++ .is_server = is_server, ++ .impl = { ++ .application = application, ++ }, + ); + if (is_server && !lib->settings->get_bool(lib->settings, + "%s.plugins.eap-ttls.request_peer_auth", FALSE, +diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c +index 63126a5c3a87..f8229f5e0ff8 100644 +--- a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c ++++ b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c +@@ -54,6 +54,11 @@ struct private_eap_ttls_peer_t { + */ + eap_method_t *method; + ++ /** ++ * Auth data for phase 2 method ++ */ ++ auth_cfg_t *auth; ++ + /** + * Pending outbound EAP message + */ +@@ -215,6 +220,11 @@ METHOD(tls_application_t, process, status_t, + switch (status) + { + case SUCCESS: ++ if (this->method->get_auth) ++ { ++ this->auth->merge(this->auth, ++ this->method->get_auth(this->method), FALSE); ++ } + this->method->destroy(this->method); + this->method = NULL; + /* fall through to NEED_MORE */ +@@ -275,11 +285,18 @@ METHOD(tls_application_t, build, status_t, + return INVALID_STATE; + } + ++METHOD(eap_ttls_peer_t, get_auth, auth_cfg_t*, ++ private_eap_ttls_peer_t *this) ++{ ++ return this->auth; ++} ++ + METHOD(tls_application_t, destroy, void, + private_eap_ttls_peer_t *this) + { + this->server->destroy(this->server); + this->peer->destroy(this->peer); ++ this->auth->destroy(this->auth); + DESTROY_IF(this->method); + DESTROY_IF(this->out); + this->avp->destroy(this->avp); +@@ -301,10 +318,12 @@ eap_ttls_peer_t *eap_ttls_peer_create(identification_t *server, + .build = _build, + .destroy = _destroy, + }, ++ .get_auth = _get_auth, + }, + .server = server->clone(server), + .peer = peer->clone(peer), + .start_phase2 = TRUE, ++ .auth = auth_cfg_create(), + .avp = eap_ttls_avp_create(), + ); + +diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h +index 0c3d90a45b7c..69a8435aefdb 100644 +--- a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h ++++ b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h +@@ -37,6 +37,13 @@ struct eap_ttls_peer_t { + * Implements the TLS application data handler. + */ + tls_application_t application; ++ ++ /** ++ * Get authentication details of this EAP method and its inner method(s). ++ * ++ * @return auth method, internal data ++ */ ++ auth_cfg_t *(*get_auth)(eap_ttls_peer_t *this); + }; + + /** +diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_server.c b/src/libcharon/plugins/eap_ttls/eap_ttls_server.c +index fc97f811ca5e..e1de1bf63c3f 100644 +--- a/src/libcharon/plugins/eap_ttls/eap_ttls_server.c ++++ b/src/libcharon/plugins/eap_ttls/eap_ttls_server.c +@@ -60,6 +60,11 @@ struct private_eap_ttls_server_t { + */ + eap_method_t *method; + ++ /** ++ * Auth data for phase 2 method ++ */ ++ auth_cfg_t *auth; ++ + /** + * Pending outbound EAP message + */ +@@ -220,6 +225,10 @@ METHOD(tls_application_t, process, status_t, + if (!received_vendor && received_type == EAP_IDENTITY) + { + chunk_t eap_id; ++ bool peer_auth; ++ ++ peer_auth = lib->settings->get_bool(lib->settings, ++ "%s.plugins.eap-ttls.request_peer_auth", FALSE, lib->ns); + + if (this->method == NULL) + { +@@ -244,9 +253,22 @@ METHOD(tls_application_t, process, status_t, + + if (this->method->get_msk(this->method, &eap_id) == SUCCESS) + { +- this->peer->destroy(this->peer); +- this->peer = identification_create_from_data(eap_id); +- DBG1(DBG_IKE, "received EAP identity '%Y'", this->peer); ++ identification_t *id; ++ ++ id = identification_create_from_data(eap_id); ++ if (peer_auth && !id->equals(id, this->peer)) ++ { ++ DBG1(DBG_IKE, "received tunneled EAP identity '%Y', keeping " ++ "certificate-authenticated identity '%Y'", id, this->peer); ++ id->destroy(id); ++ } ++ else ++ { ++ DBG1(DBG_IKE, "received EAP identity '%Y'", id); ++ this->auth->add(this->auth, AUTH_RULE_EAP_IDENTITY, id); ++ this->peer->destroy(this->peer); ++ this->peer = id->clone(id); ++ } + } + + in->destroy(in); +@@ -254,8 +276,7 @@ METHOD(tls_application_t, process, status_t, + this->method = NULL; + + /* Start Phase 2 of EAP-TTLS authentication */ +- if (lib->settings->get_bool(lib->settings, +- "%s.plugins.eap-ttls.request_peer_auth", FALSE, lib->ns)) ++ if (peer_auth) + { + return start_phase2_tnc(this, EAP_TLS); + } +@@ -278,6 +299,20 @@ METHOD(tls_application_t, process, status_t, + switch (status) + { + case SUCCESS: ++ if (this->method->get_auth) ++ { ++ identification_t *id; ++ auth_cfg_t *auth; ++ ++ auth = this->method->get_auth(this->method); ++ id = auth->get(auth, AUTH_RULE_EAP_IDENTITY); ++ if (id) ++ { ++ this->peer->destroy(this->peer); ++ this->peer = id->clone(id); ++ } ++ this->auth->merge(this->auth, auth, FALSE); ++ } + DBG1(DBG_IKE, "%N phase2 authentication of '%Y' with %N successful", + eap_type_names, EAP_TTLS, this->peer, + eap_type_names, type); +@@ -348,11 +383,18 @@ METHOD(tls_application_t, build, status_t, + return INVALID_STATE; + } + ++METHOD(eap_ttls_server_t, get_auth, auth_cfg_t*, ++ private_eap_ttls_server_t *this) ++{ ++ return this->auth; ++} ++ + METHOD(tls_application_t, destroy, void, + private_eap_ttls_server_t *this) + { + this->server->destroy(this->server); + this->peer->destroy(this->peer); ++ this->auth->destroy(this->auth); + DESTROY_IF(this->method); + DESTROY_IF(this->out); + this->avp->destroy(this->avp); +@@ -374,11 +416,13 @@ eap_ttls_server_t *eap_ttls_server_create(identification_t *server, + .build = _build, + .destroy = _destroy, + }, ++ .get_auth = _get_auth, + }, + .server = server->clone(server), +- .peer = peer->clone(peer), ++ .auth = auth_cfg_create(), + .start_phase2 = TRUE, + .start_phase2_tnc = TRUE, ++ .peer = peer->clone(peer), + .avp = eap_ttls_avp_create(), + ); + +diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_server.h b/src/libcharon/plugins/eap_ttls/eap_ttls_server.h +index 1e13f55c4c28..3348706cf280 100644 +--- a/src/libcharon/plugins/eap_ttls/eap_ttls_server.h ++++ b/src/libcharon/plugins/eap_ttls/eap_ttls_server.h +@@ -37,6 +37,13 @@ struct eap_ttls_server_t { + * Implements the TLS application data handler. + */ + tls_application_t application; ++ ++ /** ++ * Get authentication details of this EAP method and its inner method(s). ++ * ++ * @return auth method, internal data ++ */ ++ auth_cfg_t *(*get_auth)(eap_ttls_server_t *this); + }; + + /** +-- +2.43.0 + diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb index ade8dd4696..aa680d609f 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb @@ -19,6 +19,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78131.patch \ file://CVE-2026-78132.patch \ file://CVE-2026-78133.patch \ + file://CVE-2026-78134.patch \ " SRC_URI[sha256sum] = "07df7cedae56a7f3bb07e66d21a1f9f87e961db70e99184e11d3819413e4f87c" From patchwork Thu Oct 1 12:04:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Abhishek Bachiphale X-Patchwork-Id: 99818 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CBC78CA5FCC for ; Thu, 1 Oct 2026 12:05:28 +0000 (UTC) Received: from mx0a-0064b401.pphosted.com (mx0a-0064b401.pphosted.com [205.220.166.238]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9567.1790856321629847615 for ; Thu, 01 Oct 2026 05:05:21 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@windriver.com header.s=PPS06212021 header.b=JN80Ub52; spf=permerror, err=parse error for token &{10 18 %{ir}.%{v}.%{d}.spf.has.pphosted.com}: invalid domain name (domain: windriver.com, ip: 205.220.166.238, mailfrom: prvs=473490b304=abhishek.bachiphale@windriver.com) Received: from pps.filterd (m0250809.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6918Ecf4955562 for ; Thu, 1 Oct 2026 05:05:21 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=windriver.com; h=cc:content-transfer-encoding:content-type:date:from :in-reply-to:message-id:mime-version:references:subject:to; s= PPS06212021; bh=2Xe71Zxk+0aZPgtvwmSI1jaEMCqnzM09l4/CoC16ac4=; b= JN80Ub52k3qly/aW94BDQ8R6EKfUYSIVp/iGpzegizasfPzI7l8b3mBKPhnq2vHt b1O1jOI6cPlt3uef4eHWSCK0rS/9L37F4XZGFhCSbi92Gi0hG02aR544a4yj5GPB UWHoESQrO9bieS4SHTbateiXdkq6VOmIybTkPuMHO6NmITNeILHyywAoocBDp2Gt Kx19PYd+HL0gLAces6EF3xpY4GDOBd40qDt3Cdy6WhNyCButJ/nn8sEdXqSJqBd8 lMns/wY5hXEgLH50mP5sNXlaOpfbTjho9gKDA9U4YOOeY0d4xBya1LxQWeXlIQPd hn8VN1gHTMJbCjgVtDn9hA== Received: from dm5pr21cu001.outbound.protection.outlook.com (mail-centralusazon11021080.outbound.protection.outlook.com [52.101.62.80]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 4h1ku8gaqw-6 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Thu, 01 Oct 2026 05:05:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=EnEG7JXIf88qQBBiyX5yn1SeCJ6Mepdjk3OOpY9unVKrxGHHltZUPf3X4Ly6YaJRXmkFfArO2ruEFnT8MVO4prcFXvBUhLMUZ/ccf+tvlU1com9wNStFKHkyRGBGQuqgGeH7yN3IkaqsillI7Klo/YHrG3KyyjrAmjZcVIcp6/rS/Ot2yTsDFJ4EU0GrtEpf+3k55tbAPafVk6h4yiaMmz4Y7IRN1lBxVRJWaIJfzcjSrf8GZOCd+/rsun4ZJJzwZqW73EuaKf0Z9DSqGg9nF020m15bBf+WcN7BNV9ih0DGql46H3JwkQ8cmMZhUwhfrbvwRd07ASMYhj1Ppdx5ew== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=2Xe71Zxk+0aZPgtvwmSI1jaEMCqnzM09l4/CoC16ac4=; b=cVeOiGVEy6uaJoiV3el5Mjp+owvJwrUfkfgbE5pCMfm3TKrO1iaB8GhDzrnb0sejcwNy8YgmMhna0rxrGP74FRYm8TE5DBezZOA3yxWgUWXVbdjnplIEhUDAekwIp00B6/eJ730VMgDxTxdYa1YX81eyL0eu5fxjLfgiB1ghdl4AQfrLVUfb6RxECEvpNlsbEOPx7NJEeKjNehddj6i305Fd0tv5/kWadc4ZrLzX2ryb1QfBIerb1B8UTJobqM9sGJ9NaN0w7JKgBnewmdqauFH0i4THAzDUMy6QgbHfsMeBS3tDEvJnwxBdiJBbySPGXG8V8/EG4/Xx69CQVwVfUQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=windriver.com; Received: from IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) by MW4PR11MB8292.namprd11.prod.outlook.com (2603:10b6:303:20c::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.27; Thu, 1 Oct 2026 12:05:05 +0000 Received: from IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c]) by IA0PR11MB8399.namprd11.prod.outlook.com ([fe80::ea10:3d10:93bf:f83c%4]) with mapi id 15.21.0472.015; Thu, 1 Oct 2026 12:05:05 +0000 From: Abhishek Bachiphale To: openembedded-devel@lists.openembedded.org Cc: Shiva.Komati@windriver.com Subject: [meta-networking][wrynose][PATCH 11/11] strongswan: fix CVE-2026-78135 Date: Thu, 1 Oct 2026 17:34:17 +0530 Message-Id: <20261001120417.1280843-12-Abhishek.Bachiphale@windriver.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> References: <20261001120417.1280843-1-Abhishek.Bachiphale@windriver.com> X-ClientProxiedBy: TYCP301CA0020.JPNP301.PROD.OUTLOOK.COM (2603:1096:400:381::13) To IA0PR11MB8399.namprd11.prod.outlook.com (2603:10b6:208:48d::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR11MB8399:EE_|MW4PR11MB8292:EE_ X-MS-Office365-Filtering-Correlation-Id: 34f2e9d1-c797-405d-66f1-08df1fb439e7 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|52116014|376014|366016|23010399003|260925022911599003|260925021911599003|260925021311599003|10067099003|11063799006|56012099006|3023799007|12006099003|22082099003|18002099003|13003099007|38350700014; X-Microsoft-Antispam-Message-Info: 6IsjXIYQ2swJ27BzqS60exvMokYO33L9vnx690JGGraw5l+TInLwQyMKfxGwkohzL4OnCSw9Hh5dcIwu0xP2xKZvbBNoHE1w25jw8LRuqp21DtxeAkhO2GyJRiGANTw5cuXlI1C9gVeswYB7NsPom3LPhw+USaBiPeLhjYU2SwVABwB5kF+0sOCipJ1nDxcqU/cUWjiVV5TYKKTZP6+Zm8UvpvqvF/82KYbCBv7Nr7W4ACW5BE4sLsPvP0hfeFXvUCQ74mkDo6agHf1RIo3fn2Uk/EVnmSMUXWD20Ha7IfUu9m5a1SQPf0towFPjgRwCWN43aPM2oGHVbEsdUbEISX/CMxBOPc+YbCmgap2+whr8x/XwhdDxnr/4j4z+PNrKTrzzc14WyQAh/HyeKL+hEFwitXK/wv7FE+lEentt2I52UGLQXCBf8VMwTyn88cN46/5yA6/1YoJe+O7RFmgn3owWS5J1fn6iuzfLo0u1r8Y5lFPEbTCklXmfZKc8RneO0CAOa8zMoD2fhQ9XcA+0sElKnkzEYBbLd7ptSPGmCtDhV6Xp/jx/xmBbmhSsIqmX8Mu5Lnl48o5J0H9nk1ViGu5rDnFkOPBmeFeQ/vdVcFpmwLcOFagWSGFx+oEHqYpKv/3g3L+2xt3tFiUkkZ+qmNNbLBkATeVg9XBoIc1Suj0= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR11MB8399.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(52116014)(376014)(366016)(23010399003)(260925022911599003)(260925021911599003)(260925021311599003)(10067099003)(11063799006)(56012099006)(3023799007)(12006099003)(22082099003)(18002099003)(13003099007)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Mhq0ZUZaC+MUGtDjIDIicGenpbeNSv9JlVxiVnXUUkAA7OAtIUkUGmMrd6SWhmTT+YBLg4JhA2lEfbUWQ4o84F57uTEp3ABMJYR9Ac9Ki9gbj7r3//fEUAR8hs7c9yiWfIIBDuWsc/JPx4FN5MCw+Bv5oyqoJu6gLYubQsNrI3O92Sss/wzAei6FIRawPAwx2jngROMR4aSPAVqTXmbB1rKSIBAmTpvHOIuSuWJcvrf0ZPKTuSJ46vy8uL977iSyBsXl9QSo/gWPjBimsxRHRIyL/UmBEqIdiPrloeGRIpXHREMp1lY/74eJjvvN49Hc9YI5AETKVZ3m5LjpjmdNJGkhg8acSc4gik0XwHaXBJNkvaNCRJey/q8S+GPOSTv7aRl/B+VveKzBjn9jrzUVuJ5VSJV3BwFP9ssqPkOSlBmevRhJM1THYTTdehjyLcrY/EJ0w34mZuse8+JFgY7kQiNZfzrU1DT4o+DlQW8f/PXVmHMUG5LfJPBKr/rxmMoLQLRxJwwoGhQONx93hNPH0C/spt3hZzs0dO32xFK6+JwybrtFxtrglYXzE3IS1a4Gic5ibkX9qQGEhFHchEUp7ZrWk/lN4GaALr69+gIv8IE7e3jw0SXioodcM+qbYJxcGLnXhpRPSpSBMXlbRA/cvFw0O4lH/J6sWbh1+jXILcLCti2xdFvE8yRESJ2uF92VokSukylVP+/Y9AKvdZgFPRyu+k/W2ADXWAndnAg4B7JfjVGVk7we3ZVmn7Qa7MmU1sfwP+zVrFfhZLUHzVJlc5IJJ/rSPtLzvTgfN1xiFh3IOtX0wpPIZ+laEYGpRUVidWmgPXPhBURhHvE80t0K6ye518WFUz125ZnN4X2fgOMuQ3t5uPeETM+Wm0QxtvkXZUZCUWxunbcQMkDU1OL4eq7sPTXraugmvLNOzsQxsoekSWPxbdTw0uaVRxmcYI7vMtj5R5/aRiNHyxO0CKK+1PdgoSQCYtK5Fi2+r9VAR22LdTsC6SzQ5nwvaVSQUndVBEBPTYAyYQC5EONpuV9HyCWGYW5xm0/TJ4XnZj3PXfvSo0nE7QWQmyfckZaRx14R4uiEvgzxQ08+poVZuUydeCOE/JYTmEkKlEGIeQfTAXJAuAj4nYoAMXPcKpFbFFxF7oL34UHtvSX8B0pm7WLv4E1i9WRgNW+zDBwq25lt6BSF8rDWtgFUFGPTuQbdO7XGuIXJJyjV+4aRTNnJUDfiZg3vUAos28QjDmYoLpcEvrp6W0U9YNESIk/Qe8CeA67FrkblJojkqERxmQ1V+RklAc+ElvRiuXeOG7FhN3nJQzjF1qOUXf0PioklkBcp5mfdmYXynAt7dtRL0C3+5HwO2doQ2ayfTPRlqs4LmTlSXfuRz7RTgSetzuOjS8tUcka8X2DIlaOjlTnTv0K1GpjmEXOqR/vzwJIzKAo3ckjyFFweqL04xhfW/R/tXxeijc+DIhxrxj50idkVTZOfSO39IsyG5OKHYaJQ8bBGLHkIyy64PQl4vIQQp5vLrW62d1DDU0FTqIZOHj7zF4zz6rV2kUXgG+dzo+4uYDNtaudjdXc37mdWWt/rLuTJjbL0RYk2XkHuVhvNwR05rVYUokW9CCckUErTHJ+ZB1JgfvBHjetgrZiuSgPIZsNLytjOkM2+OlQa4ZMOONOmpjEa3DVdrOy3TwSdeAZQPdGMyjGhID9ZrwYlb2LB27q/9aVDY7oBDJy8VSK6+tF9SbzWdiA5JzTtsn+5j8p2EjyIpMqPsrzpxZxfsVfCy0bocD3Sl1XP X-Exchange-RoutingPolicyChecked: wfKxWDXF9KWN6jS/GymOWe+XhNmc+B1yBTE4n4lJujEKDVvdt4xMjAGCxMUFeXqhnn7AtECf3rSYteO/mLlPE7ZOtOxKCWx/fIHdWaMWCnfLgrBQEC9bgn2a9Ehy3cvRloM6sKujNYxIo6Hx6mXl9JInhmRHv2MPt4L/yMq7jknQel6fz5yEIdoS1bR/Xg4N3ReRuVsSh3lynkEYNSTPtzfJ/iZcfKh33f7OT3c5zvjqT8Q1e4pVBfzACeBok5nCdCWf0T7yiFXjlWHk6n2l8hMEMD6DyoBSzBHwXSiZS6cTWOcF8Qq6ndYEYcxvoJb3fKgz7B8tDSbNuzHsxFUugg== X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: 34f2e9d1-c797-405d-66f1-08df1fb439e7 X-MS-Exchange-CrossTenant-AuthSource: IA0PR11MB8399.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Oct 2026 12:05:03.8217 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 8nlx3p0JY2M2bnmZwcCXleUCmqTxm7AHFcPFyWSKsaYROhrmRTlG0GfNw6uZMdn1IiHuO8JQRz5U7zDRLiXxvjpybezyd+PKZPG4dHAbTplig58DBLHs3KfJym0GFBFm X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR11MB8292 X-Authority-Analysis: v=2.4 cv=c8Q+0h9l c=1 sm=1 tr=0 ts=6abe4c81 cx=c_pps a=rDyEm/81vvKQCy/iKDMZrQ==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=bi6dqmuHe4P4UrxVR6um:22 a=iKiJcTA2PjBS6x5JeXcw:22 a=PYnjg3YJAAAA:8 a=KiMCiSwjAAAA:8 a=xNf9USuDAAAA:8 a=t7CeM3EgAAAA:8 a=eWDlIGMm-JcpWxJbPyYA:9 a=sPCYT0qwnquSfqsKqTDE:22 a=FdTzh2GWekK77mhwV6Dw:22 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfXx7Qh0LpEXyxA PYLrX+hBUP5uD71IUshgSUUj/J4v1B6THZbFNZts+h/sFyL8pf3vg93SDPDlh7ZhBiF55EurjIT b0gckXyLth34wXp447+NddYQLzFewhEat+WDBonalE39mQ3q7kuw X-Proofpoint-ORIG-GUID: 5xYOoI1TMPXkoNlRKoRPvWjKX3M8SOJp X-Proofpoint-GUID: 5xYOoI1TMPXkoNlRKoRPvWjKX3M8SOJp X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDAxMDA0NyBTYWx0ZWRfX7S/2SAc7WoTJ nazK+M+V5sbpPorjoz1W58qtNZ1UeFWd0o8T/Uy2ihtOOvtxvJXr8dwfyMrBHdTsFk2G4E8m0cd NjB/codVM3DLb6+i/BVOlOm5ZFfdD2n/uivHhQvn7Tp8Po0DDF5HbvAAysDOAs+RLX8WckEtXT0 uJbjK+fX5RfdxT752NHZ248o+g8tyI67bvPDN6gmL1hJTNlfDDxiJxQk+zdWdI8y+eUcfh5fagh 4Uwua++2PFxOZNWy3KrICftTRSWQ7FumQY1+ZgDRDvbhtR2ItMLzFKtNLZ6nC6KqSQhkZ/9n6v4 4uubkzp20sK1x4EOwB6j93LNPGWprJsykwRvku28IgkLXUJrGdqQEK+bPUkPB3M6H+e5Lb08sMX Z0m5k+lcURebKhFqH4k3LVWkZ9uAvWHLYcUExn0F0TTi3/YmPikJoq/fUcLR46HWaFXbU69/DHP 4ltMAyaHVgONADFRlMQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-01_03,2026-09-21_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 clxscore=1015 malwarescore=0 phishscore=0 lowpriorityscore=0 suspectscore=0 impostorscore=0 priorityscore=1501 spamscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2609040000 definitions=main-2610010047 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 01 Oct 2026 12:05:28 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130587 libcharon in strongSwan 5.9.7 through 6.0.7 mishandles the IKEv2 state machine so that CREATE_CHILD_SA requests on unestablished IKE SAs are accepted, resulting in an authentication bypass. Reference: [https://nvd.nist.gov/vuln/detail/cve-2026-78135] [https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78135).html] [https://security-tracker.debian.org/tracker/CVE-2026-78135] Upstream Patch: [https://download.strongswan.org/security/CVE-2026-78135/] Signed-off-by: Abhishek Bachiphale --- .../strongswan/CVE-2026-78135.patch | 74 +++++++++++++++++++ .../strongswan/strongswan_6.0.6.bb | 1 + 2 files changed, 75 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78135.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78135.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78135.patch new file mode 100644 index 0000000000..69f90303c2 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78135.patch @@ -0,0 +1,74 @@ +From a34fb034926ccfebe556eb66aae5572a3b0b7e14 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Mon, 27 Jul 2026 08:53:50 +0200 +Subject: [PATCH] ikev2: Properly reject CREATE_CHILD_SA requests on + unestablished IKE_SAs + +The previous check was not actually enforced as long as there were still +tasks in the passive queue (it was originally added to fix an issue on +initiators, so the passive queue was expected to be empty). This allowed +an unauthenticated attacker to potentially establish a usable Child SA +if certain preconditions were met. + +First, it required that the initiator is authenticated with EAP so the +authentication and the creation of the first Child SA is deferred. +Second, the responder must either not configure an IP address pool or +an explicit remote TS, otherwise, traffic selector negotiation fails. + +Note that the half-open IKE SA and the installed IPsec SA will be removed +after the default timeout of 30 seconds. + +Fixes: 8503077175cd ("ikev2: Reject CREATE_CHILD_SA exchange on unestablished IKE_SAs") +Fixes: c60c7694d2d8 ("merged tasking branch into trunk") +Fixes: CVE-2026-78135 +CVE: CVE-2026-78135 +Upstream-Status: Backport [https://download.strongswan.org/security/CVE-2026-78135/] +Signed-off-by: Abhishek Bachiphale + +--- + src/libcharon/sa/ikev2/task_manager_v2.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c +index 5a19ce85b331..f9e9ab933a69 100644 +--- a/src/libcharon/sa/ikev2/task_manager_v2.c ++++ b/src/libcharon/sa/ikev2/task_manager_v2.c +@@ -1134,9 +1134,18 @@ static status_t process_request(private_task_manager_t *this, + delete_payload_t *delete; + ike_sa_state_t state; + ++ state = this->ike_sa->get_state(this->ike_sa); ++ if (message->get_exchange_type(message) == CREATE_CHILD_SA && ++ (state == IKE_CREATED || state == IKE_CONNECTING)) ++ { ++ DBG1(DBG_IKE, "received CREATE_CHILD_SA request for " ++ "unestablished IKE_SA, rejected"); ++ return FAILED; ++ } ++ ++ /* create tasks depending on request type, if not already some queued */ + if (array_count(this->passive_tasks) == 0) +- { /* create tasks depending on request type, if not already some queued */ +- state = this->ike_sa->get_state(this->ike_sa); ++ { + switch (message->get_exchange_type(message)) + { + case IKE_SA_INIT: +@@ -1177,14 +1186,6 @@ static status_t process_request(private_task_manager_t *this, + { /* FIXME: we should prevent this on mediation connections */ + bool notify_found = FALSE, ts_found = FALSE; + +- if (state == IKE_CREATED || +- state == IKE_CONNECTING) +- { +- DBG1(DBG_IKE, "received CREATE_CHILD_SA request for " +- "unestablished IKE_SA, rejected"); +- return FAILED; +- } +- + enumerator = message->create_payload_enumerator(message); + while (enumerator->enumerate(enumerator, &payload)) + { +-- +2.43.0 + diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb index aa680d609f..c84b2320ec 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.6.bb @@ -20,6 +20,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78132.patch \ file://CVE-2026-78133.patch \ file://CVE-2026-78134.patch \ + file://CVE-2026-78135.patch \ " SRC_URI[sha256sum] = "07df7cedae56a7f3bb07e66d21a1f9f87e961db70e99184e11d3819413e4f87c"