From patchwork Tue Oct 13 09:58:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100562 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 254F4CC6B08 for ; Tue, 13 Oct 2026 09:59:15 +0000 (UTC) Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3415.1791885552296354248 for ; Tue, 13 Oct 2026 02:59:12 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=De8GdKg5; spf=pass (domain: gmail.com, ip: 209.85.216.42, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-38ec1402b05so1263022a91.2 for ; Tue, 13 Oct 2026 02:59:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885551; x=1792490351; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=5NIk/Kgw5xvOD+JQHcmNKy9sbOP7mjMFnU6Y9lu4Afw=; b=De8GdKg59eVjTOxNYJTMqpTFpW9lhRbq79f/odTvnXzY16YwJUl/6ujrQDZyQ2PWL0 depXgzQpuRBvuYDYxIyT3D9jYZFGIdIj6SFbKdlf14cW2ucehe2ha9Abx9W71z+AelTb +2oMIOiqtaDMpkGJRH1jGlNGZTsP8U8zkVnaUig/VOwUqulNknxQtoNFsm31mqE4WqMJ /xE6c69PAlmTZCYCnCHE0jgzdoRVZZ2ruwGxgh4nd8Nh3NVJcwoD3kE7PoD46YO5tCE0 yWUiG8HEpohu2pNexXpaFDIgGyqaBnhLl70/PR1jdZmSyidWIWXHjyFBUHerHwwlI0Ii BY0g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885551; x=1792490351; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=5NIk/Kgw5xvOD+JQHcmNKy9sbOP7mjMFnU6Y9lu4Afw=; b=xZDjrbQN85Tsx0S0n1MHWbOjWt5c+zPAUHAN4ZCexVEg7pbPJejsrtNHsgXIRPGcqQ 68gzxIVxOHS4a8OsjWVr7ma1kKRxipSdby8O3Kki+R7RZkojUGBR8REwMos+uYr9PXe9 KN4J6mGScZl8XTyG6SDgApLXpyBjprDdI8u3Q8CG/Typ/tjC8PkXOzatYvHjMO7qWUVY INRxJZbJr115lNhJmmAsn1jBk9dIDF3ZlYv2Vfq88NOrbALQeOTLZYHAGH4L2FKYkAVs kIVf5y8rcLgF8B+uZhcW1mlxEXaVK0RmNuI7+v5MiTK9ssbmvH0wpPvMfl/Bzq5wbqLz dHKg== X-Gm-Message-State: AFq9FYI7uQmVyFI9705a6SJLE39UTgmwWNBJ1ogvTbJdWvT6UPOyIQ6m o6rU0VtsNr7pTDGrUhot9mJU1jB7gYxK2MTAMxC+qRz5SAN1GsrNH90VW1W3IA== X-Gm-Gg: AYBFou1BOdw81PFj57i7gsrLQOCktNKCEJt4aiVIZiH1UOxR7WLUV6KQ3atLQQEjUpA siUP6sNnxKYwpDJM3ETLX4Du2cP/yDbicq5ilgjxZqJyEuTdVNZpX5XE4k4m9RmSh/0SCbu5QXM fFhuRSPezvTCUXE8hfvbqYirHbbJIB4MWeDew+qJEyek/9a1QPdSgtZoGmoiN2vxWB6XO6OaKNX h+/joU+NDFSP5xaypwrGu5Awx3e8jZPmkaHnZxVBinx3DbywQlgreJ79ACoog7rjcsV8NtHIB2V imFWkaGUeQ1aLtelYORgYhxIevdkhiAXeI45AL/1/kW+nvHo4CWawnET9tG4wANTQjXCFNrXqNF wsO5QPcHzMBX+Y9qrtmYA/7BTD+/HRFWAKWPJPTFv9yC4T7crF31s+7ept5h9gsiX9VMBMdAyMl WsfZCCsTPbUVBbQOYGLpoJgTapqfn8t4MjW4dEbH3uwrcHcuzLPkR1UZbmyLtPB7qV0wNtzYH20 K+Xlnxuqf8AR/wofEZV1fBeZUV6MiboCgWSXqY= X-Received: by 2002:a17:90b:2d06:b0:3a4:b30b:b501 with SMTP id 98e67ed59e1d1-3ab3a32d491mr9173086a91.9.1791885551521; Tue, 13 Oct 2026 02:59:11 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.02.59.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 02:59:11 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][blacksail][PATCH 1/28] openvpn: ignore CVE-2026-84256 Date: Tue, 13 Oct 2026 22:58:36 +1300 Message-ID: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 09:59:15 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130834 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-84256 Signed-off-by: Ankur Tyagi --- meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb index 604162a7f2..9bf699124c 100644 --- a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb +++ b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb @@ -18,6 +18,7 @@ UPSTREAM_CHECK_URI = "https://openvpn.net/community-downloads" SRC_URI[sha256sum] = "3ab8f48fd6c26d49ba2333a092433949afdb5c85c0e6a1ff265784fbc04a2463" CVE_STATUS[CVE-2020-27569] = "not-applicable-config: Applies only Aviatrix OpenVPN client, not openvpn" +CVE_STATUS[CVE-2026-84256] = "not-applicable-platform: Issue only applies on Windows" INITSCRIPT_PACKAGES = "${PN}" INITSCRIPT_NAME:${PN} = "openvpn" From patchwork Tue Oct 13 09:58:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100563 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 27881CC6B0F for ; Tue, 13 Oct 2026 09:59:25 +0000 (UTC) Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3508.1791885555607037877 for ; Tue, 13 Oct 2026 02:59:15 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=kMNDBTG1; spf=pass (domain: gmail.com, ip: 209.85.216.43, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-3ab33730821so1524291a91.3 for ; Tue, 13 Oct 2026 02:59:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885555; x=1792490355; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Y2GZ05SsQvVqj9UW6c9UqSdHRBrdcYCibIAz3PnqTEY=; b=kMNDBTG1eQMEleh1f9ZDSU9qssr/Vomqt/ISirW3RwwYNpgpp7LAOO4uKGbJA4Uf1g wrQdlsgm+poc4TBKdOHhDqwGshMDpC+kUj8/SMol9jLPkKr/mcVCXguEzYT/XLJXo3jR 9wt5ona5FDpRdx1Slb21ywDdzcLdvmUdXCt5SIGWQuF1s99zLcndokC3gwbv/ePJOgKT H0iS3qoGYLXLaB/s+6z4ZOm3ESEQhu16EL9SRFHG8gn/oQZqruI+u7siXYfSWDC2ntYN tGltnZSCHBYF98CWp3r88Gbt72qDsMQeVfaYWQiHrDPPnTqPugaTZHIIqrmx3xV0DY0a vN5A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885555; x=1792490355; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Y2GZ05SsQvVqj9UW6c9UqSdHRBrdcYCibIAz3PnqTEY=; b=rBiwMkQCPGhAb4PgBZMXkn406uoYFkxFmoaGz+HLOu+Rx9DVGeqhy2eBcRY2voOv3O brahrOlUNznzrVJL4rAuSKgMqlCtE2bS/8yjM11Ky2D34qkK4FCWQEUrPUmlPpj3XNj4 7TRLPijXVHppiYa0P2PBUWbE6pqGARwk17gttk2RR/hQM7MDzQYAgtnBcL5UwPXaPPNB t3IAJQCmpGm67iES6sbCaE9ZQrdufNB10oGkJY5OOwNN7Ym8EMfTwPGyW4jwyoHT6Cmz UyGC9anh9Cpj0DGXTzn5R/PnTc4LXv57UQb4PXYdSwtF+wnR98ftWp9pmm3hnzH8eNxm a8EA== X-Gm-Message-State: AFq9FYJQaMReT2Xan6qisoDB6AlikeruflIOAXb7xRY1DK5xPUZpGQUm xCoa/nB92CmEwjlPWveAGLpHBAFxYdfi/PWe6S1OUvXSl6uNTnNbpydRCW4jpA== X-Gm-Gg: AYBFou25harBxf1OlrbxkHQq8At6snOYentLCJfRaEsGcwEZU3ggWSMweYPG3D65/en 4PlRQMLEKylMznG3ISPax27hhrbjQR6xYWvtrwoJKONmXaygTWHBRQdUrnFUz1EUDlpvQbTISjx IFyhst+edI+2baipcCOzrASj8oyV7oxwPE4jQq5fJUVN2jv6cY41JydJAAhs5lv83gd61DkGBbh Rqex915FJb4jFU8bPgwUNW8Z1T+4TuYlyRFgb/6jQAdQxG/UewCtK35Dnfgy010rWn68wrXsCLt MWjY5UAb/iJPAIFPz+SNZ4A+asRffsIMxUCbdPGoGQ8vHkS9Za1GNAvc+aQzx+ngYxi5bNebf8f RW5rcm+h5KS2NR3TjFBemm0WRhbU1hzanp0bPzvcvyXt5NSnJxX81OdRFYh1MudU7k1K1vvDUF2 XQQQROGkrRXfrfP5WEhkVZOhePO76CHZAWeWaw6J/Xl5Pd/ZY/ojFIryq1sqrAzLbIXZ6Bu37R8 MSv4nUnNB+SjmNoA+IINQ/ZyoVGcU1LSwEfaKa4zw== X-Received: by 2002:a17:90b:5444:b0:3a4:b74a:795c with SMTP id 98e67ed59e1d1-3ab3a60cec9mr9735830a91.16.1791885554919; Tue, 13 Oct 2026 02:59:14 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.02.59.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 02:59:13 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][blacksail][PATCH 2/28] openvpn: patch CVE-2026-88964 Date: Tue, 13 Oct 2026 22:58:37 +1300 Message-ID: <20261013095903.3544906-2-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 09:59:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130835 From: Ankur Tyagi Backport commit identified by Debian[1], also mentioned in the release note https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8 [1]https://security-tracker.debian.org/tracker/CVE-2026-88964 Signed-off-by: Ankur Tyagi --- .../openvpn/openvpn/CVE-2026-88964.patch | 78 +++++++++++++++++++ .../recipes-support/openvpn/openvpn_2.7.7.bb | 1 + 2 files changed, 79 insertions(+) create mode 100644 meta-networking/recipes-support/openvpn/openvpn/CVE-2026-88964.patch diff --git a/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-88964.patch b/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-88964.patch new file mode 100644 index 0000000000..a2b9b0ec8a --- /dev/null +++ b/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-88964.patch @@ -0,0 +1,78 @@ +From 22526848c6606698d6374c496f36009b9c6787ce Mon Sep 17 00:00:00 2001 +From: Cole Munz +Date: Sun, 13 Sep 2026 15:23:17 +0200 +Subject: [PATCH] options: fix unsigned underflow when clearing + domain_search_list + +remove_option() and update_option() clear the domain search list with + + while (o->domain_search_list_len-- > 0) + +domain_search_list_len is unsigned, and the post-decrement runs on the +final test too. When the length reaches 0 the condition is false but +the decrement has already wrapped it to UINT_MAX, so the field is left +corrupted. The next reset then does + + o->domain_search_list[UINT_MAX] = NULL + +and walks far out of bounds, writing NULL through each slot. A server +can drive this reset path against a client with PUSH_UPDATE, so on +Windows and Android this is a remotely reachable out-of-bounds write. + +v2: + Change to the semantics used for all the other lists there - set + length to 0 and clear the list with CLEAR(). + +Change-Id: I3724236d4acc3d05d786274d6baf34a21c570594 +Signed-off-by: Cole Munz +Acked-by: Razvan Cojocaru +Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1914 +Github: OpenVPN/openvpn-private-issues#178 +CVE: 2026-88964 +Message-Id: <20260913132322.2283-1-gert@greenie.muc.de> +URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg39157.html +Signed-off-by: Gert Doering +(cherry picked from commit aa12dd64b74142bbbff9f37cec05959ba115c06d) +(cherry picked from commit d586f8ad9bfc582cc7984fcd482dc7cfacc940e2) + +CVE: CVE-2026-88964 +Upstream-Status: Backport [https://github.com/OpenVPN/openvpn/commit/d586f8ad9bfc582cc7984fcd482dc7cfacc940e2] +Signed-off-by: Ankur Tyagi +--- + src/openvpn/options.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/src/openvpn/options.c b/src/openvpn/options.c +index b7d035b6..847572c2 100644 +--- a/src/openvpn/options.c ++++ b/src/openvpn/options.c +@@ -5220,12 +5220,12 @@ remove_option(struct context *c, struct options *options, char *p[], bool is_inl + memset(o->ntp, 0, sizeof(o->ntp)); + o->nbdd_len = 0; + memset(o->nbdd, 0, sizeof(o->nbdd)); +- while (o->domain_search_list_len-- > 0) +- { +- o->domain_search_list[o->domain_search_list_len] = NULL; +- } ++ o->domain_search_list_len = 0; ++ CLEAR(o->domain_search_list); + o->disable_nbt = 0; + o->dhcp_options = 0; ++ CLEAR(options->dns_options.from_dhcp); ++ + #if defined(TARGET_ANDROID) + o->http_proxy_port = 0; + o->http_proxy = NULL; +@@ -5524,10 +5524,8 @@ update_option(struct context *c, struct options *options, char *p[], bool is_inl + CLEAR(o->ntp); + o->nbdd_len = 0; + CLEAR(o->nbdd); +- while (o->domain_search_list_len-- > 0) +- { +- o->domain_search_list[o->domain_search_list_len] = NULL; +- } ++ o->domain_search_list_len = 0; ++ CLEAR(o->domain_search_list); + o->disable_nbt = 0; + o->dhcp_options = 0; + diff --git a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb index 9bf699124c..6338a0c816 100644 --- a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb +++ b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb @@ -11,6 +11,7 @@ SRC_URI = "https://github.com/OpenVPN/openvpn/releases/download/v${PV}/${BP}.tar file://0001-configure.ac-eliminate-build-path-from-openvpn-versi.patch \ file://openvpn \ file://run-ptest \ + file://CVE-2026-88964.patch \ " UPSTREAM_CHECK_URI = "https://openvpn.net/community-downloads" From patchwork Tue Oct 13 09:58:38 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100565 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5CFD1CC6B14 for ; Tue, 13 Oct 2026 09:59:26 +0000 (UTC) Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3416.1791885558207361812 for ; Tue, 13 Oct 2026 02:59:18 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=JaiLkUPc; spf=pass (domain: gmail.com, ip: 209.85.216.45, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-38ec1402b05so1263098a91.2 for ; Tue, 13 Oct 2026 02:59:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885557; x=1792490357; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=yl091zSqxJ1wyONVqV3/9eoGbFJvQFprUh6CXfXL+Aw=; b=JaiLkUPcQ2WSjkxGovrwk4iFVf8nYwC32ZanpF6dgEjKrEeV1CUEfdLWsWH3F7t8mG e4A1DT5XIi8wCDr23K1W9Q4xliT65Gaa9+TfsIVN7ArsRgkWhpgkE2/IEpVJWImOVfZU ItMvJtdciYxKseJmfAQhNgRLNJr44MNE0CH2fLUbGr7yuNlPRrxQEC0nTjtrYr2jFrxq 9DsMqNkVRbjqKo0gK5FaIdfjIVH+XViwI45SmTqGHqqnpbcN0rfHwkaxVGiBCJGOY0cD qw2zVCRMnZTuxt6RMuG7CPxXMJlYbf57m+YpYHrAvbZIJGujbxFOpLs6+5K5m12h00pb taig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885557; x=1792490357; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=yl091zSqxJ1wyONVqV3/9eoGbFJvQFprUh6CXfXL+Aw=; b=fl5YuU8A9oIcssulcsdQDVJOUuMIOz2WVv9bg+kk6D22LB2x6kJOxy7FI78IMgJxug 1xX3Sm7Ox3xSj8833e9q8thQh1UP92hn6qAJgY5zIVWgbDmcGA3UFjLVyolHn8HVKmQp KlitA0QcmoS+/OV+GlJuL4pjITvocAsS+YkLo8TxlU5oaPbb/FvI0qs1wqX/JrNwUjSx zT3E1vnYf1ZUA/fFriW8tfJw3EJVCXGSMvAh0cS9JdxnOUI9qvanqnIc2kQSHZ/JS9Jg izxz8tki1Hqmk+as7Fthgtrc83qDROrH2bflFJdDIGpi8BVj7iM7pmbuUTwM8PWgr6Ca pFmg== X-Gm-Message-State: AFq9FYKo9H4RUhYMd5WxYUyKDnriNx1yYOISlcHSTSTISNHfqTxW5+aG a0Yfgrogi869dCcqwKfhCJM7hLWBplvEcW+DIy34M+ApUJUirU/m0rOvD6UJlQ== X-Gm-Gg: AYBFou0Lvbuc7mrefzQarr57jHa6frDV+eh9OyrNb3lGVCn278dqBrZb4Q3Nq6Bl4Vp jFhLESdITEfjGu7u7TNDaZAc7Y+SzM/b3Txil8U9lBBd/Uw4Q4P013OYIP+iW6YFKIuCUi5l5Nq ZGU8jkgsm7njzybFmamlasLOo/OHuxWG3sLY2yTq5vqMnaaP/AFXaSE11L/nQRkcP8AO1KVvrIO OwEAa/II8akqPUBNRQb9ge6aBOC2rf9Y4VRgBV8hty/6E/MfqE5OBsHL1nUFd2Misl+ULNcwq5e SyEJtwNIX4qdpR41ZFbQllIgJ7Xd5cgUgvBbKill/T2WSNHyBy5Uiu50IEoh59y6hSHwxJ180e6 sQEvzPctlqo2Iuhhd5bSvQGrwhxGjHl27/QprbGVKoycRQ+6HLPoTJ7Cr2ndT9UCfBQMtedynN5 AWTzhLssjBPqmu88TqIZm8eOEZT4r1hUlP3k2yftPyRpIqf3oQqCWqx5PG7dJXH/k5hWTm/aS60 JwvHkE8lUrk7uP/uuIjYq3Obm6M+WZe3bWxgVw= X-Received: by 2002:a17:90b:2b4e:b0:3aa:9a32:5054 with SMTP id 98e67ed59e1d1-3ab3ace05e2mr9479436a91.62.1791885557399; Tue, 13 Oct 2026 02:59:17 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.02.59.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 02:59:16 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][blacksail][PATCH 3/28] openvpn: patch CVE-2026-84790 Date: Tue, 13 Oct 2026 22:58:38 +1300 Message-ID: <20261013095903.3544906-3-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 09:59:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130836 From: Ankur Tyagi Backport commit identified by Debian[1], also mentioned in the release note https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8 [1]https://security-tracker.debian.org/tracker/CVE-2026-84790 Signed-off-by: Ankur Tyagi --- .../openvpn/openvpn/CVE-2026-84790.patch | 361 ++++++++++++++++++ .../recipes-support/openvpn/openvpn_2.7.7.bb | 1 + 2 files changed, 362 insertions(+) create mode 100644 meta-networking/recipes-support/openvpn/openvpn/CVE-2026-84790.patch diff --git a/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-84790.patch b/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-84790.patch new file mode 100644 index 0000000000..b6f70d106d --- /dev/null +++ b/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-84790.patch @@ -0,0 +1,361 @@ +From 493c3b382a907ff2d5870cd0d21526bd2e866ebb Mon Sep 17 00:00:00 2001 +From: Max Fillinger +Date: Thu, 17 Sep 2026 14:46:05 +0200 +Subject: [PATCH] Check for null-bytes in certificate subjects + +When using the OpenSSL library, we escaped embedded null-bytes in a +certificate's subject in x509_get_subject(), but in +extract_x509_field_ssl(), we copied any null-bytes that are contained in +the field value. When using the option --verify-x509-name, this could +lead to an incorrect name being accepted. For example, the common name +"admin\0impersonator" would be accepted when running with +--verify-x509-name admin name. + +To fix this, this commit makes x509_get_subject() return an error if the +subject contains an embedded null-byte. This way, OpenVPN won't connect +with peers that present such certificates. + +As a defense-in-depth measure, we also check for null-bytes in +extract_x509_field_ssl() in case a future version of OpenVPN has a code +path that avoids x509_get_subject(). + +With Mbed TLS, the x509_get_subject() function already returned an error +when there is an embedded null-byte. (As of Mbed TLS 3.5.) Here too, we +added a check for null-bytes to the function where we extract individual +fields from the subject. + +Also, backend_x509_get_username() is changed so that it returns the +value of the *last* matching field, to be consistent with the behavior +of the OpenSSL backend. + +This is a partial backport of the commit +"Check for \0 and RFC 2253 chars in cert subjects" from the master +branch but skipping the part about escaping RFC 2253 characters to avoid +user-visible changes in a patch release. We do not consider the +null-byte check "user-visible" because we don't expect users to put +null-bytes into the common name. + +v2: The previous version of the commit unescaped control characters in +the subject, so it had user-visible changes after all. This version +escapes any control characters in the subject. + +Discovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2. +Contributing Researcher: Vivek Parikh. + +CVE: 2026-84790 +Reported-by: Vivek Parikh +Github: OpenVPN/openvpn-private-issues#163 + +Change-Id: Iea1481e94ba1abe18c39d81cd797187c88427571 +Signed-off-by: Max Fillinger +Acked-by: Steffan Karger +Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1902 +Message-Id: <20260917124610.14291-1-gert@greenie.muc.de> +URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg39304.html +Signed-off-by: Gert Doering +(cherry picked from commit cf4384eef4676a01bd3ee98fa602f7b2af8079ea) + +CVE: CVE-2026-84790 +Upstream-Status: Backport [https://github.com/OpenVPN/openvpn/commit/cf4384eef4676a01bd3ee98fa602f7b2af8079ea] + +Signed-off-by: Ankur Tyagi +--- + src/openvpn/ssl_verify_mbedtls.c | 51 ++++++++++------ + src/openvpn/ssl_verify_openssl.c | 41 ++++++++++--- + tests/unit_tests/openvpn/test_ssl.c | 92 ++++++++++++++++++++++++++++- + 3 files changed, 155 insertions(+), 29 deletions(-) + +diff --git a/src/openvpn/ssl_verify_mbedtls.c b/src/openvpn/ssl_verify_mbedtls.c +index 66cc66e5..1319c079 100644 +--- a/src/openvpn/ssl_verify_mbedtls.c ++++ b/src/openvpn/ssl_verify_mbedtls.c +@@ -214,6 +214,24 @@ fieldname_to_oid(const char *fieldname) + } + } + ++static bool ++asn1_buf_is_cstr_compatible(const mbedtls_asn1_buf *asn1_buf) ++{ ++ if (!(asn1_buf->tag == MBEDTLS_ASN1_UTF8_STRING || asn1_buf->tag == MBEDTLS_ASN1_PRINTABLE_STRING ++ || asn1_buf->tag == MBEDTLS_ASN1_IA5_STRING)) ++ { ++ return false; ++ } ++ for (size_t i = 0; i < asn1_buf->len; i++) ++ { ++ if (asn1_buf->p[i] == '\0') ++ { ++ return false; ++ } ++ } ++ return true; ++} ++ + result_t + backend_x509_get_username(char *cn, size_t cn_len, char *x509_username_field, mbedtls_x509_crt *cert) + { +@@ -259,16 +277,17 @@ backend_x509_get_username(char *cn, size_t cn_len, char *x509_username_field, mb + } + + /* Find field_oid in the subject name. */ +- mbedtls_x509_name *name = &cert->subject; +- while (name != NULL) ++ mbedtls_x509_name *name = NULL; ++ mbedtls_x509_name *next = &cert->subject; ++ while (next != NULL) + { +- if (strlen(field_oid) == name->oid.len +- && 0 == memcmp(name->oid.p, field_oid, name->oid.len)) ++ if (strlen(field_oid) == next->oid.len ++ && 0 == memcmp(next->oid.p, field_oid, next->oid.len)) + { +- break; ++ name = next; + } + +- name = name->next; ++ next = next->next; + } + + /* Not found, return an error if this is the peer's certificate */ +@@ -277,6 +296,11 @@ backend_x509_get_username(char *cn, size_t cn_len, char *x509_username_field, mb + goto fail; + } + ++ if (!asn1_buf_is_cstr_compatible(&name->val)) ++ { ++ goto fail; ++ } ++ + /* Check that we have room in the buffer, including the terminating '/0' byte. */ + if (cn_len <= name->val.len) + { +@@ -586,22 +610,11 @@ do_setenv_x509(struct env_set *es, const char *name, char *value, int depth) + static char * + asn1_buf_to_c_string(const mbedtls_asn1_buf *orig, struct gc_arena *gc) + { +- size_t i; + char *val; + +- if (!(orig->tag == MBEDTLS_ASN1_UTF8_STRING || orig->tag == MBEDTLS_ASN1_PRINTABLE_STRING +- || orig->tag == MBEDTLS_ASN1_IA5_STRING)) ++ if (!asn1_buf_is_cstr_compatible(orig)) + { +- /* Only support C-string compatible types */ +- return string_alloc("ERROR: unsupported ASN.1 string type", gc); +- } +- +- for (i = 0; i < orig->len; ++i) +- { +- if (orig->p[i] == '\0') +- { +- return string_alloc("ERROR: embedded null value", gc); +- } ++ return string_alloc("ERROR: Unsupported string type or embedded null bytes.", gc); + } + val = gc_malloc(orig->len + 1, false, gc); + memcpy(val, orig->p, orig->len); +diff --git a/src/openvpn/ssl_verify_openssl.c b/src/openvpn/ssl_verify_openssl.c +index a30099d0..1f2804ff 100644 +--- a/src/openvpn/ssl_verify_openssl.c ++++ b/src/openvpn/ssl_verify_openssl.c +@@ -196,12 +196,13 @@ extract_x509_field_ssl(const X509_NAME *x509, const char *field_name, char *out, + int lastpos = -1; + int tmp = -1; + unsigned char *buf = NULL; ++ result_t ret = FAILURE; + + ASN1_OBJECT *field_name_obj = OBJ_txt2obj(field_name, 0); + if (field_name_obj == NULL) + { + msg(D_TLS_ERRORS, "Invalid X509 attribute name '%s'", field_name); +- return FAILURE; ++ goto exit; + } + + ASSERT(size > 0); +@@ -222,28 +223,31 @@ extract_x509_field_ssl(const X509_NAME *x509, const char *field_name, char *out, + /* Nothing found */ + if (lastpos == -1) + { +- return FAILURE; ++ goto exit; + } + + const X509_NAME_ENTRY *x509ne = X509_NAME_get_entry(x509, lastpos); + if (!x509ne) + { +- return FAILURE; ++ goto exit; + } + + const ASN1_STRING *asn1 = X509_NAME_ENTRY_get_data(x509ne); + if (!asn1) + { +- return FAILURE; ++ goto exit; + } +- if (ASN1_STRING_to_UTF8(&buf, asn1) < 0) ++ int length = ASN1_STRING_to_UTF8(&buf, asn1); ++ if (length < 0 || (size_t)length != strlen((char *)buf)) + { +- return FAILURE; ++ goto exit; + } + + strncpynt(out, (char *)buf, size); + +- const result_t ret = (strlen((char *)buf) < size) ? SUCCESS : FAILURE; ++ ret = (strlen((char *)buf) < size) ? SUCCESS : FAILURE; ++ ++exit: + OPENSSL_free(buf); + return ret; + } +@@ -384,15 +388,34 @@ x509_get_subject(X509 *cert, struct gc_arena *gc) + goto err; + } + ++ /* Get the subject with unescaped control characters so that we can check for null bytes. */ + X509_NAME_print_ex(subject_bio, X509_get_subject_name(cert), 0, +- XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_FN_SN | ASN1_STRFLGS_UTF8_CONVERT +- | ASN1_STRFLGS_ESC_CTRL); ++ XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_FN_SN | ASN1_STRFLGS_UTF8_CONVERT); + + if (BIO_eof(subject_bio)) + { + goto err; + } + ++ BIO_get_mem_ptr(subject_bio, &subject_mem); ++ if (memchr(subject_mem->data, 0, subject_mem->length) != NULL) ++ { ++ msg(M_WARN, "ERROR: Certificate subject contains a '\\0' byte."); ++ goto err; ++ } ++ ++ /* Now output the subject with escaped control characters. */ ++ if (BIO_reset(subject_bio) != 1) ++ { ++ goto err; ++ } ++ X509_NAME_print_ex(subject_bio, X509_get_subject_name(cert), 0, ++ XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_FN_SN | ASN1_STRFLGS_UTF8_CONVERT ++ | ASN1_STRFLGS_ESC_CTRL); ++ if (BIO_eof(subject_bio)) ++ { ++ goto err; ++ } + BIO_get_mem_ptr(subject_bio, &subject_mem); + + subject = gc_malloc(subject_mem->length + 1, false, gc); +diff --git a/tests/unit_tests/openvpn/test_ssl.c b/tests/unit_tests/openvpn/test_ssl.c +index 7e7679c5..adfc07a8 100644 +--- a/tests/unit_tests/openvpn/test_ssl.c ++++ b/tests/unit_tests/openvpn/test_ssl.c +@@ -884,6 +884,94 @@ crypto_test_print_cert_details(void **state) + free_certificate(cert); + } + ++/* Certificate with two CNs, "foo" and "bar". ++ * ++ * Generated with: ++ * openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -subj "/CN=foo/CN=bar" \ ++ * -noenc -out two_cns.crt -keyout two_cns.key ++ */ ++static const char *cert_with_two_cns = ++ "-----BEGIN CERTIFICATE-----\n" ++ "MIIByTCCAVCgAwIBAgIUZuvd8Wfnq5jeRc3ohoJ/Vza54wQwCgYIKoZIzj0EAwIw\n" ++ "HDEMMAoGA1UEAwwDZm9vMQwwCgYDVQQDDANiYXIwHhcNMjYwODI4MTU1NjAwWhcN\n" ++ "MjYwOTI3MTU1NjAwWjAcMQwwCgYDVQQDDANmb28xDDAKBgNVBAMMA2JhcjB2MBAG\n" ++ "ByqGSM49AgEGBSuBBAAiA2IABERAfb210NOACy+QVYAu3EXrcGhTJpZDfhpDnE/h\n" ++ "PvPMWGWzqecTYdseArxZc0T/5Xma36IKCjGGsgN9ypZ5oQugQlB/NrVRCJIuHSGA\n" ++ "hGBWFvnUsqdNo765lGwVdBwhY6NTMFEwHQYDVR0OBBYEFPwnD+wK9R81Syk0qyTI\n" ++ "dFT/BNoJMB8GA1UdIwQYMBaAFPwnD+wK9R81Syk0qyTIdFT/BNoJMA8GA1UdEwEB\n" ++ "/wQFMAMBAf8wCgYIKoZIzj0EAwIDZwAwZAIwGxazGb6RRQtXzOWCPLRKId4e+E88\n" ++ "cwoCK3UwzEr8+Ddf54w5cEZC54f5J6AKFUJjAjBpT/JqF41uK57H+8i/16oZkBcm\n" ++ "OyQnlH8W/UzZo3/weTEBTcNW0iuCpIrS6im8pSk=\n" ++ "-----END CERTIFICATE-----\n"; ++ ++void ++ssl_test_extract_last_matching_field(void **state) ++{ ++ /* When there are multiple fields of the same type in the certificate's subject, OpenVPN ++ * should extract the value of the last matching field. This is essentially arbitrary and there ++ * is no correct choice here, but this test exists to make sure that the behavior is consistent ++ * between different backends. ++ */ ++ openvpn_x509_cert_t *cert = get_certificate(cert_with_two_cns); ++ ++ char username[TLS_USERNAME_LEN + 1] = { 0 }; ++ assert_int_equal(backend_x509_get_username(username, sizeof(username), "CN", cert), SUCCESS); ++ assert_string_equal(username, "bar"); ++ free_certificate(cert); ++} ++ ++/* Certificate with a null-byte embedded in the CN. ++ * ++ * Generated with the following Python script: ++ * ++ * from cryptography import x509 ++ * from cryptography.x509.oid import NameOID, ExtensionOID, ExtendedKeyUsageOID ++ * from cryptography.hazmat.primitives import hashes, serialization ++ * from cryptography.hazmat.primitives.asymmetric import ec ++ * import datetime ++ * ++ * private_key = ec.generate_private_key(ec.SECP384R1()) ++ * now = datetime.datetime.now(datetime.timezone.utc) ++ * name = "with\x00null" ++ * ++ * cert = (x509.CertificateBuilder() ++ * .subject_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, name)])) ++ * .issuer_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, name)])) ++ * .public_key(private_key.public_key()) ++ * .serial_number(x509.random_serial_number()) ++ * .not_valid_before(now) ++ * .not_valid_after(now + datetime.timedelta(days=10 * 365)) ++ * .sign(private_key, hashes.SHA256())) ++ * ++ * print(str(cert.public_bytes(serialization.Encoding.PEM), encoding='utf-8')) ++ **/ ++static const char *cert_with_null = ++ "-----BEGIN CERTIFICATE-----\n" ++ "MIIBZTCB66ADAgECAhRLWdNRl+C20KKBG4QC9HFPWlOtBzAKBggqhkjOPQQDAjAU\n" ++ "MRIwEAYDVQQDDAl3aXRoAG51bGwwHhcNMjYwODI4MTQzMDA4WhcNMzYwODI1MTQz\n" ++ "MDA4WjAUMRIwEAYDVQQDDAl3aXRoAG51bGwwdjAQBgcqhkjOPQIBBgUrgQQAIgNi\n" ++ "AAT7PE+vJCBiB4CVHBcvJVF9n5n/dGQIn4C8HeYE8M2iXYCIRW5wg6/mlPaeiJY/\n" ++ "Ywh3pa8zhto1+aczbJKTvLgRwXn6N5vNpME1c5iWMzY0WHe1dJyVtoRBvkNvy5+k\n" ++ "GuEwCgYIKoZIzj0EAwIDaQAwZgIxAP2ekdQ8muG8Nv2o3PsBp0CqiaSNByGiP75i\n" ++ "k099bUFvHp/3LSp8Wf4JK2iWzc5h6gIxAINBGg2xjlmMgpXxROKA9qQqaM3d92Mp\n" ++ "EzZyRyPM3PGR83ZPbIaYDq8lCVxVlbYr/Q==\n" ++ "-----END CERTIFICATE-----\n"; ++ ++void ++ssl_test_reject_null_in_cert_subject(void **state) ++{ ++ openvpn_x509_cert_t *cert = get_certificate(cert_with_null); ++ struct gc_arena gc = gc_new(); ++ ++ /* Trying to get the subject as a whole should fail. */ ++ assert_ptr_equal(x509_get_subject(cert, &gc), NULL); ++ ++ /* Trying to extract the common name should fail. */ ++ char username[TLS_USERNAME_LEN + 1] = { 0 }; ++ assert_int_equal(backend_x509_get_username(username, sizeof(username), "CN", cert), FAILURE); ++ gc_free(&gc); ++ free_certificate(cert); ++} + + int + main(void) +@@ -908,7 +996,9 @@ main(void) + cmocka_unit_test(test_data_channel_roundtrip_bf_cbc), + cmocka_unit_test(test_data_channel_known_vectors_epoch), + cmocka_unit_test(test_data_channel_known_vectors_shortpktid), +- cmocka_unit_test(crypto_test_print_cert_details) ++ cmocka_unit_test(crypto_test_print_cert_details), ++ cmocka_unit_test(ssl_test_extract_last_matching_field), ++ cmocka_unit_test(ssl_test_reject_null_in_cert_subject) + + }; + diff --git a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb index 6338a0c816..f4aa8fce9c 100644 --- a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb +++ b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb @@ -12,6 +12,7 @@ SRC_URI = "https://github.com/OpenVPN/openvpn/releases/download/v${PV}/${BP}.tar file://openvpn \ file://run-ptest \ file://CVE-2026-88964.patch \ + file://CVE-2026-84790.patch \ " UPSTREAM_CHECK_URI = "https://openvpn.net/community-downloads" From patchwork Tue Oct 13 09:58:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100564 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id F3088CC6B03 for ; Tue, 13 Oct 2026 09:59:25 +0000 (UTC) Received: from mail-pg1-f181.google.com (mail-pg1-f181.google.com [209.85.215.181]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3509.1791885561293233331 for ; Tue, 13 Oct 2026 02:59:21 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=S8DhFkzv; spf=pass (domain: gmail.com, ip: 209.85.215.181, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f181.google.com with SMTP id 41be03b00d2f7-cc1d57602e8so989074a12.3 for ; Tue, 13 Oct 2026 02:59:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885560; x=1792490360; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bEDQS+kx9VMgq5JbOjminOwY+7UtO3rsA4XnZSG/ZsI=; b=S8DhFkzvCcnfa3EOAkTOTpNamzJA2GvP2A0a/qf4U9+Dub4hqihv50RoCdl8r05X6T 4wQcSCp0i295TOR35FbXeMA+XCsDghUzwK+ckXqvYoaBH2NF2cgO5i/LJZH20J6Tn/KC 9eDKsyHnkR6k1BNFHUyYaOZN2QcO22Pjhp/ehmSk8i+0Vs7vTyzswfI86CSCDcKi7LxI EurNifZDklBB6q7qVockpQbUmVsowZknKId9L9dugeqz7NC/zH38UopXSk1mGxkn1v4v M1vyfsqebeuO/AK5dae+rAg4uFo8qsqhktS6sJGMMvdsM2Q8tZJCYwaRae5hCo0bmKBW rTLg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885560; x=1792490360; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=bEDQS+kx9VMgq5JbOjminOwY+7UtO3rsA4XnZSG/ZsI=; b=ZyXEnUjuas61bdJtPxUbPN0qdo3FLLRmYMLQUoczw7zp/y+81CU3u9RIDQ/aEbUSBo XFhQjal9/jBbhWbwY/LZDS8H98a2zgjmrMphx/vXl9FbLkkYz8JofftGfXWeW8gzkNUH R5c296t31SHQA4CNVBjAxPnQJJ4pY2iBzWLkgtIAysMjPHJyEjhaJq5QtVJqj2+3jwgq X+xOYmhpoqXhvLUm0B0x9sI838BgexjbnrHjGsOKYydJO0WpOZggNjysCNSrhlTee5Hm 3LYa29x7Ldn83Ng+jSLGT174Ml9LjUihj/AVTRQo254y9jOdhlk/lsAKw0vblQHaTq10 +9LA== X-Gm-Message-State: AFq9FYLebqyaVMuW3owl3/TLs7tNUhsDiqbs7D0xk9EJHILIoBKN5zIt 5t69xGon5bkAfNiNqHdstionNpJEjlDskQJgLIcg6YrSLXW63TKi37heZNibvQ== X-Gm-Gg: AYBFou32bGGkPEs7Xf4Sd+sF+pnAp9DyVLEZ9P8FhCf21ztmM8pv7vDw1w27DLG3bGH oZmL0i2GTRLPMS6Y90HqjpnMkYVMvpklj1YPK5ZIw3MjUm9UD28lTM0myc3QVIvpwYB71lFj0dh nhC8fnDSx2XLt6nQzoSrv+tflFfYVEjG92D2rfZkQEt1wX+vNDdcM93x4hzk0wqOZiyOlCIWuxp YgeyngrCq9i46cEmoXY13Vlj/VN4K9u0Zqc0slpMlYwFBbxkW7n0PNz3qb1DgumHpAK2MXbMtU3 PrKepbdkyF4uuQWT8QzV5GEd5M5691HQu/JybyOB0mlQRLp2svC8eC6MRsHEE1YPd5Te9zk9+mz S7V3hqXyhBiAYZ5Gpt0pqIWllP2cA9QKdLEu7RMVXX2p99IrN/Dyy+1mFXEC3quC7A2UMUoB9Ci 56IhvPsaHyrGrwJms/0Q/9Z1wjEhrMxTLDuzTNrMouuulUpd617eRk2n5Yhl6HlCnviJhOIBLxN iJScCDvc3Ln+0xjWuDhP+4+WeWpxL1ifdRoaWk= X-Received: by 2002:a17:90a:d44d:b0:3ab:1b19:78ed with SMTP id 98e67ed59e1d1-3ab3a60d92emr9861246a91.21.1791885560316; Tue, 13 Oct 2026 02:59:20 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.02.59.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 02:59:19 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-python][blacksail][PATCH 4/28] python3-eventlet: mark CVE-2023-29483 fixed Date: Tue, 13 Oct 2026 22:58:39 +1300 Message-ID: <20261013095903.3544906-4-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 09:59:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130837 From: Ankur Tyagi Fix[1] for the CVE is part of the upstream version. Details: https://nvd.nist.gov/vuln/detail/cve-2023-29483 [1]https://github.com/eventlet/eventlet/commit/51e3c4928d4938beb576eff34f3bf97e6e64e6b4 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 47b2ce9cc77297c740ecf50d00d6956f5a867144) Signed-off-by: Ankur Tyagi --- meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb b/meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb index 3292950e2c..67a69b1478 100644 --- a/meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb +++ b/meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb @@ -17,3 +17,5 @@ RDEPENDS:${PN} += " \ python3-dnspython \ python3-greenlet \ " + +CVE_STATUS[CVE-2023-29483] = "fixed-version: fixed since v0.35.2" From patchwork Tue Oct 13 09:58:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100566 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4FEFECC6B10 for ; Tue, 13 Oct 2026 09:59:26 +0000 (UTC) Received: from mail-pg1-f169.google.com (mail-pg1-f169.google.com [209.85.215.169]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3510.1791885564143953707 for ; Tue, 13 Oct 2026 02:59:24 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=czgYQXv2; spf=pass (domain: gmail.com, ip: 209.85.215.169, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f169.google.com with SMTP id 41be03b00d2f7-ccca948203aso947587a12.3 for ; Tue, 13 Oct 2026 02:59:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885563; x=1792490363; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=nHw5JRLgOlcFY5DYdmACJelptg6LctIJStO918gX8nQ=; b=czgYQXv2V6jaujas8iEds7jK14q+9Y7CJf6YNvcdxkcgLuWMfEAM3Dl/dkVdCidBtL nO0QYKXeow72aX7gPPbEf5mxQdT3TllIBDeQVg4ufLliCcwTu9Ps8nJsM2SaTN/i3P+a uf7mU2icc9e0cqni0sWaLyAyJ/R+C1mftZKu3Y/p9iBuKvJLXfQhr0gwZi9/SNpswjY6 xVJcpc0P3H2gnjXZHxxEdslOewgMZYSFyap9NwASUmIvcKmpNvQOjzVqa2rjrH5650ry 5UBJnVwk28E1Wwov8dU9NbFO2wsF/JsOKYrwNCKrdnaWJukcpJT3RETusNjKVjgLoBLl QEFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885563; x=1792490363; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=nHw5JRLgOlcFY5DYdmACJelptg6LctIJStO918gX8nQ=; b=cobLjBwbM7OOiHvh8xAVWuG2w9+owYP95TEmkU+Zt+4wyLVWtOpEaYzJNFoVGTD63a DfkeifNAKNFLgTd7YAguR0IjMTPyvxFuPK6uId9cojhIGucmHn/s7qgGcwt0cMznd4E7 QYH2Dwp0mQ1PtPFlIErOhR0deTI+rrn/kkL7Hq09O3EBlc9DgGU+YtqWSKIKEH0uaMEW D6YVz6+taSN0J7PtdE02q5QTM0iTxyourUqayTuHheAoA3rY1yPyUTF4YhWVGTTfv9Ho nHCvUOGryF7G9zjyN3NReTI5Jklb4zuiq96cp2dztha0KBnGivL+qdDE2Xdvtr4VQ/xY Vilg== X-Gm-Message-State: AFq9FYKpM+wskcPum0CkyIgAtkcIV3cuKIdD+J4qkvNsBkmWCopf8U+x P6gcOxKaBkxiLDKgLO1Gg3k33NOOm7jJQAs2rxxf1aWqGvjyjbwC/16riC/6LQ== X-Gm-Gg: AYBFou09hHi0Fu2gP/3lhfpdfd3NoUNhCsgq3Yin0MilBJ9d6tBWdpM6sQwq2swC7E4 3Rb2BxhJxoTniaT/ZJ8N3zoTDhqJBeUcvpfW6SoUJrOSvJGFKJBG6ZtHH+bPC73CYErsw8Ya+7o IBddtwYrFRdAbVINQOevc/gGLeqzI0Prwi6iYw5Rf5ju1pYxqj7UzELY6kcwrZ1MTRsny/Rzg+x cX3MrVqedtwO7AAeRYt+lvtN5EgeFOJt0Q1WA9sQzJva0rIf8b+cAZxxzd0ALGw7DHK2otJ95/I /W13aSzWt5VaaceFwucukRbBGEQGX8o/Ygj/ybJktpt7HJUd6AcyOHwnlu7lkMGsVCeMwprRn1h gkD9TNa5/Sz4R3Dx+nir81J1HPTrhQHqCqhqaAEQOz2cfZNL5WILE3q3OsKCBImiIHX2IU07V+V b3408ayoVQbBZQ6wDaLtnDRHUeT7jZldqxv3LKimTKF7nvfP86ixZX9xIh8ay/M+PQk9SJEBWVu PGW4dEH3maTn39avYd3us0x897Aw5VBRxt871Q= X-Received: by 2002:a17:90a:1049:b0:3ab:9c73:13a with SMTP id 98e67ed59e1d1-3ab9c730800mr4092311a91.0.1791885563329; Tue, 13 Oct 2026 02:59:23 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.02.59.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 02:59:23 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 5/28] cjson: patch CVE-2026-87933 Date: Tue, 13 Oct 2026 22:58:40 +1300 Message-ID: <20261013095903.3544906-5-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 09:59:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130838 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-87933 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 2b3f5cbbd85177f06cea6f89f0b6d83bba48da40) Signed-off-by: Ankur Tyagi --- .../cjson/cjson/CVE-2026-87933.patch | 110 ++++++++++++++++++ .../recipes-devtools/cjson/cjson_1.7.19.bb | 1 + 2 files changed, 111 insertions(+) create mode 100644 meta-oe/recipes-devtools/cjson/cjson/CVE-2026-87933.patch diff --git a/meta-oe/recipes-devtools/cjson/cjson/CVE-2026-87933.patch b/meta-oe/recipes-devtools/cjson/cjson/CVE-2026-87933.patch new file mode 100644 index 0000000000..3972e5eafc --- /dev/null +++ b/meta-oe/recipes-devtools/cjson/cjson/CVE-2026-87933.patch @@ -0,0 +1,110 @@ +From a1b370963c98e1374e5538e97841f9d476a8932e Mon Sep 17 00:00:00 2001 +From: lilu5458 +Date: Wed, 16 Sep 2026 09:55:35 +0800 +Subject: [PATCH] Fix: heap-use-after-free in merge_patch when patch is subtree + of target (#1065) + +When cJSONUtils_MergePatch(target, patch) is called with a non-object +patch (scalar, array, or NULL) that happens to be a subtree of target, +merge_patch() called cJSON_Delete(target) first, which freed the patch +memory, and then cJSON_Duplicate(patch, 1) read the already-freed memory, +triggering a heap-use-after-free (detected by AddressSanitizer at +cJSON_Duplicate_rec, cJSON.c:2808). + +Fix: duplicate the patch first into a local variable, then delete the +target, then return the duplicate. This matches the Option B approach +proposed in issue #1060. + +Verified locally: +- Reproduced the UAF with a minimal PoC under ASan before the fix. +- After the fix the PoC runs cleanly (exit 0, correct result [1,2,3]). +- Added a regression unit test + (merge_patch_should_not_read_freed_memory_when_patch_is_subtree). +- Full ctest suite passes (22/22 tests). + +Fixes #1060 + +Signed-off-by: lilu +(cherry picked from commit 6d9f2443ab071f86e5d9b43025a40929ec41c46c) + +CVE: CVE-2026-87933 +Upstream-Status: Backport [https://github.com/DaveGamble/cJSON/commit/6d9f2443ab071f86e5d9b43025a40929ec41c46c] + +Signed-off-by: Ankur Tyagi +--- + cJSON_Utils.c | 8 ++++++-- + tests/old_utils_tests.c | 34 ++++++++++++++++++++++++++++++++++ + 2 files changed, 40 insertions(+), 2 deletions(-) + +diff --git a/cJSON_Utils.c b/cJSON_Utils.c +index 8fa24f8..6f41875 100644 +--- a/cJSON_Utils.c ++++ b/cJSON_Utils.c +@@ -1324,9 +1324,13 @@ static cJSON *merge_patch(cJSON *target, const cJSON * const patch, const cJSON_ + + if (!cJSON_IsObject(patch)) + { +- /* scalar value, array or NULL, just duplicate */ ++ /* scalar value, array or NULL, just duplicate. ++ * Duplicate the patch first in case it is a subtree of target, ++ * otherwise cJSON_Delete(target) would free the patch memory ++ * and the subsequent cJSON_Duplicate would read freed memory. */ ++ cJSON *duplicate = cJSON_Duplicate(patch, 1); + cJSON_Delete(target); +- return cJSON_Duplicate(patch, 1); ++ return duplicate; + } + + if (!cJSON_IsObject(target)) +diff --git a/tests/old_utils_tests.c b/tests/old_utils_tests.c +index 690dbb5..bdc7393 100644 +--- a/tests/old_utils_tests.c ++++ b/tests/old_utils_tests.c +@@ -189,6 +189,39 @@ static void merge_tests(void) + } + } + ++static void merge_patch_should_not_read_freed_memory_when_patch_is_subtree(void) ++{ ++ /* When patch is a subtree of target, merge_patch must duplicate the patch ++ * before deleting target. Otherwise cJSON_Delete(target) frees the patch ++ * memory and the subsequent cJSON_Duplicate reads freed memory (UAF). ++ * See CVE candidate: heap-use-after-free in merge_patch (cJSON_Utils.c). */ ++ cJSON *target = cJSON_Parse("{\"a\":[1,2,3]}"); ++ cJSON *patch = cJSON_GetObjectItem(target, "a"); ++ cJSON *result = NULL; ++ cJSON *first = NULL; ++ cJSON *second = NULL; ++ cJSON *third = NULL; ++ ++ TEST_ASSERT_NOT_NULL(target); ++ TEST_ASSERT_NOT_NULL(patch); ++ ++ /* patch (array [1,2,3]) is a subtree of target. This used to trigger ++ * heap-use-after-free under AddressSanitizer before the fix. */ ++ result = cJSONUtils_MergePatch(target, patch); ++ TEST_ASSERT_NOT_NULL(result); ++ TEST_ASSERT_TRUE(cJSON_IsArray(result)); ++ TEST_ASSERT_EQUAL_INT(3, cJSON_GetArraySize(result)); ++ ++ first = cJSON_GetArrayItem(result, 0); ++ second = cJSON_GetArrayItem(result, 1); ++ third = cJSON_GetArrayItem(result, 2); ++ TEST_ASSERT_EQUAL_INT(1, first->valueint); ++ TEST_ASSERT_EQUAL_INT(2, second->valueint); ++ TEST_ASSERT_EQUAL_INT(3, third->valueint); ++ ++ cJSON_Delete(result); ++} ++ + static void generate_merge_tests(void) + { + size_t i = 0; +@@ -219,6 +252,7 @@ int main(void) + RUN_TEST(misc_tests); + RUN_TEST(sort_tests); + RUN_TEST(merge_tests); ++ RUN_TEST(merge_patch_should_not_read_freed_memory_when_patch_is_subtree); + RUN_TEST(generate_merge_tests); + + return UNITY_END(); diff --git a/meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb b/meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb index d914018331..b4e57d7297 100644 --- a/meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb +++ b/meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb @@ -7,6 +7,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=218947f77e8cb8e2fa02918dc41c50d0" SRC_URI = "git://github.com/DaveGamble/cJSON.git;branch=master;protocol=https \ file://run-ptest \ file://0001-allow-build-with-cmake-4.patch \ + file://CVE-2026-87933.patch \ " SRCREV = "c859b25da02955fef659d658b8f324b5cde87be3" From patchwork Tue Oct 13 09:58:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100567 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 53BABCC6B08 for ; Tue, 13 Oct 2026 09:59:36 +0000 (UTC) Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3512.1791885566592559741 for ; Tue, 13 Oct 2026 02:59:26 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Us/F2rcB; spf=pass (domain: gmail.com, ip: 209.85.216.51, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f51.google.com with SMTP id 98e67ed59e1d1-3ab3260b35dso1682252a91.1 for ; Tue, 13 Oct 2026 02:59:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885566; x=1792490366; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=aCNrHROzSGrBwyuBelOAqyHW2e2UcD7LzYWMrr5DFYU=; b=Us/F2rcBwVJZrbEckG+tysPHauFHasscQJ1EnBoRVSkA68Y4n3dzFkZauGAx5q+T/i R3vUSmFAx5Q7REtM4LV1e6a4ddTqbJ6qa6rKWH3SRW1ARevyGmcmTE/fr/yZF3Too4Ft jv/1axlEGc5/HHoqgkO0oviYw61AM/GsrYQwvzQElMqEzjGc3kbxZrdOcnhH6Q+C5tbN VD38DP1MOm70v21R69T3iQKR3+FhBRlDQBRPALQoLds2elp2liFJkl/6Yso/KkNASunT SM2SllM8Bul302gpS1WG/01GO9dE8b+RrVZPBOGVSfHsLpvYt4Fdifjq7dBdkRGBrJek njLQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885566; x=1792490366; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=aCNrHROzSGrBwyuBelOAqyHW2e2UcD7LzYWMrr5DFYU=; b=fLT/xWWohkthyZxKQTmnjkIMhYJjjiC0yjBShk8i7MGK9ylYMallN1+t2gTvhqNIPW OifqEPi8IR72R66swhJ+wPSOzate4FT3F8AlhN9R83pTvbZTJ0I9Z1rvxWd6gmc6dPsB tlkaaLNYzf/crmUFJ37/K9eKa+OvWYHaRe1kw2RqQBLmdsR+66YrJ0GrzfucXY7UdINI TlF6pVgjJeFJSj4rp4kjZJh7SIkzspXeuBi8oevMLLzdrJzUQ7zZVwCzMrUqT1MyOhFK RYsD68+/1YPDpfHhh9Nhu0Nv+hLoFIOukTnbmJaCVZAGIsCYHuca0+vyEbDPuI8P2Ixy 1Rqw== X-Gm-Message-State: AFq9FYJ2YeFGJojWOtNdiQkD+h0QrkVL5UDo/8ufra1p3BFlXyjMNeNb 0X4LxScBG4Vn1GXGFZAsYKiEKBfsSYHXsxbbI6QYgaMMnevad9ZW3dS45EPurg== X-Gm-Gg: AYBFou0abdTNlz4Nz8uzVi6UwgV3hC3ej+od5SIuHoLI82+s7zWvllDWYjQM+plew0c KMUF2YC5wTS7PzH1UvzBhylNggbAZJ2KAC2iaXejYO3iLcr+Wkhw5UyLm2XDnF1C4xz+0ZDXfM4 ss8gnSyUixvFLg6jjoEcGs0Fhl5aKx/SvjTOwFIiNuOeYKxtXDh7r5D2rzbUkEtSdbqrNlpkfSI nptCCsQj0hWEPWaNSmFZquqVyFROErKreLh85dg3GxnPMjFCqsmbbgC23JdHRH8Cs4c2lpspgFB 4XCMkNNkDkL/zCDqmCkyPNae6RiQkIoa1MaP1/Z7Bvyh1Z4hkrSvcdcOrSzPhdpfqWyRBqNDSOO uogNj4FdcJPZK3mz4FkwBU1+Non1Zuk9LIIsn3jvyQg5NMNCKZFhRgkL2/qtZpMUc5+dfjmAk5n Le5euugoerigGAs7HyP6edq9LrGGyWi8/4hTv8H3qD9SGgS2mAf2vsBL+MKuelmfSap1I+SmR2R fSmWSWVdSFPegzErf5fG8aYiBzAk8R52d6JnAg= X-Received: by 2002:a17:90a:a8f:b0:3ab:413:49af with SMTP id 98e67ed59e1d1-3ab3a92850dmr7836439a91.49.1791885565977; Tue, 13 Oct 2026 02:59:25 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.02.59.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 02:59:25 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][blacksail][PATCH 6/28] smarty: mark CVE-2026-82531 patched Date: Tue, 13 Oct 2026 22:58:41 +1300 Message-ID: <20261013095903.3544906-6-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 09:59:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130839 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-82531 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/smarty/smarty_5.8.5.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-oe/recipes-support/smarty/smarty_5.8.5.bb b/meta-oe/recipes-support/smarty/smarty_5.8.5.bb index 83f428d388..c700ed5d93 100644 --- a/meta-oe/recipes-support/smarty/smarty_5.8.5.bb +++ b/meta-oe/recipes-support/smarty/smarty_5.8.5.bb @@ -35,3 +35,4 @@ FILES:${PN} += "${datadir}/php/smarty3/" RDEPENDS:${PN} = "php" CVE_PRODUCT = "smarty:smarty smarty-php:smarty" +CVE_STATUS[CVE-2026-82531] = "fixed-version: fixed in v5.8.5" From patchwork Tue Oct 13 09:58:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100570 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5CDB6CC6B14 for ; Tue, 13 Oct 2026 09:59:37 +0000 (UTC) Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3420.1791885569409458576 for ; Tue, 13 Oct 2026 02:59:29 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=N9V8d5ei; spf=pass (domain: gmail.com, ip: 209.85.216.51, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f51.google.com with SMTP id 98e67ed59e1d1-3aacde0cc0fso1041557a91.2 for ; Tue, 13 Oct 2026 02:59:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885569; x=1792490369; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Qb8/j2uKVCmvYEcp11K6RjURHYDD16OFpwlyTN8Ral8=; b=N9V8d5eisU/BmJVcr8CJZgrYOAXxO31GSlXOK4IcHiyJkFMFo0REFJb4dIDrBWt9hl +8ign+Dos8G4eb5/8Uk3ydWX5KV5C+AyrT0+tJ3QqrndynaUyGJzTyaN+GeLzmq4Ol/Q 9+cf2hf3UJmnJpaE6qXCJsdTYRbQLiqXoJEtjIUdueYqqtIjeZ+NwWOBM0Rl1WXQiXKp WR9kCCseh2CFyLc/PfODz3WxXmYPQdVtpeOF+I02qgLhFY9h65DCeMYU/G3BLZexh+Pf 7XIivoJjT7dpIOhPJf6W45NTJIFxQbZGSrLaS/kYdcgsFnBLv/5d9kw9gkIPp8x00tyg sq/w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885569; x=1792490369; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Qb8/j2uKVCmvYEcp11K6RjURHYDD16OFpwlyTN8Ral8=; b=I7+C1WvWdgQsneP/qzIcnZEriSB+DrDJhAem0r4GPsZoXcc1ukPUAtNYDzX9ulSQNj iZqzo3SrCU78H963MQtJkZaWZi6UvPV60fLlrTmY6+FDcV+wkZkDoE2cavBmtq6ibloU bNAG0OF+HfQQdC7ELauQGJG1KkGcmAiYtJbyro88w58sOZ9eyTZMsifWxOsg016Lldak PICS5h/HY6iirum863toTHk8EyC3m787gvsjmIO5rPEYMzClI8Ndy8luoPkWkMSfxNH/ 1I8adI6xo7ANjwajuVc9mGPmZVZD2zpWwFiW0LdHCFp1Cvj88uRgrzAZzs1YoBS+sBG7 B5HQ== X-Gm-Message-State: AFq9FYIb2PYU080BWvxfKM9riKsx/IRuk9zVN6h93w8f62Z6i/iKYajs ELaWhi7V0xhPHeuKwzhYsQdTcVkwewzqtlF+kBtotaAnxvtowS5iUY1arWRijA== X-Gm-Gg: AYBFou1pLCApz5zPqKIe21PDNw3rVPYTWOTsw9u7h5gF+lDYJO6ZG/sazoAbctUENIz nGmberKQM6G8u8t/LiRAHRbUufINxl6i5hbQgLSWp8xerq7YXxKMkOPW46uH91KYuMY6Fx+h3Rw q6eNEdELtz8AvUogyazgqXA+bwyS6jaWP7ytwlIaAOGCFwZsWTT4tRjHrPPhimeE311vGG+qv0Q 02R2TUlnBTAuWktXzrAxzLpWJeGQ+gekr2oHignC965XHf5VZqinis6KKvzIatb20tznf6T+KVT 3wo1WJWDk6hN8njzaMkwBCIUs4yUXQDYIGxADDi5/XQtYBK0bgtZ0OEB8HPKARiR8DUC64bMxBJ mx0WhwjczmN2OwQ6ANjPSw8bbnD/Wxn7wvJZuS7vgNPoh33RDAml8XqTdqIJNMPP9VbAe1Be1vc 07xF38+vXkjXlYalUiLrbDoGV+k5EHyhAo7WhO3lGMMG6RiFKiwJJbDGO64AsAW81d/SexDlljh oY4Am6pMG62ljC46s8gYt3+ZwQMYI6YOizBAsM= X-Received: by 2002:a17:90a:ec87:b0:3ac:5ca:c7a8 with SMTP id 98e67ed59e1d1-3ac05cac819mr3352083a91.60.1791885568562; Tue, 13 Oct 2026 02:59:28 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.02.59.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 02:59:28 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 7/28] ntopng: patch CVE-2026-84990 Date: Tue, 13 Oct 2026 22:58:42 +1300 Message-ID: <20261013095903.3544906-7-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 09:59:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130840 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-84990 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 2d932fa4e349690dc42485b9dd04ab04d19710d9) Signed-off-by: Ankur Tyagi --- .../ntopng/files/CVE-2026-84990.patch | 53 +++++++++++++++++++ .../recipes-support/ntopng/ntopng_6.6.bb | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta-networking/recipes-support/ntopng/files/CVE-2026-84990.patch diff --git a/meta-networking/recipes-support/ntopng/files/CVE-2026-84990.patch b/meta-networking/recipes-support/ntopng/files/CVE-2026-84990.patch new file mode 100644 index 0000000000..0b443e3050 --- /dev/null +++ b/meta-networking/recipes-support/ntopng/files/CVE-2026-84990.patch @@ -0,0 +1,53 @@ +From 2f36e393fc35f576d7c447af337848e81990b084 Mon Sep 17 00:00:00 2001 +From: Alfredo Cardigliano +Date: Fri, 17 Jul 2026 11:51:03 +0200 +Subject: [PATCH] Add admin check in conf backup listing and download + +(cherry picked from commit f912ee93bc143330b6ff3bb946ee7211e5ee9e1a) + +CVE: CVE-2026-84990 +Upstream-Status: Backport [https://github.com/ntop/ntopng/commit/f912ee93bc143330b6ff3bb946ee7211e5ee9e1a] +Signed-off-by: Ankur Tyagi +--- + .../rest/v2/get/system/configurations/download_backup.lua | 5 +++++ + .../v2/get/system/configurations/list_available_backups.lua | 6 ++++++ + 2 files changed, 11 insertions(+) + +diff --git a/scripts/lua/rest/v2/get/system/configurations/download_backup.lua b/scripts/lua/rest/v2/get/system/configurations/download_backup.lua +index 1603a94c48..404b09ed97 100644 +--- a/scripts/lua/rest/v2/get/system/configurations/download_backup.lua ++++ b/scripts/lua/rest/v2/get/system/configurations/download_backup.lua +@@ -12,6 +12,11 @@ local backup_config = require("backup_config") + + -- ############################################## + ++if not isAdministratorOrPrintErr() then ++ rest_utils.answer(rest_utils.consts.err.not_granted) ++ return ++end ++ + local download = _GET["download"] + local epoch = _GET["epoch"] + +diff --git a/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua b/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua +index d901a876b0..8a08ad15d5 100644 +--- a/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua ++++ b/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua +@@ -8,11 +8,17 @@ package.path = dirs.installdir .. "/scripts/lua/modules/system_config/?.lua;" .. + + -- ############################################## + ++require "lua_utils" + local backup_config = require("backup_config") + local rest_utils = require("rest_utils") + + -- ############################################## + ++if not isAdministratorOrPrintErr() then ++ rest_utils.answer(rest_utils.consts.err.not_granted) ++ return ++end ++ + local rc = rest_utils.consts.success.ok + + local order = _GET["order"] or "desc" diff --git a/meta-networking/recipes-support/ntopng/ntopng_6.6.bb b/meta-networking/recipes-support/ntopng/ntopng_6.6.bb index 03350f240c..b4a1ff1883 100644 --- a/meta-networking/recipes-support/ntopng/ntopng_6.6.bb +++ b/meta-networking/recipes-support/ntopng/ntopng_6.6.bb @@ -19,6 +19,7 @@ SRC_URI = "gitsm://github.com/ntop/ntopng;protocol=https;branch=6.6-stable \ file://0001-luaengine-Use-lua-5.5-API-signature-for-lua_newstate.patch \ file://ntopng.service \ file://0001-Fix-build-with-OpenSSL-4.0.patch \ + file://CVE-2026-84990.patch \ " # don't use the lua under thirdparty as it supports cross compiling badly From patchwork Tue Oct 13 09:58:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100569 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 63954CC6B03 for ; Tue, 13 Oct 2026 09:59:36 +0000 (UTC) Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3421.1791885571779594141 for ; Tue, 13 Oct 2026 02:59:31 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=ZgdDinae; spf=pass (domain: gmail.com, ip: 209.85.216.43, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-3ab2bf5e75bso1418429a91.3 for ; Tue, 13 Oct 2026 02:59:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885571; x=1792490371; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Fu7dE7rXvJZDuxDzliREsmItfHQTI6WQZRQJ4oaFchY=; b=ZgdDinae2TD7RE+UyQnrVkIUR+f+LyP8GLY3CbbvMhhawC9ItThslF1jvYpDLYwLtT 9WDEBmPQi7KvwJo1f6dGkL8XqzsIkwlojK5TaHBH2g7krJJD8i3L3nRuR+uNJo34G7A0 Pyw+K14w/DSgM0us0eUe9rukG3y8I2LTQebTFDA6LEC7Q9Dw6NI8IopKtnWCH1MgNYm5 KGzUbYmNE5jJgCM09mWhyc9bpDc0o8V2O82uxJVA+z4cqTdcS7JffqVvX6cASiPnKsdn MJQCXwfjEHCutQZGM5Ceg9jWpoeefpSDHdUFnnEawUP5V7gMorMinjV3Dmvd+S7nutcx 17Gw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885571; x=1792490371; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Fu7dE7rXvJZDuxDzliREsmItfHQTI6WQZRQJ4oaFchY=; b=MGtbVvVT0y1JqmwdzWfEBy/cGzk/NMTklMjxpaI8Ly8qu2pixTXqgH5nw2ssiI+Jsx IXt56jvcIiQRogLvUcnnfkDPIqf0g4LCgiCWA1H/a1wmaUIhtl1VkBrtSGl1RqWWrxCJ mK+HhQz/2DOJRDzNA95936z6bt8aPKgriNcEp9i/oEQutdHNy/+VksXckP9Foig0rn8K GIAEZd0XMBe9IQi3roD06msXHHkWdHKQ/9k1Q0VE2CkPXGhaQdJSxAAaXDpZfqcWzu/+ Sf+GvIAVVK6Th/6HAQS/kujXKmMC5y377Upcelxb7Pkm7pk5HhFbUiFM7tpwwp2Sz/Up x5rA== X-Gm-Message-State: AFq9FYLshCDczEFbPhMFjGfJcq0iTHfLM/3Q6rCMcfIuGkPzlukw7SCk qYGWoi3VIK2hBpOTG8CWb0ymI6iFWGKDXfsLp4LcWbfRrJUsfr4+ditPdGG+jA== X-Gm-Gg: AYBFou2GnkNBou+l/YnkTZKkWC5AWW3dCtVkahCfoAd4AE6MMyXtEOppf5p+OaFxWGY PQ8YyV2AVA0EH/MBIOhvpjxmP2+F3P83Ta1JkkJkle/YSwt4z1lNCVZ5hpTgXkMIBSQB+LeVHEg YsIcc3LPNcy5w9l42YMY9nxPGdbvKw0zmAS4ug1C+NBzMasZaCFO9Cnwf52Psz86VUqEaMzMr1O nd67lCuz7pa1m0cHc6mvJe7OqohHyQKjhLUQ7wiz1yvP6KbZ5U5ViizF3VhatyLa5ogdrIjl+tS mUMsqRJzXcpFH2eMYymYQYUNSLLOX9N7DiAlkymkCEVg13UqtgsaY7FW9Q8aTS2YVmDDNpQ+y5y HqbhwjBZdvxXegYZofIrGmqwFWbuslR1H5O+zeL1YoQ+uANgQYJnNGh6zLlDNtA1dM8LGFA8FkA PZHUqZ2SlhZZakkEOK453O2wyfzFFoPGZ6jG1AgB6QttGIa6ImBxt09aEjETEgTmvlckfjv4+71 ip2Q1CUEDjZMG8CRkLpSletj6r1zhmCRWV1RZlmubrfPJQjZw== X-Received: by 2002:a17:90b:1d4f:b0:3a4:fe48:d410 with SMTP id 98e67ed59e1d1-3ab3a954001mr9920677a91.30.1791885571070; Tue, 13 Oct 2026 02:59:31 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.02.59.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 02:59:30 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 8/28] ntopng: patch CVE-2026-86090 and CVE-2026-86091 Date: Tue, 13 Oct 2026 22:58:43 +1300 Message-ID: <20261013095903.3544906-8-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 09:59:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130841 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-86090 https://nvd.nist.gov/vuln/detail/cve-2026-86091 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit ae180302f4c7f7dc0ba45c330d55b127aeefaf01) Signed-off-by: Ankur Tyagi --- .../files/CVE-2026-86090-CVE-2026-86091.patch | 67 +++++++++++++++++++ .../recipes-support/ntopng/ntopng_6.6.bb | 1 + 2 files changed, 68 insertions(+) create mode 100644 meta-networking/recipes-support/ntopng/files/CVE-2026-86090-CVE-2026-86091.patch diff --git a/meta-networking/recipes-support/ntopng/files/CVE-2026-86090-CVE-2026-86091.patch b/meta-networking/recipes-support/ntopng/files/CVE-2026-86090-CVE-2026-86091.patch new file mode 100644 index 0000000000..a8a3ba72ac --- /dev/null +++ b/meta-networking/recipes-support/ntopng/files/CVE-2026-86090-CVE-2026-86091.patch @@ -0,0 +1,67 @@ +From c6f4d42e1bb029463f927532819c5f5b331ea066 Mon Sep 17 00:00:00 2001 +From: Alfredo Cardigliano +Date: Thu, 16 Jul 2026 14:42:29 +0200 +Subject: [PATCH] Fix user capability check for deleting notification endpoints + and pools + +(cherry picked from commit 7d830f31af367745431c5d92e2e82fc432f6bdd8) + +CVE: CVE-2026-86090 CVE-2026-86091 +Upstream-Status: Backport [https://github.com/ntop/ntopng/commit/7d830f31af367745431c5d92e2e82fc432f6bdd8] +Signed-off-by: Ankur Tyagi +--- + scripts/lua/modules/pools/pools_rest_utils.lua | 5 +++++ + scripts/lua/rest/v2/delete/endpoints.lua | 6 ++++++ + scripts/lua/rest/v2/delete/recipients.lua | 6 ++++++ + 3 files changed, 17 insertions(+) + +diff --git a/scripts/lua/modules/pools/pools_rest_utils.lua b/scripts/lua/modules/pools/pools_rest_utils.lua +index 9b692ea5db..73f08e0c8d 100644 +--- a/scripts/lua/modules/pools/pools_rest_utils.lua ++++ b/scripts/lua/modules/pools/pools_rest_utils.lua +@@ -452,6 +452,11 @@ end + + -- @brief Get all pools of all the available (currently implemented) pool instances + function pools_rest_utils.delete_all_instances_pools() ++ if not auth.has_capability(auth.capabilities.pools) then ++ rest_utils.answer(rest_utils.consts.err.not_granted) ++ return ++ end ++ + local all_instances = pools_lua_utils.all_pool_instances_factory() + + for _, instance in pairs(all_instances) do +diff --git a/scripts/lua/rest/v2/delete/endpoints.lua b/scripts/lua/rest/v2/delete/endpoints.lua +index 31852cedab..6d25c01953 100644 +--- a/scripts/lua/rest/v2/delete/endpoints.lua ++++ b/scripts/lua/rest/v2/delete/endpoints.lua +@@ -10,6 +10,12 @@ package.path = dirs.installdir .. "/scripts/lua/modules/notifications/?.lua;" .. + local rest_utils = require "rest_utils" + local endpoints = require("endpoints") + local recipients = require "recipients" ++local auth = require "auth" ++ ++if not auth.has_capability(auth.capabilities.notifications) then ++ rest_utils.answer(rest_utils.consts.err.not_granted) ++ return ++end + + endpoints.reset_configs() + recipients.cleanup() +diff --git a/scripts/lua/rest/v2/delete/recipients.lua b/scripts/lua/rest/v2/delete/recipients.lua +index cbdffcae4c..14b3956498 100644 +--- a/scripts/lua/rest/v2/delete/recipients.lua ++++ b/scripts/lua/rest/v2/delete/recipients.lua +@@ -8,6 +8,12 @@ package.path = dirs.installdir .. "/scripts/lua/modules/notifications/?.lua;" .. + + local rest_utils = require "rest_utils" + local recipients = require "recipients" ++local auth = require "auth" ++ ++if not auth.has_capability(auth.capabilities.notifications) then ++ rest_utils.answer(rest_utils.consts.err.not_granted) ++ return ++end + + recipients.cleanup() + rest_utils.answer(rest_utils.consts.success.ok) diff --git a/meta-networking/recipes-support/ntopng/ntopng_6.6.bb b/meta-networking/recipes-support/ntopng/ntopng_6.6.bb index b4a1ff1883..808967e969 100644 --- a/meta-networking/recipes-support/ntopng/ntopng_6.6.bb +++ b/meta-networking/recipes-support/ntopng/ntopng_6.6.bb @@ -20,6 +20,7 @@ SRC_URI = "gitsm://github.com/ntop/ntopng;protocol=https;branch=6.6-stable \ file://ntopng.service \ file://0001-Fix-build-with-OpenSSL-4.0.patch \ file://CVE-2026-84990.patch \ + file://CVE-2026-86090-CVE-2026-86091.patch \ " # don't use the lua under thirdparty as it supports cross compiling badly From patchwork Tue Oct 13 09:58:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100568 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 53BE2CC6B0F for ; Tue, 13 Oct 2026 09:59:36 +0000 (UTC) Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3422.1791885574486712487 for ; Tue, 13 Oct 2026 02:59:34 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=OgHqxiF8; spf=pass (domain: gmail.com, ip: 209.85.215.170, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f170.google.com with SMTP id 41be03b00d2f7-cc502d509c0so784886a12.2 for ; Tue, 13 Oct 2026 02:59:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885574; x=1792490374; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=2NjEwcz1evegYdskFb76XdF6DQwohpaVPIJPmv8IdZU=; b=OgHqxiF85t2Sy2QVFjNJIhQgw7ZWP14qzXdnjn8/IkBnWk3maJKK3ayTkIe25dpqSD 78cEcFAToF9wRQAVVZ2YPCfb345sKn5CsyxHIcWzr5I7Rap90WMPvjJ/xTcerv9QSt+a XJWeVO7cKuC5oPLdvt2tZSDzdQovmu7/mzVsey6qfMgiCdraYMbuzP4bAB5QEX6zuICS uctBJCJv04AyIER+A+aQeiQoTDpP7EN2BjzYbSrLS/AEYKAVqrmIJINZSrvF1PbwaLFx K9G5GgthB3q1x1Xu83W3CBh+g3uM4OLxu1m8C/0y7aQgKAM3OwUboHaaqpdjXTGCkI0P i24w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885574; x=1792490374; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=2NjEwcz1evegYdskFb76XdF6DQwohpaVPIJPmv8IdZU=; b=ct1Vn31QI2qa67+4/kDUP4bzc0y+p7Tm8AA0QbnQPvd4pmygQ/ah499UHi9PRsXRdU zszgmX8ox0kuElseuYi8iUyU6Q5RFi9nrnRrsHYJQfZmpp4L3uvz1wUMxRl86OtQxCBL aFNvp8eZ96cCHkrzlYbK92/HQRdRuXy2ojpAVGG97PQcepi0OzGBRSwtx6k/JvZ371gA xssg2qxDoMMI7jcKCvWrcxp5RY8vHcnBfHk42H5DYmML9y5rj5sHQ+oulJYJMYz/g0Hl GnE/PW95q4mIHbtoI8hz0lf29aD7EQxDENLBYVSQGPQ2vvUBCVKoYGswdVjCHlxUV7T0 SpXg== X-Gm-Message-State: AFq9FYKUCriIuPefavMJsi8qIcwFdPtBHBCRsWzVXhzH/UVyZHIdmnbY Ca+n6LgKyU5OBODS5NMd5HUVIAzy7AB/5liCXT6ZLKaLEQjRsxVNda96hHRPag== X-Gm-Gg: AYBFou25z2b7FzNg5zrkgStqymmRRRZTSHgMhM7blz8lqgXPpJq/f8bXbE4nmTvEj0u uLZLBAGtquI+/O248WTo4L/MIVIXy2G5dui6F4K1+/OKx0nOhRJnQG1EzZHWqLbvy47w1yDABGw M46Mvuvc1QopH/uncmcjYmHSllp+rZVTJEdt515NJAQrC/4mF7GC+VJStPZxMam6HxecMPEApGo lEon3c2MhppunDPY0yFnYUdydpZMbAbwhDHB9r4oJdkGz3k9BPnIR882/+HXdnZZKbZ0og02Jy4 jhStXdu5uLIC0dBbg1que3fwLuyMiDMvuYAKyuCX7hq/CJk330flqqvX3aUYQyWvphW+Q+pQ8Qe iYamT3avRbDAXMeFC7lpgXDfhF9d7mypvKD6LScoV2b0Fr733fr7XOYpt2PxbuBDHTdjQoWgzsF XnzxAYfiyXzkzjWzXsRuqLbf9i7IlGoiVZ61nV0UW1JouvjrU+aPBlG9k/lrZ8BF0i98uphBlrx 2Z+avMAYedUb4eyPBG4q2xshEHhs78VFqb5cNQxzscDfB9kcw== X-Received: by 2002:a17:90b:390a:b0:3a8:824:83ca with SMTP id 98e67ed59e1d1-3ab3a9337ebmr9932511a91.54.1791885573791; Tue, 13 Oct 2026 02:59:33 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.02.59.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 02:59:33 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 9/28] sngrep: patch CVE-2026-90558 Date: Tue, 13 Oct 2026 22:58:44 +1300 Message-ID: <20261013095903.3544906-9-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 09:59:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130842 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-90558 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 36ddee53b179b5108186cc3e8d76c0f6a5e5d069) Signed-off-by: Ankur Tyagi --- .../sngrep/sngrep/CVE-2026-90558.patch | 84 +++++++++++++++++++ .../recipes-support/sngrep/sngrep_1.8.4.bb | 4 +- 2 files changed, 87 insertions(+), 1 deletion(-) create mode 100644 meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch diff --git a/meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch b/meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch new file mode 100644 index 0000000000..64fd8044a9 --- /dev/null +++ b/meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch @@ -0,0 +1,84 @@ +From 399346a12ca3bcf7703734fa33b5b3427775b014 Mon Sep 17 00:00:00 2001 +From: Kaian +Date: Fri, 7 Aug 2026 08:45:42 +0200 +Subject: [PATCH] fix: prevent stack buffer overflow in SIP attribute + formatting + +call_get_attribute() formatted the Call-ID, X-Call-ID and Reason header +text with an unbounded sprintf("%s"). Call-ID/X-Call-ID can hold up to +MAX_CALLID_SIZE/MAX_XCALLID_SIZE (1023 bytes) and Reason text is copied +from the raw payload (up to MAX_SIP_PAYLOAD), while all callers pass a +255-byte SIP_ATTR_MAXLEN stack buffer (call list rendering, sort compare). +A SIP message with a long Call-ID, X-Call-ID or Reason header overflowed +the stack, triggerable via pcap, live capture or HEP/EEP remote capture. + +Bound these writes with "%.*s" and SIP_ATTR_MAXLEN - 1. Also fix a +matching off-by-one in msg_get_attribute(), where the existing "%.*s" +used SIP_ATTR_MAXLEN as the precision and could write 256 bytes +(255 chars + NUL) into the 255-byte buffer. + +Thanks to TristanInSec for reporting the issue. + +(cherry picked from commit 1ff74ee3ab5ff280e8ba976aa8c744dca57eb35b) + +CVE: CVE-2026-90558 +Upstream-Status: Backport [https://github.com/irontec/sngrep/commit/1ff74ee3ab5ff280e8ba976aa8c744dca57eb35b] + +SIP contract change was dropped during backport as it was introduced in +v1.8.4[1] + +[1]https://github.com/irontec/sngrep/commit/c61a26d90c166f996e31aceefc9c2f8f831ccd86 + +Signed-off-by: Ankur Tyagi +--- + src/sip_call.c | 6 +++--- + src/sip_msg.c | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/src/sip_call.c b/src/sip_call.c +index bea879a..68ecb50 100644 +--- a/src/sip_call.c ++++ b/src/sip_call.c +@@ -257,10 +257,10 @@ call_get_attribute(sip_call_t *call, enum sip_attr_id id, char *value) + sprintf(value, "%d", call->index); + break; + case SIP_ATTR_CALLID: +- sprintf(value, "%s", call->callid); ++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->callid); + break; + case SIP_ATTR_XCALLID: +- sprintf(value, "%s", call->xcallid); ++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->xcallid); + break; + case SIP_ATTR_MSGCNT: + sprintf(value, "%d", vector_count(call->msgs)); +@@ -282,7 +282,7 @@ call_get_attribute(sip_call_t *call, enum sip_attr_id id, char *value) + break; + case SIP_ATTR_REASON_TXT: + if (call->reasontxt) +- sprintf(value, "%s", call->reasontxt); ++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->reasontxt); + break; + case SIP_ATTR_WARNING: + if (call->warning) +diff --git a/src/sip_msg.c b/src/sip_msg.c +index 379a40a..6762862 100644 +--- a/src/sip_msg.c ++++ b/src/sip_msg.c +@@ -136,13 +136,13 @@ msg_get_attribute(sip_msg_t *msg, int id, char *value) + } + break; + case SIP_ATTR_METHOD: +- sprintf(value, "%.*s", SIP_ATTR_MAXLEN, sip_get_msg_reqresp_str(msg)); ++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, sip_get_msg_reqresp_str(msg)); + break; + case SIP_ATTR_SIPFROM: +- sprintf(value, "%.*s", SIP_ATTR_MAXLEN, msg->sip_from); ++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, msg->sip_from); + break; + case SIP_ATTR_SIPTO: +- sprintf(value, "%.*s", SIP_ATTR_MAXLEN, msg->sip_to); ++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, msg->sip_to); + break; + case SIP_ATTR_SIPFROMUSER: + if (msg->sip_from && (ar = strchr(msg->sip_from, '@'))) { diff --git a/meta-networking/recipes-support/sngrep/sngrep_1.8.4.bb b/meta-networking/recipes-support/sngrep/sngrep_1.8.4.bb index 5bb30da6db..c7457fd0c0 100644 --- a/meta-networking/recipes-support/sngrep/sngrep_1.8.4.bb +++ b/meta-networking/recipes-support/sngrep/sngrep_1.8.4.bb @@ -15,7 +15,9 @@ DEPENDS = "\ ncurses \ " -SRC_URI = "git://github.com/irontec/sngrep.git;protocol=https;branch=master;tag=v${PV}" +SRC_URI = "git://github.com/irontec/sngrep.git;protocol=https;branch=master;tag=v${PV} \ + file://CVE-2026-90558.patch \ +" SRCREV = "9c370866afaf5ccb258bf03848b2d22f30cf61bd" inherit cmake pkgconfig From patchwork Tue Oct 13 09:58:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100571 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40A1ECC6B08 for ; Tue, 13 Oct 2026 09:59:47 +0000 (UTC) Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3515.1791885577445991519 for ; Tue, 13 Oct 2026 02:59:37 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=PxZwJzEy; spf=pass (domain: gmail.com, ip: 209.85.216.44, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-381b831d535so3247167a91.0 for ; Tue, 13 Oct 2026 02:59:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885577; x=1792490377; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=PySX8MfFG1SWeTGIfyn2z+EEa0WNcsH5pwKMedREvqM=; b=PxZwJzEydsYmKl/9FdUBjee0Cm35el74mn40XdVPq2qpHnL7GdSfG4/d6lwcwJAlk3 BpFeSdB9RmPxR+bFdf1GyN7bY8b2wcJPDWDsU5rB3cBiLC7smTBNTiO4Y3rsFDBEl7T/ d4ZZmq+xG+fifsd2vek7EZIJK9yh0PVAd9Br/mqorsNGo/z19ZPkkQoQj9mH4DMxJylZ v8bNMMlauyLjtEGFSiSAy4FOp9CCLtvQF1CvlAskrXjAY/D70ftw5EHibe97xjW1RHRN hoV8oAcFnaF0qz51VCMw1B2Ia47m3y9hGtbeG/zLJb81+hq8KcN3jAxJ2dlgn7DzPg/V Zprg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885577; x=1792490377; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=PySX8MfFG1SWeTGIfyn2z+EEa0WNcsH5pwKMedREvqM=; b=cGD8Mfj6+1MI/ronCoke/nE74rpwo5wdllm7TNGuHQoQLvQl+PUc8LdWkPIGaBAOxY u6SNkvJLgxdJO6hbtZZA6s2w9LJ9pzSohPnswDCI6k7afzLG23MxmCkSvDQ4eGMTrV5a toOlciZHJWJGT3/KeDHbbLiaTj2giMHmm+Vp080X/g6qvfSUggLcMuQHGHl/Ql/6+54m d62q4QHcq9qNxsAdcJUJGsetJJYef8O3pMbea9LghfX8T2v3Ytc8rUsRbDIE69gJKbnj qkJKNn1L/bGz0fkGQlAoUQstw2JeJwGBWWXjATCT3+AD8aErnl7xbhUBrqo4x7ci9HRU ey3Q== X-Gm-Message-State: AFq9FYLEz+UwgVk0vvBZeBDlPTZbQBHD1Bn0eeFHcAGR29ynH88h5xxK DIDKj7WJLDMPhp1u9Fgvv0ODCct3x9p1b4QE1MPVhS77+Yqv0G9F21u08W3NXQ== X-Gm-Gg: AYBFou11YAZBAfoC2HMrrvqK09PSej0acRDEiOcaUoTNVMQhAuWC89FyJXp5Fh+QJmw ByXGQXpladojYiRR97c9+Vi6bLQ7WoAMCwW+FbQ2CIPtZIUZqaB0Fne7R5Uk7XDtOFAVXEI3NaP ngnrr2BeGT8tdtqnZBVSA9vb4bNoT1y44d1nJ/ccrdlD430qteVxvYN1VOSJSR7u2R82AZbS2fJ hdzmW5U+dWRKBLij8YzWmqzaCSNriE0y1ushVI4kN5hDtyG1WgyAEhCln+0DeJCud7gkS86bm7/ +YhQdPUvNML9XOvTTX2llU1DoTDZsFCfvpjEuK+gSXtyuBvOdlEEcMjUlauhvG95r+3vmyGMFv5 n3ft4qRrmNScY1em7rceDug1G0JBl+T6HbTW6dkEcJWMawwKuw+FVvh6+Pf2KqGLLxoELvk1A7D 4H00qnDxx3Al7UBtHKA6m4fMZqXZ/rEXr4m8kgmyRZp2nIbkdKuw5kI2HwT5uLi+sAIP6T+Jwhw q+y6wD7HhHcaAbYdmT2zDNEIPKRy2JPbSnlI+dwo+cdpo9Cpw== X-Received: by 2002:a17:90b:4b05:b0:3aa:ff19:42b8 with SMTP id 98e67ed59e1d1-3ab3a9aaab6mr11201789a91.27.1791885576805; Tue, 13 Oct 2026 02:59:36 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.02.59.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 02:59:36 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 10/28] strongswan: patch CVE-2026-78123 Date: Tue, 13 Oct 2026 22:58:45 +1300 Message-ID: <20261013095903.3544906-10-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 09:59:47 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130843 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78123 [1]https://download.strongswan.org/security/CVE-2026-78123/strongswan-5.0.2-6.0.7_openssl_pkcs7_info_init.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78123).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit aa064e512a7d50e20f8e9c5a5249ee8bb2ee82ea) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78123.patch | 51 +++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 4 +- 2 files changed, 54 insertions(+), 1 deletion(-) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78123.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78123.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78123.patch new file mode 100644 index 0000000000..36e6eb1289 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78123.patch @@ -0,0 +1,51 @@ +From 23707d346f1f85dba0419c43658a86a80a24f568 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Mon, 1 Jun 2026 17:51:35 +0200 +Subject: [PATCH] openssl: Fix undefined memory access when verifying PKCS#7 + containers + +If the signerInfo or recipientInfo structure doesn't contain +issuerAndSerialNumber but instead a subjectKeyIdentifier, then the called +functions will leave the passed name and serial numbers unchanged. While +openssl_x509_name2id() prevents a NULL-pointer dereference, it tries to +DER-encode the object at the passed pointer via i2d_X509_NAME(). +Depending on the stack contents, this likely causes a segmentation fault. + +Fixes: 3c820cdc232a ("Implement PKCS#7 decryption using openssl") +Fixes: c61723c69fb5 ("Implement OpenSSL PKCS#7 signed-data parsing and verification") +Fixes: CVE-2026-78123 + +CVE: CVE-2026-78123 +Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/e59b4c96990635a482d6532f7905143f2541d8b5] + +Signed-off-by: Ankur Tyagi +--- + src/libstrongswan/plugins/openssl/openssl_pkcs7.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c +index d9abcf8..b15c8d7 100644 +--- a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c ++++ b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c +@@ -222,8 +222,8 @@ static auth_cfg_t *verify_signature(CMS_SignerInfo *si, + auth_cfg_t *auth, *found = NULL; + identification_t *issuer, *serial; + chunk_t attrs = chunk_empty, sig, attr; +- X509_NAME *name; +- ASN1_INTEGER *snr; ++ X509_NAME *name = NULL; ++ ASN1_INTEGER *snr = NULL; + int i; + + if (CMS_SignerInfo_get0_signer_id(si, NULL, &name, &snr) != 1) +@@ -628,8 +628,8 @@ static bool decrypt(private_openssl_pkcs7_t *this, + identification_t *serial, *issuer; + private_key_t *private; + X509_ALGOR *alg; +- X509_NAME *name; +- ASN1_INTEGER *sn; ++ X509_NAME *name = NULL; ++ ASN1_INTEGER *sn = NULL; + u_char zero = 0; + int oid; + diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index 117c148865..a7636554a6 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -8,7 +8,9 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263" DEPENDS = "flex-native flex bison-native" DEPENDS:append = "${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', ' tpm2-tss', '', d)}" -SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2" +SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ + file://CVE-2026-78123.patch \ +" SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Tue Oct 13 09:58:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100572 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5D2D1CC6B10 for ; Tue, 13 Oct 2026 09:59:48 +0000 (UTC) Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3517.1791885580595251109 for ; Tue, 13 Oct 2026 02:59:40 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=KwfQbeln; spf=pass (domain: gmail.com, ip: 209.85.216.41, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-383b4a3755fso1758583a91.3 for ; Tue, 13 Oct 2026 02:59:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885580; x=1792490380; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Kl4iyfn1rSLP8mcMOluUdNGkgVtSTu7Y/Di6Nt6CjxI=; b=KwfQbelnYciOJTDtO3zsRkQf0T1rrryIRPGZTEVGE1vQW9Sim9QexzhfgJoic2xuOX zvqAd+IgAaPhQ7i1e8xD6/UqkxkXw4dzc2KGI2p8c2NYTj648o69E/motELFw3j/uQZF wP2UQ6mBGGqG9p6tTz6BFc6lufmY+NMzVN+rjpjwCA0gwjMHcFpVniqKFOoNfsOT9jGJ eE09zEkRB+zTd/1WJeLBktw2Ib613OvuGol/LqyLukXLSuzDUHn3YZS6urg16QLp3Bst sQoMxqPmmoHyaQFRgEJ26FMkXEFMkcbk65knKO/2WOmsDzQISO2zPbQMuyMSGWqVffsg uIJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885580; x=1792490380; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Kl4iyfn1rSLP8mcMOluUdNGkgVtSTu7Y/Di6Nt6CjxI=; b=v8bye9yUv1gPldVLyc4TkCuMVporn+ewZXTAQ6ci6o2jwhPq4FI8826IOuAbv1yJY1 g2QkLgPk4zEbhL9cnwZRzN+dvLzG/19TL5bEAH1p0zh8FuDSd1OIt2P5asLCdjZORTEo havUeIl6+liOZ6iL53ngryW0Faq5OGO2flMoPwU7eeVSbSkD7kGqOoJ76YXa2XcOj9RS hkJU7FOi4HZC4kRGCRVlfBqVroXno1hVGRH668qP00dLJRyPFTDtqAVkMYZUQuRJom5W DREEEw7CQZmUYu4AdHhzXbf5630LFAL+M5KxBa4HoP66CCrf/4SzrpL38YOE5io3X/+U hAYg== X-Gm-Message-State: AFq9FYLH8SmpJVidURoP4pTHorj+Z/GIDomAoXGWkvwAQKjg/b1+OOFE i9iTYVdl8rmA6qp9Q0p6Km/zmJWxTXSSYy67A75bZJu8Ydtg/vgfsIfvyexwvQ== X-Gm-Gg: AYBFou36ubDkGnj5ByvtlQrFnPpPY51rN60D57u+nesn9/hshaeqg8N9L3PZdWkTz35 L/1vW7toMzydbbgmeQGz4QMuwYKv8pZOMmaye6G/SsO8XsddeqHqv/JGa5pFoPldl+F0BFRWpnd leQPn2LKxCfePao2zyg3ehGTxxqQW/ZsAhyHHTrVJFgBgDal1piID+LoN7v+FXflhMpE3IeYndH BW78o/9G9nE9apzuwDHpAWjrvs4xlnqjR2gIJrBnS14EyPSUdd060yLMlSGly1xJVcfBmmzpGjZ /o2XalwhKt7iUeNatI+r4qRNnVIbj0+VVt+qzTFG89B2ZsMeUNGVSyLRKhVxxuJBQ6GPv44gAAw 9Jhc9PweXz4tUQz39FfF6Qbw/OPNcVjmls8dr+xIuxV5019aXSNGK00aptS6PJXCilkf8huwJIt ZktpJ1RNZBLa2qaXE+pPFmkFgzC6Q0CqjMyOfbAavWQTL1X9Nmnvjuu6UISG7dI3qxIFbPhbjNS CmSphkp+fGkPIjViTFcmGiE+SkIEXojfH2Li24= X-Received: by 2002:a17:90b:3c8c:b0:3aa:6b5d:a018 with SMTP id 98e67ed59e1d1-3ab3af94c34mr9434397a91.67.1791885579947; Tue, 13 Oct 2026 02:59:39 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.02.59.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 02:59:39 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 11/28] strongswan: patch CVE-2026-78124 Date: Tue, 13 Oct 2026 22:58:46 +1300 Message-ID: <20261013095903.3544906-11-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 09:59:48 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130844 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78124 [1]https://download.strongswan.org/security/CVE-2026-78124/strongswan-5.0.2-6.0.7_openssl_pkcs7_certs_leak.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78124).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit dd0ba33ed20b4245c82c19b19c55b3710384ce52) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78124.patch | 34 +++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 35 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78124.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78124.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78124.patch new file mode 100644 index 0000000000..5e37ed671a --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78124.patch @@ -0,0 +1,34 @@ +From 36ce778a76b4b912699a52cf1109394fce109c83 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Mon, 15 Jun 2026 16:02:01 +0200 +Subject: [PATCH] openssl: Fix memory leaks after enumerating certificates in + PKCS#7 container + +This can be triggered via IKEv1. + +Fixes: 04884be3b5f7 ("Implement openssl PKCS#7 certficiate enumeration") +Fixes: CVE-2026-78124 + +CVE: CVE-2026-78124 +Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/49bf0725fa61198d1e29d5b4c2651c9190b2c10c] + +Signed-off-by: Ankur Tyagi +--- + src/libstrongswan/plugins/openssl/openssl_pkcs7.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c +index b15c8d7..cefe1ae 100644 +--- a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c ++++ b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c +@@ -132,6 +132,10 @@ typedef struct { + METHOD(enumerator_t, cert_destroy, void, + cert_enumerator_t *this) + { ++ if (this->certs) ++ { ++ sk_X509_pop_free(this->certs, X509_free); ++ } + DESTROY_IF(this->cert); + free(this); + } diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index a7636554a6..82cd4738fb 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -10,6 +10,7 @@ DEPENDS:append = "${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', ' tpm2-tss', SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78123.patch \ + file://CVE-2026-78124.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Tue Oct 13 09:58:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100573 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22160CC6B0F for ; Tue, 13 Oct 2026 09:59:48 +0000 (UTC) Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3519.1791885583712087236 for ; Tue, 13 Oct 2026 02:59:43 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=RwPvVgmQ; spf=pass (domain: gmail.com, ip: 209.85.216.47, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-3856d6fbcb3so1549549a91.2 for ; Tue, 13 Oct 2026 02:59:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885583; x=1792490383; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=/spFjGBu+l/0TF0RD9LUyxEsSeNwPyZCTqz2qpNpq9g=; b=RwPvVgmQxXeMVNc0auM6jo9PgWQCelx4EpVLAOWSWNBkNb4WcARWrSnNEj6FlbPFqK gzsS/2oMmlJZ6iipnC7MQR3MbZlUvUpEY1uVRro+z5N9QsXUXJ22420xAmMEZ1Z/8afe XZ95fqdl6deUtwhd9PVX/LCdeT6zBXbgduos8jg9C1PpcdKPTxc2cLkk14s1e09recg7 7XZRmp7iG7sGLux07GlGwTmRPKgKJ5/Nd94ATlqor11K4n7UF9rAFB3q0Od875PCodw7 vhSXDljsqO9VyOQzDGBclYR2OxVMX5rsgUfvRShKcE9/Sq1l9DVTsCM1XoBaSWmzl5Tr xOeg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885583; x=1792490383; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=/spFjGBu+l/0TF0RD9LUyxEsSeNwPyZCTqz2qpNpq9g=; b=PTmkVdQloGNj9AzoZXzsWxZkVYDt0KTOfvpNdtgg7pbQUT+WwhM/TP63osC/eXYTuN 2HMxlalrIm9AAtD9GYtdgxTOW1OsyZ4yLqcd3uZoqR6GXwtgrqYgpKhjd4YVN4e9ysFF Wbp2KFskKeBhuucNqMNw4KQKIUmORk7UTCsDpO7dA3zQePe1N+QeO5Psfza3gt22ilj6 dP5PJYxHrnGQbTgQiE1PX+15MH+T92q0WjHG0QOs0GfU4mMRxbst2LJMgYuoeIE1PCBD YhFj9NH3xqRZU4K3v9ZEA4hu6LA+Syw6XkmTLfQtMAaqNCuLcCkmIx+QRXcVa1jd+WM0 Dnzw== X-Gm-Message-State: AFq9FYKI1fI3M8tGsLKpdBnHBZPnpabJJEfi1VR/z6yGjmWNMkTVbd8H YemgK7z7l+mjlBY2vNCxXZNNzn9YBPHRmqgw36mYVr/EJdRwUIzn+HIV3BSRsA== X-Gm-Gg: AYBFou2zW7RUD8EVejRxHueKXWdb0BuHC5nViAbm771e74g3z0D29SLRn0F2r2TctA0 Vm/MMTYbZC/FjxtD7hOkrEy4BQHqnnKKaocD/+5z1yBeNn7nB5YrzYIa+7mDsVbvff+j6BccsXk bxiauZQOuRPstKt6P9CcPeb19obflyhnCpTUO04ykOEqDUKp6FN01IsQsKwvI0c/sUjC41zW/7P OEz3WCcG1AQjqm9kKFBGAMQNwIc9Xuuvg83GkkgO+/gqx7GqvTUpm2Rhqs4uVx8BrnNTKgXVDLp iuwVh4Jfc63zyqHan94vXTYtMKWupDH8OEBVLRpW1DFdRmuZhWvsneSa5LjUZW4rRaUnCWF8K5f CY0UTU2+lWY7FrLBfn7pidtXAk7I3ex5DOn0+/H0+u1QqZJ6ns8XL8t3jajdFA4hsjJ6ZkOW9Ge dhY4iJ6bbV8qjN46vVYIeTs3IQIos7b0ID8CconV3dBoz0M8m2o5ZTECn5aoYahmLXLX4eBkfAS p2IfI5cw0SPdPzzgpb3cEuPjrlUUx3ALWRHFw4= X-Received: by 2002:a17:90b:4a8f:b0:3aa:fc22:8ab0 with SMTP id 98e67ed59e1d1-3ab3a8e55damr10022373a91.38.1791885582941; Tue, 13 Oct 2026 02:59:42 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.02.59.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 02:59:42 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 12/28] strongswan: patch CVE-2026-78126 Date: Tue, 13 Oct 2026 22:58:47 +1300 Message-ID: <20261013095903.3544906-12-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 09:59:48 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130845 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78126 [1]https://download.strongswan.org/security/CVE-2026-78126/strongswan-4.4.0-6.0.7_eap_aka_sync_fail.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78126).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit e228e7711e49349b1342ae2be83530ab34883f98) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78126.patch | 37 +++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 38 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78126.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78126.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78126.patch new file mode 100644 index 0000000000..307d1a9834 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78126.patch @@ -0,0 +1,37 @@ +From 13aa926cad7ec7f668249b6513c938b8c2e95af4 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Thu, 4 Jun 2026 10:00:02 +0200 +Subject: [PATCH] eap-aka: Only accept AKA-Synchronization-Failure if expected + +This fixes a NULL-pointer dereference if the client sends such an error +before the server issued a challenge and allocated this->rand. + +Fixes: 26e246769224 ("ported EAP-AKA branch into trunk") +Fixes: 4735965fc048 ("EAP servers check if the received EAP message was expected") +Fixes: CVE-2026-78126 + +CVE: CVE-2026-78126 +Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/7bedb451346261370256d390a8c155b86e4b455d] + +Signed-off-by: Ankur Tyagi +--- + src/libcharon/plugins/eap_aka/eap_aka_server.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/src/libcharon/plugins/eap_aka/eap_aka_server.c b/src/libcharon/plugins/eap_aka/eap_aka_server.c +index 0712ccc..95d4b03 100644 +--- a/src/libcharon/plugins/eap_aka/eap_aka_server.c ++++ b/src/libcharon/plugins/eap_aka/eap_aka_server.c +@@ -505,6 +505,12 @@ static status_t process_synchronize(private_eap_aka_server_t *this, + simaka_attribute_t type; + chunk_t data, auts = chunk_empty; + ++ if (this->pending != AKA_CHALLENGE) ++ { ++ DBG1(DBG_IKE, "received %N, but not expected", ++ simaka_subtype_names, AKA_SYNCHRONIZATION_FAILURE); ++ return FAILED; ++ } + if (this->synchronized) + { + DBG1(DBG_IKE, "received %N, but peer did already resynchronize", diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index 82cd4738fb..2abc616c37 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -11,6 +11,7 @@ DEPENDS:append = "${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', ' tpm2-tss', SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78123.patch \ file://CVE-2026-78124.patch \ + file://CVE-2026-78126.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Tue Oct 13 09:58:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100574 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4CE92CC6B13 for ; Tue, 13 Oct 2026 09:59:48 +0000 (UTC) Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3521.1791885586447823719 for ; Tue, 13 Oct 2026 02:59:46 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=idlKCUil; spf=pass (domain: gmail.com, ip: 209.85.216.41, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-3ab3260b2cdso1133977a91.1 for ; Tue, 13 Oct 2026 02:59:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885586; x=1792490386; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DMOJ+wdKtsBYkFERsEOue3c/hDi2ukGCx5whtwPoGAo=; b=idlKCUil2SaM/ph3gDMMBJJjRqS7UPjqsSD0UXlyhGfqpehWdxqDxsK/k7J/GH69y6 ht/oUL5iaHwXOEIESxP3lrCGfFJb8KGJ6Gis7enldpmFcf9fT75qp+13HE1na+CNwP5n yrtlVq8pzI8zrm8t75SgqfjJTpttmDfU+VUcItjXXNDCYqowdNNOSXANm/qLDgq+e2I+ 7vTSUgWDrBNpl5oUWdrjUol3dx6BmuD/tkyIrywBcatc2AF6HFzqaR3UUK+JRJ3pLFwE XnMIE5jKHvH94KCi0rsE0F2KXB1AAR/SIlapwHUFoBPd1LQAAdyXGamzpttpUbt9UZj3 AfYw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885586; x=1792490386; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=DMOJ+wdKtsBYkFERsEOue3c/hDi2ukGCx5whtwPoGAo=; b=EL0tztKmCHHPMfCSy+ZHPJOrVF2LSBAZ6EAgqvnCjGPgfKWSNZ5cOZeuo1IdWJgrwF 2i5mGiVkOzjb/FXlXppIXQtWaEnqLBc69CoHVtGjX9vt3cdqD39ZhOFGDAj2ve49KgMt YqaQmEO22V+gqUSgScD+5H/xW47gGRmzlYq9OHOtuH6muWqrccSAE+v+lff7P8XvOIar n4Aa8z9DgmdQb9sRpZch5k6GjP/8z2cEyn2AMmoieUhC0nU99vpwdqOTG+nSw4SJbeAK jGCJe2vsyM/tQ1blpE88E2VcjdhactCg8EUJyHWBoh0l+oZgxYKVe0ojs6B60k+ENlFp vBcg== X-Gm-Message-State: AFq9FYK2jnLBvvq6akHKD0RDZQWFSt/m8AhegvmvBcijwGFJ5oOCR/tS fLmRxED/DFs3wqcT4TEgPlQmCHX3TMG/Q0X15EH4ZSo9z4bW+HmHtPc2SiYb9A== X-Gm-Gg: AYBFou3pGIzCBKyNL44k3O3z6ugAf2qOTC9eNTa3Cok5+V4Obr1suhj+/R60MRx1qJd lr9h75T62dQA9tCeVaoZFgfKFKzjbyjLTwQ8HGi0ZyvKqAFD2LVCxHgQujrOy8UW7ufULAS3f2Z Dk8OvYPf/L/YNrhtKlsJGl+5SSjTH+mNFGLwdCHwDCLQl5iXNMPqGaqr3JJb6KWdLw7TwLwwUXL mV4bRasmAFga9z0m3dPkRuSW8nQidinXTgSjtmbGnfUBMs9JKyMJcWZC5Q0ZmGxheTUif60pX2Z z7chbZtXZZfOEZLEunSX72jOLr/Cg+tzxSif0wM8NHNPCHLqgxkXY43u9BmSRqSzym9xKqAXRxj R7W5n9I1O7W5Euqs054Mogcy2oaSwTNEOIQHpPmWhaQqX3L1LyfasGSAUEX8VjfFoMYjZuKEl0k pV3gJCPaoGyxTCn6Bvn8q0d272g4AypqX87E78h6odhtrWCscXikbijN/QmXxdz4JqHkZhIA5sF TjWBxuZQ8YKRT6Hai2kOTimIpPtXogOD1kVwgs= X-Received: by 2002:a17:90b:164d:b0:3a4:a370:d888 with SMTP id 98e67ed59e1d1-3ab3a99b4c2mr8344724a91.20.1791885585667; Tue, 13 Oct 2026 02:59:45 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.02.59.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 02:59:45 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 13/28] strongswan: patch CVE-2026-78127 Date: Tue, 13 Oct 2026 22:58:48 +1300 Message-ID: <20261013095903.3544906-13-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 09:59:48 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130846 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78127 [1]https://download.strongswan.org/security/CVE-2026-78127/strongswan-5.3.1-6.0.7_message_log_leak.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78127).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 7b8fd4df2e4eb82ad4558d6d3ddde57524ce9216) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78127.patch | 115 ++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 116 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78127.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78127.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78127.patch new file mode 100644 index 0000000000..43def8b9b1 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78127.patch @@ -0,0 +1,115 @@ +From b38d55b7df137e599c0364a8f0e6d3e1ab84ed50 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Mon, 8 Jun 2026 09:19:42 +0200 +Subject: [PATCH] message: Avoid memory leak if string buffer for message is + too small + +This leaked 40 or 80 bytes per parsed message for the enumerators that +were not destroyed. While triggering an OOM condition will require quite +a lot of messages and the DoS protection also helps avoiding that this +is triggered quickly, it all depends on the memory constraints of the +system and the time available to the attacker. Also, if IKEv1 is allowed, +it could get quicker as the lack of message IDs doesn't allow dismissing +unexpected messages before parsing them. + +Fixes: 092958c89d52 ("fixed payload debug message") +Fixes: 6a4a47511f75 ("Show contents of the CP payload in message_t stringification") +Fixes: CVE-2026-78127 + +CVE: CVE-2026-78127 +Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/4b7108ac0f84fbf40da2b510eb6333afa2a54240] + +Signed-off-by: Ankur Tyagi +--- + src/libcharon/encoding/message.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/src/libcharon/encoding/message.c b/src/libcharon/encoding/message.c +index 8da9a1d..a4bf9cb 100644 +--- a/src/libcharon/encoding/message.c ++++ b/src/libcharon/encoding/message.c +@@ -1398,7 +1398,7 @@ static char* get_string(private_message_t *this, char *buf, int len) + payload->get_type(payload)); + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; +@@ -1424,7 +1424,7 @@ static char* get_string(private_message_t *this, char *buf, int len) + } + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; +@@ -1454,7 +1454,7 @@ static char* get_string(private_message_t *this, char *buf, int len) + eap->get_code(eap), method); + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; +@@ -1495,7 +1495,8 @@ static char* get_string(private_message_t *this, char *buf, int len) + attribute->get_type(attribute)); + if (written >= len || written < 0) + { +- return buf; ++ attributes->destroy(attributes); ++ goto err; + } + pos += written; + len -= written; +@@ -1507,7 +1508,7 @@ static char* get_string(private_message_t *this, char *buf, int len) + written = snprintf(pos, len, ")"); + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; +@@ -1529,7 +1530,7 @@ static char* get_string(private_message_t *this, char *buf, int len) + } + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; +@@ -1544,7 +1545,7 @@ static char* get_string(private_message_t *this, char *buf, int len) + frag->get_total_fragments(frag)); + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; +@@ -1557,16 +1558,16 @@ static char* get_string(private_message_t *this, char *buf, int len) + written = snprintf(pos, len, "(%d)", unknown->get_type(unknown)); + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; + } + } +- enumerator->destroy(enumerator); +- +- /* remove last space */ + snprintf(pos, len, " ]"); ++ ++err: ++ enumerator->destroy(enumerator); + return buf; + } + #endif diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index 2abc616c37..d8ed26d841 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -12,6 +12,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78123.patch \ file://CVE-2026-78124.patch \ file://CVE-2026-78126.patch \ + file://CVE-2026-78127.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Tue Oct 13 09:58:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100576 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55DF5CC6B03 for ; Tue, 13 Oct 2026 09:59:58 +0000 (UTC) Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3522.1791885589262985903 for ; Tue, 13 Oct 2026 02:59:49 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=PKu2smUZ; spf=pass (domain: gmail.com, ip: 209.85.216.42, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-381b831d535so3247358a91.0 for ; Tue, 13 Oct 2026 02:59:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885589; x=1792490389; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=kQX8ZX3OmqB3os19hZtjRRMHYNsxUulUgZR6g/FqSpY=; b=PKu2smUZzi9ijHNBfhQLR3CpQNu06ujNw/1KDU4epSTyymPkmPSN/tH1l3GPyTJABB +DoPRt0SsXNhZSDQgz/h0fgZDypu6q2r/rl7YgejWLXr6CagxX7k+jkUq357dbwJmzSr keT9QSqHCN767Jrd8ILBeLoOf6dCXGA+EqyDzZpsWHpzne3zCPaKieCmD/5DFgEv9bID izjT/785qS/ChebazVOAlroTNu3Sqo1KXSOkJvVxKad44do/mj50ijVBPJ2i5+tGqrn4 kzZEBSycmr/eC9N9R5OaBzhl+LS32syL2DNrlhDYOaTMiGVbbAIgF/txsFETw6QGXHmG 8pfg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885589; x=1792490389; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=kQX8ZX3OmqB3os19hZtjRRMHYNsxUulUgZR6g/FqSpY=; b=n0s1Jot6ulLn8J68PwNcTlRC8enPGB6mXuk6Z3Ea+rveJy+rU8jROLGzL81tuAbtQZ JEQWeR78kcidRmdfozJqUUv7Uld8YnAOdW5lNB0Lne7NegCzfr+ekVRFHDbJwIb2diLD F9dRTqkuoNY3xIZLEKUrENYQoYe9HtwbinlAt/YsvbpLZo4xRiUxHwwiLmgVEdsEvl4s LN5uX7epgPsi4lLYeLZ2MDcXV5vFtolOgpfecApHUnazR7+tS/zM48+BsPiARlLthNLI aVeY9QJWcefXCHAF4wXdZIRNNHnX+usw0BsLd3jSUNvXXgoOuWmQgbAGCmCGtLbC2FFy wTaw== X-Gm-Message-State: AFq9FYKIGAaDiTXa4V91fPJ9sK1CuinVLAsbFItvg22pbem43/MVx4b5 H9XOUzkTGXWbZqqxZLszSRuNJRvyzAe091SUpyWgPcilmTMP61slwF3U1lA38Q== X-Gm-Gg: AYBFou0g+3Yf7ZhzYZEqG8vO1OHGjaV+ie+PFx8zbjN6BQ0W8uwKQ6V0mBC/Zx/jJZj hG2CHh/MjjpNu96ZnQQFnlYveEJBQSUB9xtwnuzwNZSEcuCaYYZarztbQC4q3Vr/zuhwWTLueOp eC4ioKk/iUx9o2EnXi6y8JFcVdFoN2UR+6r5jmJZWhcbVADCqLNcTTpqgEhY6G/T1rp4INpdyqY k80JO3RxngddtLRkS0gWJtcKfrP9RaSRaY/EFV132L/Rz6nNBb1y6VXTgFN9BiUwu6R8vc7LW2x eQGTlNSfYJQI5dmJf42ttyJUDcO0Z69vEUGrxAbB6HEtzkM3AA0kxoqeZ7O/grRHegBlWsPE8lw wQLULSKpmmaWVbD4xVBdG+1/ePEy6IpUb1ZVwQvAQajGDxsJQ5NJeTZh2PdpJ5PONDn59AQm5cB jKbYSsLJyT1RKaWCyTun5/vaO3yVqGpbfaa1wxOOqIt8+1+4+2GRdNpwBa48Me2c3CYEv00VPlj VEIdsjkGeHyycygrv03OlLx6x2adiJUgCPqdKw= X-Received: by 2002:a17:90b:3d81:b0:3a7:9adb:2a18 with SMTP id 98e67ed59e1d1-3ab3ae6964cmr9881724a91.62.1791885588538; Tue, 13 Oct 2026 02:59:48 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.02.59.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 02:59:48 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 14/28] strongswan: patch CVE-2026-78129 Date: Tue, 13 Oct 2026 22:58:49 +1300 Message-ID: <20261013095903.3544906-14-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 09:59:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130847 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78129 [1]https://download.strongswan.org/security/CVE-2026-78129/strongswan-5.6.3-6.0.7_pkcs5_params_dos.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78129).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 9ea8363e3055e4b608c0e19d5db87e1fbfcad7e2) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78129.patch | 155 ++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 156 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78129.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78129.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78129.patch new file mode 100644 index 0000000000..5f327989a0 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78129.patch @@ -0,0 +1,155 @@ +From ec14a504137915cc45080323238c64d348d020eb Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Tue, 23 Jun 2026 11:55:31 +0200 +Subject: [PATCH] pkcs5: Validate parsed parameters to avoid DoS attacks + +With the unbounded iterations, an attacker can craft a PKCS#7 file and +send it during IKEv1 to block the processing thread practically for an +unlimited amount of time. + +As the key length is used for an allocation on the stack, not limiting +it could cause a crash. We validate it after parsing the params, but +since `encryption_algorithm_from_oid()` only returns trusted key lengths +that are lower than the limit, that's fine. + +The unlimited salt length had no direct impact (the maximum is bound by +the accepted message size), but we now limit it as well before cloning. + +Fixes: 4076e3ee9121 ("Extract PKCS#5 handling from pkcs8 plugin to separate helper class") +Fixes: fd1ff46f6143 ("Added support for PKCS#5 v2 schemes when decrypting PKCS#8 files.") +Fixes: cab127cba66c ("Added support for encrypted PKCS#8 files (for some PKCS#5 v1.5 schemes).") +Fixes: CVE-2026-78129 + +CVE: CVE-2026-78129 +Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/f60a55e36f95e210ab067de295c9f6bacefcdd1a] + +Signed-off-by: Ankur Tyagi +--- + src/libstrongswan/crypto/pkcs5.c | 65 +++++++++++++++++++++++++++++++- + 1 file changed, 64 insertions(+), 1 deletion(-) + +diff --git a/src/libstrongswan/crypto/pkcs5.c b/src/libstrongswan/crypto/pkcs5.c +index 822656f..e01010b 100644 +--- a/src/libstrongswan/crypto/pkcs5.c ++++ b/src/libstrongswan/crypto/pkcs5.c +@@ -14,6 +14,8 @@ + * for more details. + */ + ++#include ++ + #include "pkcs5.h" + + #include +@@ -22,6 +24,15 @@ + #include + #include + ++/** maximum accepted length for salts in parsed parameters */ ++#define PKCS5_SALT_LEN_MAX 128 ++ ++/** maximum accepted iteration count in parsed parameters */ ++#define PKCS5_ITERATIONS_MAX 1000000 ++ ++/** maximum key length accepted in parsed parameters */ ++#define PKCS5_KEY_LEN_MAX 64 ++ + typedef struct private_pkcs5_t private_pkcs5_t; + + /** +@@ -379,6 +390,41 @@ METHOD(pkcs5_t, decrypt, bool, + keymat, key, iv); + } + ++/** ++ * Make sure the salt has an appropriate length ++ */ ++static bool validate_salt_length(chunk_t salt) ++{ ++ if (salt.len > PKCS5_SALT_LEN_MAX) ++ { ++ DBG1(DBG_ASN, " salt length %zu exceeds maximum of %zu bytes", ++ salt.len, (size_t)PKCS5_SALT_LEN_MAX); ++ return FALSE; ++ } ++ return TRUE; ++} ++ ++/** ++ * Validate that parsed parameters are in an allowed range ++ */ ++static bool validate_params(private_pkcs5_t *this) ++{ ++ if (!this->iterations || this->iterations > PKCS5_ITERATIONS_MAX) ++ { ++ DBG1(DBG_ASN, " iteration count %" PRIu64 " is out of range " ++ "(1-%" PRIu64 ")", this->iterations, ++ (uint64_t)PKCS5_ITERATIONS_MAX); ++ return FALSE; ++ } ++ if (this->keylen > PKCS5_KEY_LEN_MAX) ++ { ++ DBG1(DBG_ASN, " key length %zu exceeds maximum of %zu bytes", ++ this->keylen, (size_t)PKCS5_KEY_LEN_MAX); ++ return FALSE; ++ } ++ return TRUE; ++} ++ + /** + * ASN.1 definition of a PBEParameter structure + */ +@@ -399,7 +445,7 @@ static bool parse_pbes1_params(private_pkcs5_t *this, chunk_t blob, int level0) + asn1_parser_t *parser; + chunk_t object; + int objectID; +- bool success; ++ bool success = FALSE; + + parser = asn1_parser_create(pbeParameterObjects, blob); + parser->set_top_level(parser, level0); +@@ -410,6 +456,10 @@ static bool parse_pbes1_params(private_pkcs5_t *this, chunk_t blob, int level0) + { + case PBEPARAM_SALT: + { ++ if (!validate_salt_length(object)) ++ { ++ goto end; ++ } + this->salt = chunk_clone(object); + break; + } +@@ -421,6 +471,11 @@ static bool parse_pbes1_params(private_pkcs5_t *this, chunk_t blob, int level0) + } + } + success = parser->success(parser); ++ if (success) ++ { ++ success = validate_params(this); ++ } ++end: + parser->destroy(parser); + return success; + } +@@ -471,6 +526,10 @@ static bool parse_pbkdf2_params(private_pkcs5_t *this, chunk_t blob, int level0) + { + case PBKDF2_SALT: + { ++ if (!validate_salt_length(object)) ++ { ++ goto end; ++ } + this->salt = chunk_clone(object); + break; + } +@@ -500,6 +559,10 @@ static bool parse_pbkdf2_params(private_pkcs5_t *this, chunk_t blob, int level0) + } + } + success = parser->success(parser); ++ if (success) ++ { ++ success = validate_params(this); ++ } + end: + parser->destroy(parser); + return success; diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index d8ed26d841..5a7a12d903 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -13,6 +13,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78124.patch \ file://CVE-2026-78126.patch \ file://CVE-2026-78127.patch \ + file://CVE-2026-78129.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Tue Oct 13 09:58:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100577 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 39D32CC6B10 for ; Tue, 13 Oct 2026 09:59:59 +0000 (UTC) Received: from mail-pg1-f178.google.com (mail-pg1-f178.google.com [209.85.215.178]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3431.1791885592704516764 for ; Tue, 13 Oct 2026 02:59:52 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=rKtX+JgQ; spf=pass (domain: gmail.com, ip: 209.85.215.178, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f178.google.com with SMTP id 41be03b00d2f7-cc50ad2d650so1947687a12.1 for ; Tue, 13 Oct 2026 02:59:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885592; x=1792490392; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Tpx6wHmaqrgpjQKmI4jUXEEKGskH2a6/Ik7uFEpL7oE=; b=rKtX+JgQxhQzMju3Vl4RmiYyM/SoQMFcq7rE1b11xC9V36zKpNQUevusyL5usbNyYm svvTIqD466yjVp+SqnebeHcPEinBeJMc0Iuv5lKurG7PYbW2xob9KKNjRhNQ4AKOMZUI LxcEf8sqaQarI0MMnDrG/1n2FLWK35SPToWxCkWR09DEgb6W16FQO5pm8Pc61xYCVRj5 frjfBfniJbDU5jI8Jlo33qKDuxObxE8s/PxilYzks5r9Z3OjeqLVdWzOjBXvf1Z+msL6 6AGA47p7/uCYaMXbgAR0lmRYz8r4OYv7UawyPyvVlBhDWzoE0iR3QaW7vLAzTtpoK9h6 aX4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885592; x=1792490392; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Tpx6wHmaqrgpjQKmI4jUXEEKGskH2a6/Ik7uFEpL7oE=; b=ACTsWKwaGOlz8ezpRJbyB1NBss44VLl1ZI3Bm4Cm6FnkjZC41mC/XB/elVsks0wFtf CtNSLNZ0sg79V7HygguDcYMrFBhXe7yxtmYIpNYKogM7PYumeBRQT3zvcVDHECvGfPw3 tE4yWBK/LFPEjgqOa5dU6jIdB4+3ndH0mDBgSdKMsb+HCpvFNeWsHHBH9vV7o7fHQd2k XH6wl+Ir4yy7mvSUB/lJzeHAi6CE7foaNtr8KkbIf4AUcGyBrcxBnQC0MLPiL8zgWVSb D1Plhu6iIeyE5mW2Zs3xVKRrcAnuU9iwKJIlC2Q6Ct1heduqqqdx9WUpgk1QpsEiGJlO JuVw== X-Gm-Message-State: AFq9FYJCZSZAacbYJl+98vFS2l5BlO4UL56+kYZhSn42r+1OPdxZ8uxo i/WQRnc9E/HbToX6quh/syddYAy0QNM7fTq+Cn0Me66JgzEOKypxznaXti2gYQ== X-Gm-Gg: AYBFou2VbSEdXYbDzqcT1KpTJYjTlrhSmDAFYQ++RHjRHyprtQp2upNclFQZUF6bi8v cdaiDQ+jFafmaj01b5IBM2Eu+Ux2EOx9zf7Lw8G+It8t4BaNbxsz1loe1DKQ3ePeTF6vhcn85MI VVT1Y1rtIUqiEk2dKeG4cyphTQ736mjcb/yY90vRAjyKQOl6cNNmommQBYkSyBfZj2wxWes05Nq voSVvUjNK+Io2rabqkglCJNhAsN0i++C+2rLIF3izRZLKmB/myS6AQ6UnSsKPoyjYCy+QcwZsXU PXodqW8zs++EBrOKdfKHhQevHfF97Bk0QpXiF2czwMXg8cysy2jqW/QSFMiuRriZVXQ5LufwqZX I7odxz0VvSaWHHbOVjbz8FXrvUQJj9v3BKPfHcmMJPcZiP0u8eFJTRcHd1t5C05JtZhllMHOtgp P98klfBPWU9a3TXt526OGNuwd7RE5eBbpkoxaJnrJQ9+0zt8DmV60A6DlGX9JtRubVXMIMM9qMs kuxVXkfx6DZpksvq3k5BA9WD0wj9+V9t+wWHGSrTA== X-Received: by 2002:a17:90b:2d86:b0:3a4:f8da:2478 with SMTP id 98e67ed59e1d1-3ab3a778678mr10196745a91.29.1791885591950; Tue, 13 Oct 2026 02:59:51 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.02.59.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 02:59:51 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 15/28] strongswan: patch CVE-2026-78133 Date: Tue, 13 Oct 2026 22:58:50 +1300 Message-ID: <20261013095903.3544906-15-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 09:59:59 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130848 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78133 [1]https://download.strongswan.org/security/CVE-2026-78133/strongswan-6.0.0-6.0.7_ikev2_rekey_collision.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78133).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 7a5589163324a26c8c3569d8e5ec11f078df0ef5) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78133.patch | 620 ++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 621 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78133.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78133.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78133.patch new file mode 100644 index 0000000000..f009168a9a --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78133.patch @@ -0,0 +1,620 @@ +From 3f5768c48bc9dff62511c91157e0a9bd12b2159b Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Fri, 5 Jun 2026 08:15:46 +0200 +Subject: [PATCH] ikev2: Prevent use-after-free during collision after passive + multi-KE rekeying failed + +During a multi-KE rekey collision, where the initial response to the +active rekeying is delayed (or withheld), the active task already keeps +track of the passive task to eventually resolve the collision (it can +only do so once all nonces are known). + +If the passive task then fails, e.g. due to a missing or invalid KE +payload, and completes with SUCCESS, `collide()` previously recognized +that the passive task is not yet complete returned FALSE, which caused +the task manager to destroy the task. However, the reference in the +active task would remain. So once the active rekeying progresses and +the collision is resolved, that dangling pointer would get dereferenced +for an indirect method call. This happens via the `get_lower_nonce` +function pointer of the `child_create_t` instance in the private task +struct. So besides having to be authenticated, an attacker has to get +two indirections right to exploit this flaw for a potential RCE. +Otherwise, the effects are a crash or basically undefined behavior +triggered by the method call. + +By passing whether the passive task is done (and would get destroyed), +the active tasks can properly clear the held reference. + +Note that this patch includes another fix for a state change during +Child SA rekeying that's included in 6.1.0 (4611f41b1e14 ("child-rekey: +Only reset state of SAs not actively rekeyed if passive rekeying +fails")). + +Fixes: d2b2e1b3fae8 ("ikev2: Make CHILD_SAs properly trackable during rekey collisions") +Fixes: ca3e6d2d144e ("ike-rekey: Support IKE_SA rekeying with multiple key exchanges") +Fixes: CVE-2026-78133 + +CVE: CVE-2026-78133 +Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/eb615b452539461d57503f50041f01773c1ccf86] + +Signed-off-by: Ankur Tyagi +--- + src/libcharon/sa/ikev2/task_manager_v2.c | 13 +- + src/libcharon/sa/ikev2/tasks/child_rekey.c | 47 ++++-- + src/libcharon/sa/ikev2/tasks/child_rekey.h | 3 +- + src/libcharon/sa/ikev2/tasks/ike_rekey.c | 40 +++-- + src/libcharon/sa/ikev2/tasks/ike_rekey.h | 3 +- + src/libcharon/tests/suites/test_child_rekey.c | 136 ++++++++++++++++ + src/libcharon/tests/suites/test_ike_rekey.c | 147 ++++++++++++++++++ + 7 files changed, 361 insertions(+), 28 deletions(-) + +diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c +index 0f3b937..5a19ce8 100644 +--- a/src/libcharon/sa/ikev2/task_manager_v2.c ++++ b/src/libcharon/sa/ikev2/task_manager_v2.c +@@ -927,7 +927,8 @@ static status_t process_response(private_task_manager_t *this, + * Handle exchange collisions, returns TRUE if the given passive task was + * adopted by the active task and the task manager lost control over it. + */ +-static bool handle_collisions(private_task_manager_t *this, task_t *task) ++static bool handle_collisions(private_task_manager_t *this, task_t *task, ++ bool done) + { + enumerator_t *enumerator; + task_t *active; +@@ -951,7 +952,7 @@ static bool handle_collisions(private_task_manager_t *this, task_t *task) + if (type == TASK_IKE_REKEY || type == TASK_IKE_DELETE) + { + ike_rekey_t *rekey = (ike_rekey_t*)active; +- adopted = rekey->collide(rekey, task); ++ adopted = rekey->collide(rekey, task, done); + break; + } + continue; +@@ -959,7 +960,7 @@ static bool handle_collisions(private_task_manager_t *this, task_t *task) + if (type == TASK_CHILD_REKEY) + { + child_rekey_t *rekey = (child_rekey_t*)active; +- adopted = rekey->collide(rekey, task); ++ adopted = rekey->collide(rekey, task, done); + break; + } + continue; +@@ -1011,14 +1012,14 @@ static status_t build_response(private_task_manager_t *this, message_t *request) + case SUCCESS: + /* task completed, remove it */ + array_remove_at(this->passive_tasks, enumerator); +- if (!handle_collisions(this, task)) ++ if (!handle_collisions(this, task, TRUE)) + { + task->destroy(task); + } + break; + case NEED_MORE: + /* processed, but task needs another exchange */ +- if (handle_collisions(this, task)) ++ if (handle_collisions(this, task, FALSE)) + { + array_remove_at(this->passive_tasks, enumerator); + } +@@ -1029,7 +1030,7 @@ static status_t build_response(private_task_manager_t *this, message_t *request) + /* FALL */ + case DESTROY_ME: + /* destroy IKE_SA, but SEND response first */ +- if (handle_collisions(this, task)) ++ if (handle_collisions(this, task, FALSE)) + { + array_remove_at(this->passive_tasks, enumerator); + } +diff --git a/src/libcharon/sa/ikev2/tasks/child_rekey.c b/src/libcharon/sa/ikev2/tasks/child_rekey.c +index fb3ba2a..e984668 100644 +--- a/src/libcharon/sa/ikev2/tasks/child_rekey.c ++++ b/src/libcharon/sa/ikev2/tasks/child_rekey.c +@@ -403,7 +403,7 @@ METHOD(task_t, build_r, status_t, + child_sa_t *child_sa, *old_replacement; + child_sa_state_t state = CHILD_INSTALLED; + uint32_t reqid; +- bool followup_sent = FALSE; ++ bool active, followup_sent = FALSE; + + if (!this->child_sa) + { +@@ -423,7 +423,8 @@ METHOD(task_t, build_r, status_t, + message->add_notify(message, TRUE, TEMPORARY_FAILURE, chunk_empty); + return SUCCESS; + } +- if (actively_rekeying(this, &followup_sent) && followup_sent) ++ active = actively_rekeying(this, &followup_sent); ++ if (active && followup_sent) + { + DBG1(DBG_IKE, "peer initiated rekeying, but we did too and already " + "sent IKE_FOLLOWUP_KE"); +@@ -483,8 +484,9 @@ METHOD(task_t, build_r, status_t, + /* like installing the outbound SA, we only trigger the child-rekey + * event once the old SA is deleted */ + } +- else if (this->child_sa->get_state(this->child_sa) == CHILD_REKEYING) +- { /* rekeying failed, reuse old child */ ++ else if (!active && ++ this->child_sa->get_state(this->child_sa) == CHILD_REKEYING) ++ { /* rekeying failed, reuse old child, unless we are actively rekeying */ + this->child_sa->set_state(this->child_sa, state); + } + return SUCCESS; +@@ -1127,8 +1129,22 @@ METHOD(child_rekey_t, handle_delete, child_rekey_collision_t, + return CHILD_REKEY_COLLISION_NONE; + } + ++/** ++ * Clear the colliding passive task if it did not complete successfully. ++ */ ++static void clear_collision(private_child_rekey_t *this, task_t *other) ++{ ++ if (this->collision == other) ++ { ++ DBG1(DBG_IKE, "colliding passive rekeying for CHILD_SA %s{%u} " ++ "failed", this->child_sa->get_name(this->child_sa), ++ this->child_sa->get_unique_id(this->child_sa)); ++ this->collision = NULL; ++ } ++} ++ + METHOD(child_rekey_t, collide, bool, +- private_child_rekey_t *this, task_t *other) ++ private_child_rekey_t *this, task_t *other, bool done) + { + private_child_rekey_t *rekey = (private_child_rekey_t*)other; + child_sa_t *other_child; +@@ -1142,16 +1158,25 @@ METHOD(child_rekey_t, collide, bool, + other_child = rekey->child_create->get_child(rekey->child_create); + if (!other_child) + { +- /* ignore passive tasks that did not successfully create a CHILD_SA */ ++ /* ignore passive tasks that did not successfully create a CHILD_SA, ++ * if we are already tracking it in the multi-KE case, clear it */ ++ clear_collision(this, other); + return FALSE; + } + if (other_child->get_state(other_child) != CHILD_INSTALLED) + { +- DBG1(DBG_IKE, "colliding passive rekeying for CHILD_SA %s{%u} is not " +- "yet complete", this->child_sa->get_name(this->child_sa), +- this->child_sa->get_unique_id(this->child_sa)); +- /* we do reference the task to check its state later */ +- this->collision = other; ++ if (done) ++ { /* passive task failed, clear it if necessary */ ++ clear_collision(this, other); ++ } ++ else ++ { ++ DBG1(DBG_IKE, "colliding passive rekeying for CHILD_SA %s{%u} is " ++ "not yet complete", this->child_sa->get_name(this->child_sa), ++ this->child_sa->get_unique_id(this->child_sa)); ++ /* we do reference the task to check its state later */ ++ this->collision = other; ++ } + return FALSE; + } + if (this->collision && this->collision != other) +diff --git a/src/libcharon/sa/ikev2/tasks/child_rekey.h b/src/libcharon/sa/ikev2/tasks/child_rekey.h +index a8daed7..fef0bba 100644 +--- a/src/libcharon/sa/ikev2/tasks/child_rekey.h ++++ b/src/libcharon/sa/ikev2/tasks/child_rekey.h +@@ -79,10 +79,11 @@ struct child_rekey_t { + * are going on and notifies the active task by passing the passive. + * + * @param other passive task ++ * @param done passive task is done and gets destroyed if not adopted + * @return whether the task was adopted and should be removed from + * the task manager's control + */ +- bool (*collide)(child_rekey_t* this, task_t *other); ++ bool (*collide)(child_rekey_t* this, task_t *other, bool done); + }; + + /** +diff --git a/src/libcharon/sa/ikev2/tasks/ike_rekey.c b/src/libcharon/sa/ikev2/tasks/ike_rekey.c +index c7e8ffb..f275d2d 100644 +--- a/src/libcharon/sa/ikev2/tasks/ike_rekey.c ++++ b/src/libcharon/sa/ikev2/tasks/ike_rekey.c +@@ -743,8 +743,23 @@ METHOD(ike_rekey_t, did_collide, bool, + return this->collision != NULL; + } + ++/** ++ * Clear the colliding passive task if it did not complete successfully. ++ */ ++static bool clear_collision(private_ike_rekey_t *this, ++ private_ike_rekey_t *other) ++{ ++ if (this->collision == other) ++ { ++ DBG1(DBG_IKE, "colliding passive rekeying failed, ignore"); ++ this->collision = NULL; ++ return TRUE; ++ } ++ return FALSE; ++} ++ + METHOD(ike_rekey_t, collide, bool, +- private_ike_rekey_t* this, task_t *other) ++ private_ike_rekey_t* this, task_t *other, bool done) + { + DBG1(DBG_IKE, "detected %N collision with %N", task_type_names, + TASK_IKE_REKEY, task_type_names, other->get_type(other)); +@@ -760,23 +775,30 @@ METHOD(ike_rekey_t, collide, bool, + + if (!rekey->ike_init) + { +- DBG1(DBG_IKE, "colliding exchange did not result in an IKE_SA, " +- "ignore"); +- if (this->collision == rekey) ++ if (!clear_collision(this, rekey)) + { +- this->collision = NULL; ++ DBG1(DBG_IKE, "colliding exchange did not result in an " ++ "IKE_SA, ignore"); + } + break; + } +- /* we keep track of the passive exchange in any case, if not +- * complete yet, this method might be called again later */ +- this->collision = rekey; ++ /* we keep track of the passive exchange, if not complete yet, this ++ * method might be called again later */ + if (rekey->flags & IKE_REKEY_DONE) + { ++ this->collision = rekey; + this->flags |= IKE_REKEY_ADOPTED_PASSIVE; + return TRUE; + } +- DBG1(DBG_IKE, "colliding passive exchange is not yet complete"); ++ else if (done) ++ { /* passive task failed, clear it if necessary */ ++ clear_collision(this, rekey); ++ } ++ else ++ { ++ DBG1(DBG_IKE, "colliding passive exchange is not yet complete"); ++ this->collision = rekey; ++ } + break; + } + default: +diff --git a/src/libcharon/sa/ikev2/tasks/ike_rekey.h b/src/libcharon/sa/ikev2/tasks/ike_rekey.h +index 5fab349..e68fa62 100644 +--- a/src/libcharon/sa/ikev2/tasks/ike_rekey.h ++++ b/src/libcharon/sa/ikev2/tasks/ike_rekey.h +@@ -54,10 +54,11 @@ struct ike_rekey_t { + * are going on and notifies the active task by passing the passive. + * + * @param other passive task ++ * @param done passive task is done and gets destroyed if not adopted + * @return whether the task was adopted and should be removed from + * the task manager's control + */ +- bool (*collide)(ike_rekey_t* this, task_t *other); ++ bool (*collide)(ike_rekey_t* this, task_t *other, bool done); + }; + + /** +diff --git a/src/libcharon/tests/suites/test_child_rekey.c b/src/libcharon/tests/suites/test_child_rekey.c +index 1c81e75..4ef081a 100644 +--- a/src/libcharon/tests/suites/test_child_rekey.c ++++ b/src/libcharon/tests/suites/test_child_rekey.c +@@ -2546,6 +2546,141 @@ START_TEST(test_collision_delayed_response_multi_ke) + } + END_TEST + ++/** ++ * Remove the KE payload from the IKE_FOLLOWUP_KE request ++ */ ++static bool remove_ke(listener_t *listener, ike_sa_t *ike_sa, ++ message_t *message, bool incoming, bool plain) ++{ ++ if (plain && incoming && ++ message->get_exchange_type(message) == IKE_FOLLOWUP_KE && ++ message->get_request(message)) ++ { ++ enumerator_t *enumerator = message->create_payload_enumerator(message); ++ payload_t *pld; ++ ++ while (enumerator->enumerate(enumerator, &pld)) ++ { ++ if (pld->get_type(pld) == PLV2_KEY_EXCHANGE) ++ { ++ message->remove_payload_at(message, enumerator); ++ pld->destroy(pld); ++ break; ++ } ++ } ++ enumerator->destroy(enumerator); ++ free(listener); ++ return FALSE; ++ } ++ return TRUE; ++} ++ ++#define remove_ke_from_ike_followup_ke() ({ \ ++ listener_t *_ke_listener; \ ++ INIT(_ke_listener, \ ++ .message = remove_ke, \ ++ ); \ ++ exchange_test_helper->add_listener(exchange_test_helper, _ke_listener); \ ++}) ++ ++/** ++ * This simulates an incorrect behavior by the peer. It triggers a collision by ++ * not responding to the initial CREATE_CHILD_SA and then sends an invalid ++ * IKE_FOLLOWUP_KE (in this case the KE payload is missing). The initiator ++ * has to correctly track and then untrack the passive rekey task. ++ * ++ * Peer A Peer B ++ * rekey ----\ /---- rekey ++ * \-----/----> detect collision and withhold response ++ * detect collision <---------/ ++ * ----------------> ++ * handle failure <---------------- send invalid additional KE ++ * handle rekey <---------------- send withheld response ++ */ ++START_TEST(test_collision_delayed_response_multi_ke_failure) ++{ ++ ike_sa_t *a, *b; ++ message_t *msg; ++ ++ assert_track_sas_start(); ++ ++ exchange_test_helper->establish_sa(exchange_test_helper, ++ &a, &b, &multi_ke_conf); ++ ++ /* make sure the responder wins the collision so it continues */ ++ exchange_test_helper->nonce_first_byte = 0x00; ++ initiate_rekey(a, 1); ++ assert_ipsec_sas_installed(a, 1, 2); ++ exchange_test_helper->nonce_first_byte = 0xff; ++ initiate_rekey(b, 2); ++ assert_ipsec_sas_installed(b, 1, 2); ++ ++ /* these should not get called as no SA goes down or gets rekeyed */ ++ assert_hook_not_called(child_updown); ++ assert_hook_not_called(child_rekey); ++ ++ /* CREATE_CHILD_SA { N(REKEY_SA), SA, Ni, [KEi,] TSi, TSr } --> */ ++ exchange_test_helper->nonce_first_byte = 0xff; ++ exchange_test_helper->process_message(exchange_test_helper, b, NULL); ++ assert_child_sa_state(b, 2, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED); ++ assert_ipsec_sas_installed(b, 1, 2); ++ ++ /* <-- CREATE_CHILD_SA { N(REKEY_SA), SA, Ni, [KEi,] TSi, TSr } */ ++ exchange_test_helper->nonce_first_byte = 0xff; ++ exchange_test_helper->process_message(exchange_test_helper, a, NULL); ++ assert_child_sa_state(a, 1, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED); ++ assert_ipsec_sas_installed(a, 1, 2); ++ ++ /* the responder is not responding */ ++ msg = exchange_test_helper->sender->dequeue(exchange_test_helper->sender); ++ ++ /* CREATE_CHILD_SA { SA, Nr, [KEr,] TSi, TSr } --> */ ++ exchange_test_helper->process_message(exchange_test_helper, b, NULL); ++ assert_num_tasks(b, 0, TASK_QUEUE_PASSIVE); ++ assert_num_tasks(b, 1, TASK_QUEUE_ACTIVE); ++ assert_child_sa_state(b, 2, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED); ++ assert_ipsec_sas_installed(b, 1, 2); ++ ++ /* remove the KE payload in the IKE_FOLLOWUP_KE request */ ++ remove_ke_from_ike_followup_ke(); ++ ++ /* <-- IKE_FOLLOWUP_KE { N(ADD_KE) } */ ++ assert_no_payload(IN, PLV2_KEY_EXCHANGE); ++ assert_single_notify(OUT, INVALID_SYNTAX); ++ exchange_test_helper->process_message(exchange_test_helper, a, NULL); ++ assert_child_sa_state(a, 1, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED); ++ assert_ipsec_sas_installed(a, 1, 2); ++ assert_num_tasks(a, 0, TASK_QUEUE_PASSIVE); ++ ++ /* <-- CREATE_CHILD_SA { SA, Nr, [KEr,] TSi, TSr } (delayed) */ ++ exchange_test_helper->process_message(exchange_test_helper, a, msg); ++ assert_num_tasks(a, 0, TASK_QUEUE_PASSIVE); ++ assert_num_tasks(a, 1, TASK_QUEUE_ACTIVE); ++ assert_child_sa_state(a, 1, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED); ++ assert_ipsec_sas_installed(a, 1, 2); ++ ++ /* drop the STATE_NOT_FOUND error message from the initiator */ ++ msg = exchange_test_helper->sender->dequeue(exchange_test_helper->sender); ++ msg->destroy(msg); ++ ++ /* since we explicitly forced the responder to win, it already removed ++ * the passive task it won't accept the request */ ++ ++ /* IKE_FOLLOWUP_KE { KEi, N(ADD_KE) } --> */ ++ assert_payload(IN, PLV2_KEY_EXCHANGE); ++ assert_notify(IN, ADDITIONAL_KEY_EXCHANGE); ++ exchange_test_helper->process_message(exchange_test_helper, b, NULL); ++ ++ /* child_rekey/child_updown */ ++ assert_hook(); ++ assert_hook(); ++ assert_track_sas(2, 2); ++ ++ call_ikesa(a, destroy); ++ call_ikesa(b, destroy); ++} ++END_TEST ++ + /** + * In this scenario one of the peers does not notice that there is a + * rekey collision: +@@ -4436,6 +4571,7 @@ Suite *child_rekey_suite_create() + tcase_add_loop_test(tc, test_collision_delayed_response, 0, 4); + tcase_add_loop_test(tc, test_collision_delayed_response_delete, 0, 4); + tcase_add_loop_test(tc, test_collision_delayed_response_multi_ke, 0, 4); ++ tcase_add_test(tc, test_collision_delayed_response_multi_ke_failure); + tcase_add_loop_test(tc, test_collision_delayed_request, 0, 6); + tcase_add_loop_test(tc, test_collision_delayed_request_more, 0, 3); + tcase_add_loop_test(tc, test_collision_delayed_request_more_delete, 0, 3); +diff --git a/src/libcharon/tests/suites/test_ike_rekey.c b/src/libcharon/tests/suites/test_ike_rekey.c +index c6691ac..2c41022 100644 +--- a/src/libcharon/tests/suites/test_ike_rekey.c ++++ b/src/libcharon/tests/suites/test_ike_rekey.c +@@ -1784,6 +1784,152 @@ START_TEST(test_collision_delayed_response_multi_ke) + } + END_TEST + ++/** ++ * Remove the ADDITIONAL_KEY_EXCHANGE notify payload from the IKE_FOLLOWUP_KE ++ * request ++ */ ++static bool remove_notify(listener_t *listener, ike_sa_t *ike_sa, ++ message_t *message, bool incoming, bool plain) ++{ ++ if (plain && incoming && ++ message->get_exchange_type(message) == IKE_FOLLOWUP_KE && ++ message->get_request(message)) ++ { ++ enumerator_t *enumerator = message->create_payload_enumerator(message); ++ payload_t *pld; ++ ++ while (enumerator->enumerate(enumerator, &pld)) ++ { /* we only expect one notify, so just remove the first */ ++ if (pld->get_type(pld) == PLV2_NOTIFY) ++ { ++ message->remove_payload_at(message, enumerator); ++ pld->destroy(pld); ++ break; ++ } ++ } ++ enumerator->destroy(enumerator); ++ free(listener); ++ return FALSE; ++ } ++ return TRUE; ++} ++ ++#define remove_notify_from_ike_followup_ke() ({ \ ++ listener_t *_ke_listener; \ ++ INIT(_ke_listener, \ ++ .message = remove_notify, \ ++ ); \ ++ exchange_test_helper->add_listener(exchange_test_helper, _ke_listener); \ ++}) ++ ++/** ++ * This simulates an incorrect behavior by the peer. It triggers a collision by ++ * not responding to the initial CREATE_CHILD_SA and then sends an invalid ++ * IKE_FOLLOWUP_KE (in this case by removing the ADDITIONAL_KEY_EXCHANGE ++ * notify). The initiator has to correctly track and then untrack the passive ++ * rekey task. ++ * ++ * Peer A Peer B ++ * rekey ----\ /---- rekey ++ * \-----/----> detect collision and withhold response ++ * detect collision <---------/ ++ * ----------------> ++ * handle failure <---------------- send invalid additional KE ++ * handle rekey <---------------- send withheld response ++ */ ++START_TEST(test_collision_delayed_response_multi_ke_failure) ++{ ++ ike_sa_t *a, *b; ++ message_t *msg; ++ ++ assert_track_sas_start(); ++ ++ exchange_test_helper->establish_sa(exchange_test_helper, ++ &a, &b, &multi_ke_conf); ++ ++ /* these should not get called as no SA goes down or gets rekeyed */ ++ assert_hook_not_called(ike_updown); ++ assert_hook_not_called(ike_rekey); ++ assert_hook_not_called(child_updown); ++ ++ /* make sure the responder wins the collision so it continues */ ++ exchange_test_helper->nonce_first_byte = 0x00; ++ initiate_rekey(a); ++ exchange_test_helper->nonce_first_byte = 0xff; ++ initiate_rekey(b); ++ ++ /* CREATE_CHILD_SA { SA, Ni, KEi } --> */ ++ exchange_test_helper->nonce_first_byte = 0xff; ++ exchange_test_helper->process_message(exchange_test_helper, b, NULL); ++ assert_ike_sa_state(b, IKE_REKEYING); ++ assert_child_sa_count(b, 1); ++ assert_ike_sa_count(0); ++ ++ /* <-- CREATE_CHILD_SA { SA, Ni, KEi } */ ++ exchange_test_helper->nonce_first_byte = 0xff; ++ exchange_test_helper->process_message(exchange_test_helper, a, NULL); ++ assert_ike_sa_state(a, IKE_REKEYING); ++ assert_child_sa_count(a, 1); ++ assert_ike_sa_count(0); ++ ++ /* the responder is not responding */ ++ msg = exchange_test_helper->sender->dequeue(exchange_test_helper->sender); ++ ++ /* simplify next steps by checking in original IKE_SAs */ ++ charon->ike_sa_manager->checkin(charon->ike_sa_manager, a); ++ charon->ike_sa_manager->checkin(charon->ike_sa_manager, b); ++ assert_ike_sa_count(2); ++ ++ /* CREATE_CHILD_SA { SA, Nr, KEr, N(ADD_KE) } --> */ ++ assert_notify(IN, ADDITIONAL_KEY_EXCHANGE); ++ exchange_test_helper->process_message(exchange_test_helper, b, NULL); ++ assert_num_tasks(b, 0, TASK_QUEUE_PASSIVE); ++ assert_num_tasks(b, 1, TASK_QUEUE_ACTIVE); ++ assert_ike_sa_state(b, IKE_REKEYING); ++ assert_ike_sa_count(2); ++ ++ /* remove the ADD_KE notify from the IKE_FOLLOWUP_KE request */ ++ remove_notify_from_ike_followup_ke(); ++ ++ /* <-- IKE_FOLLOWUP_KE { KEi } */ ++ assert_payload(IN, PLV2_KEY_EXCHANGE); ++ assert_no_notify(IN, ADDITIONAL_KEY_EXCHANGE); ++ assert_single_notify(OUT, STATE_NOT_FOUND); ++ exchange_test_helper->process_message(exchange_test_helper, a, NULL); ++ assert_ike_sa_state(a, IKE_REKEYING); ++ assert_child_sa_count(a, 1); ++ assert_ike_sa_count(2); ++ ++ /* <-- CREATE_CHILD_SA { SA, Nr, KEr } (delayed) */ ++ exchange_test_helper->process_message(exchange_test_helper, a, msg); ++ assert_num_tasks(a, 0, TASK_QUEUE_PASSIVE); ++ assert_num_tasks(a, 1, TASK_QUEUE_ACTIVE); ++ assert_ike_sa_state(a, IKE_REKEYING); ++ assert_child_sa_count(a, 1); ++ assert_ike_sa_count(2); ++ ++ /* drop the STATE_NOT_FOUND error message from the initiator */ ++ msg = exchange_test_helper->sender->dequeue(exchange_test_helper->sender); ++ msg->destroy(msg); ++ ++ /* since we explicitly forced the responder to win, it already removed ++ * the passive task it won't accept the request */ ++ ++ /* IKE_FOLLOWUP_KE { KEi, N(ADD_KE) } --> */ ++ assert_payload(IN, PLV2_KEY_EXCHANGE); ++ assert_notify(IN, ADDITIONAL_KEY_EXCHANGE); ++ exchange_test_helper->process_message(exchange_test_helper, b, NULL); ++ ++ /* ike_updown/rekey/child_updown */ ++ assert_hook(); ++ assert_hook(); ++ assert_hook(); ++ assert_track_sas(2, 2); ++ ++ charon->ike_sa_manager->flush(charon->ike_sa_manager); ++} ++END_TEST ++ + /** + * In this scenario one of the peers does not notice that there is a rekey + * collision because the other request is dropped: +@@ -2590,6 +2736,7 @@ Suite *ike_rekey_suite_create() + tcase_add_loop_test(tc, test_collision_ke_invalid_delayed_retry, 0, 3); + tcase_add_loop_test(tc, test_collision_delayed_response, 0, 4); + tcase_add_loop_test(tc, test_collision_delayed_response_multi_ke, 0, 4); ++ tcase_add_test(tc, test_collision_delayed_response_multi_ke_failure); + tcase_add_loop_test(tc, test_collision_dropped_request, 0, 3); + tcase_add_loop_test(tc, test_collision_delayed_request, 0, 3); + tcase_add_loop_test(tc, test_collision_delayed_request_and_delete, 0, 3); diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index 5a7a12d903..bd3191d35d 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -14,6 +14,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78126.patch \ file://CVE-2026-78127.patch \ file://CVE-2026-78129.patch \ + file://CVE-2026-78133.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Tue Oct 13 09:58:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100575 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55E4DCC6B0F for ; Tue, 13 Oct 2026 09:59:58 +0000 (UTC) Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3523.1791885595570286027 for ; Tue, 13 Oct 2026 02:59:55 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=HCo3WWbr; spf=pass (domain: gmail.com, ip: 209.85.216.48, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-3a4b3ac8fb7so1152088a91.0 for ; Tue, 13 Oct 2026 02:59:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885595; x=1792490395; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=QWEYDV99Zj+PR0BNtmTW2g3aHPvohqUOT6ScDs+PuZE=; b=HCo3WWbrSwhl9atC4C3/LVpGF1/eytJvJnnuacoT7I1VyISvqNGyIr+01llwHnRkp/ wO16+Szy6PwzDvlL7YbGY772NnXCaEnCXfRTLfMvUF7OsQ9AhN678mV/z+q2/5xaUOkV tPaD2ZphT/BCaFlAGkqmhkpBCmBySjzLyYbUTG2IfoCsSYiao9uZLgFZ6dizqbkKhOL4 Hsz7WhVTHR+WFPRQBm8ilxSVz0ektkYCyNDGhOXfXmLTOAbcWfERY3mKDuVtqcjBWzGK Px2/j8K4ttaUoiLE3SMyhyROw3dq68cBAqj2ptYnKn2pwzwWHMgTX32T2TkLrkbTGLBv D4DA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885595; x=1792490395; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=QWEYDV99Zj+PR0BNtmTW2g3aHPvohqUOT6ScDs+PuZE=; b=ooMq919uB6x4FKgbLwd3YUgg2LPImIj0/+K+C6M5NTygf3lc/Pz0X4xqcdIy4AlRuJ pDGI+XDAklyjEYt0wuBGPO/qxpCH7zMOqI4K8Djh5lMplctJkG8wDWrjUvzTkYJax3is D9yY+c83+AL9sTiimuj9mykisFvRRBdbhvfXdT+iZH+PnR80+DsE8UfXxjG1VFYg05N3 JbgHK2iJuqs5+QXvNYpN4caN0l8H5/ods/LQJPktla3Gm/yPfNER8XwVrh3hyQmP56aD lq1reeH8TECo8oW0IUI/W2q9t2z80VZFc8C6fGkxuWxE7ZFg3iQHbdht37p+MwqwsyxN XT/w== X-Gm-Message-State: AFq9FYL5ldKOpG/3lpKfyhwtpXoYPTPtkLacvEYuqH95UDgfPtMrI1fK pHF1ihWO7KSyJT3Y6qUYcpg1ViizQwAkA389k688Dz6VBobaJq2CPUpPpDiXHQ== X-Gm-Gg: AYBFou1E5FkxRV0Cu7XM3whxLOEd5rxZMwOXsBjY+qLNhCdJ/VBlG/yXL18qxzDLW+D ioIE2NSo9DWBjQbhci9p5fIJw3r2DixyGYA6SjeofvKg2zvMDzE1D6bFgaZCPO3GFt/mhSW/fUp jB24I7l4WTV6O4TuT7BEdFBDXS/GP+lIjPtDPJj2hhsXB3HOwYamkuMMPoRAnCPMbD1/5pvuxb9 zWCCBa7bnzUT2+ct0Bihs+eQAlBODVzgMkKxaqZnsNFeOAscI1m3ChNbr5e0vOvvkK0d6uP3nQ1 MgSdADNHF03U/SrmbTyz/NvYG6ON6ecjs8Yj0gqLyfXzvgJCEPOfd4gHrQnue6IeJaOuAihUv7L 1CCpm8WYSql4bXgVUeICJjqhoAqw5Mrb1eYaTy8GwbDVVtOP6pH/P73cGslrowxFlOkiX/1C9Hn FkS1ojbfkT3XmgzpWBHgnc8Go1ChQJF1PZEZiavdR2182WrdvE7SFSSTyTrlljxB5yimxodnn/C sSbdlg94Fj2mJNTL1p2sYo9tWgFRKMT3BLePsUf3CERXdDO0g== X-Received: by 2002:a17:90b:164b:b0:39e:6c69:34da with SMTP id 98e67ed59e1d1-3ab3a91169cmr9968860a91.62.1791885594944; Tue, 13 Oct 2026 02:59:54 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.02.59.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 02:59:54 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 16/28] strongswan: patch CVE-2026-78131 Date: Tue, 13 Oct 2026 22:58:51 +1300 Message-ID: <20261013095903.3544906-16-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 09:59:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130849 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78131 [1]https://download.strongswan.org/security/CVE-2026-78131/strongswan-5.5.3-6.0.7_x509_ac_leaks.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78131).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 41cb8cca46d3f97981245f2213942d2006df121f) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78131.patch | 86 +++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 87 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78131.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78131.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78131.patch new file mode 100644 index 0000000000..da53f8e5a0 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78131.patch @@ -0,0 +1,86 @@ +From d1d29ac675b42a8c4a6454db84803bfecf5a0d99 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Fri, 12 Jun 2026 15:55:43 +0200 +Subject: [PATCH] x509: Fix memory leaks when parsing attribute certificates + +This can be triggered by an attribute certificate with lots of GeneralName +entries or AuthorityKeyIdentifier extensions. There is no verification +before the certificate is parsed. + +Fixes: 3134379ac7f1 ("x509: Fix some whitespaces and do some minor style cleanups in acert") +Fixes: 26930a8c3e42 ("certificate factory can load certs from file") +Fixes: CVE-2026-78131 + +CVE: CVE-2026-78131 +Upstream-Status: Backport [1][2] + +[1]https://github.com/strongswan/strongswan/commit/23c9b9a2708e4958292d828424523fa63c0be829 +[2]https://github.com/strongswan/strongswan/commit/9762cc3b091b423543510113a5d05215daf16951 + +Signed-off-by: Ankur Tyagi +--- + src/libstrongswan/plugins/x509/x509_ac.c | 33 +++++++----------------- + 1 file changed, 9 insertions(+), 24 deletions(-) + +diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c +index 3fc5de2..68b7cf9 100644 +--- a/src/libstrongswan/plugins/x509/x509_ac.c ++++ b/src/libstrongswan/plugins/x509/x509_ac.c +@@ -186,41 +186,25 @@ extern bool x509_parse_generalNames(chunk_t blob, int level0, bool implicit, + static bool parse_directoryName(chunk_t blob, int level, bool implicit, + identification_t **name) + { +- identification_t *directoryName; +- enumerator_t *enumerator; +- bool first = TRUE; + linked_list_t *list; + + list = linked_list_create(); + if (!x509_parse_generalNames(blob, level, implicit, list)) + { +- list->destroy(list); ++ list->destroy_offset(list, offsetof(identification_t, destroy)); + return FALSE; + } +- +- enumerator = list->create_enumerator(list); +- while (enumerator->enumerate(enumerator, &directoryName)) +- { +- if (first) +- { +- *name = directoryName; +- first = FALSE; +- } +- else +- { +- DBG1(DBG_ASN, "more than one directory name - first selected"); +- directoryName->destroy(directoryName); +- break; +- } +- } +- enumerator->destroy(enumerator); +- list->destroy(list); +- +- if (first) ++ if (list->remove_first(list, (void**)name) != SUCCESS) + { + DBG1(DBG_ASN, "no directoryName found"); ++ list->destroy(list); + return FALSE; + } ++ if (list->get_count(list)) ++ { ++ DBG1(DBG_ASN, "more than one directory name - first selected"); ++ } ++ list->destroy_offset(list, offsetof(identification_t, destroy)); + return TRUE; + } + +@@ -539,6 +523,7 @@ static bool parse_certificate(private_x509_ac_t *this) + DBG2(DBG_ASN, " need to parse crlDistributionPoints"); + break; + case OID_AUTHORITY_KEY_ID: ++ chunk_free(&this->authKeyIdentifier); + this->authKeyIdentifier = + x509_parse_authorityKeyIdentifier(object, + level, &this->authKeySerialNumber); diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index bd3191d35d..af687f5e4d 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -15,6 +15,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78127.patch \ file://CVE-2026-78129.patch \ file://CVE-2026-78133.patch \ + file://CVE-2026-78131.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Tue Oct 13 09:58:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100578 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7CB20CC6B03 for ; Tue, 13 Oct 2026 10:00:08 +0000 (UTC) Received: from mail-pg1-f182.google.com (mail-pg1-f182.google.com [209.85.215.182]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3433.1791885598505396640 for ; Tue, 13 Oct 2026 02:59:58 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=nIShymgv; spf=pass (domain: gmail.com, ip: 209.85.215.182, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f182.google.com with SMTP id 41be03b00d2f7-ccc6b11a19aso994393a12.0 for ; Tue, 13 Oct 2026 02:59:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885598; x=1792490398; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=q3bjbu3SYHQnOKZUSQVvueM5tc9yw5nav+41CQmL1xA=; b=nIShymgv0bK430OQv8AOg/GKk5CmfF2iPFN/gnW1/Z0GF3Kp5JilPA9iNsUJsoF9Sd i27naSB6HOk9G5tCcxrjvye89Vn1YOVfS/VCbd/8/Bs2SUDKRVEy/70aTvD42yyOFFsm M0xYYqFCjLODaaYi9AlfUqXbRUfytXi112jahPzScu5xa1r2mnLyqq5e3AaoIcaGEmca RxxM/T0+rjEs951UQC5rkQopuYWWhSYr22W4dZwPgE+mugiJd38QK5E9ZJoS4haLRhjw SPluDcBwUp4ygVz0R5r987hQc667mmDVlldUzZgsjN2irorJaRYgWS9DcvL1PSZ8GF5z 2omA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885598; x=1792490398; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=q3bjbu3SYHQnOKZUSQVvueM5tc9yw5nav+41CQmL1xA=; b=w6eRKXEwgC5zi1XMaH0ZeuddJq/UZ8qE2bPvKRzP5NbNAG723oG40jE6mg2F4wJP1y c6ZDLiJvSoCzH7AZ/gztwWrL1Qv2m+sTc8qZdLwlOHo+/k066n73dQGNh+irO2EcKWsE wU6w2SGJ9GQyTp/UoPnYMMRiYzNokOF/h2GP/EWHS0x8pCm+fwFQkYM7ra6F5WdG2GCr c715WnoWcZbtcAOvfZvLN3g7IglKz1SYYNHtga1vp78SwfGtpFZCB9oKMZn+w9hd6ZkR koMmHbaXrQq0L1cfI6MuOErgFz+ohlN43zd6uQsAunRgij6QcMsmdk+6vhBTay6ggT8W Vjig== X-Gm-Message-State: AFq9FYLQTt06DrRXST8j0xuWbwaGjJ9+HdLstbPyDpNU9/oUsj4m8nUJ dSLwxSYJcCp+oJVL6dlaocxNs83XUlyngAD6YR4jr5g0ccPeLHKN+oFaVAUgZA== X-Gm-Gg: AYBFou2LAbwrf8JLTETT/OnQ+2/tQ+EcM1kvlXroHLbrLil0zvid4Vf5yU8bBgOlLto M4sCB1Ueep74g+n+WqiPzotTabsJLmV6+hPyAKM6Y3UkmoRHl4+ylLY0ZYPa48z9WhYKiorWy92 k48yIftKLznEr6fx7ERPvslGbKS1ah1Mg9mO1EK81UD1XYG+p2OZysnPBrPXwgP9iJtkFEhAv6v Ft1zdxUn1NyX/442uy/BQGkCSxzHola/hdEMqnXfTCWiJJW9WBjEhwhwOUWQZB6e36AlzVjupcb iQW0okWwCiZzhzG9d/pRvwm4z4zGY/rJU2HBwKNmwa4Q++pPuXoRY0fxe1RbGh9IyFz7LXJmrd0 +v/cSkmYaKdT69jO0AG84jXDImh9iFcNPCp/7wGWL5on6Sr1GxIo7M1701/0kUOlQkAzH/YeA5M 7TB4Hr/97IXPQAOV+W7vwID5zORjj2DI9+KdNTBYbq85C4T5fAxzlCTQ8kH4biINHbWd9oRsv0v RlwoXrlDhv3j324pQPRGvOVUI9Mqgr+kWIGgak= X-Received: by 2002:a17:90b:1dd1:b0:3a8:f70f:1cb8 with SMTP id 98e67ed59e1d1-3ab3aceb97dmr8798077a91.44.1791885597827; Tue, 13 Oct 2026 02:59:57 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.02.59.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 02:59:57 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 17/28] strongswan: patch CVE-2026-78130 Date: Tue, 13 Oct 2026 22:58:52 +1300 Message-ID: <20261013095903.3544906-17-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 10:00:08 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130850 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78130 [1]https://download.strongswan.org/security/CVE-2026-78130/strongswan-5.1.3-6.0.7_x509_ac_issuer_null.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78130).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit d831ff4ac956483745e6df0fe9a4f6fe055440f8) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78130.patch | 49 +++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 50 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch new file mode 100644 index 0000000000..8fe5c7f278 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch @@ -0,0 +1,49 @@ +From 254d971bbe7479fe5fffc34cd1dd1e349a48e7aa Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Fri, 19 Jun 2026 11:57:48 +0200 +Subject: [PATCH] x509: Avoid NULL-pointer dereference if issuerName is missing + in attribute certificate + +If neither authoritiyKeyIdentifier nor issuerName are encoded in an +attribute certificate, the validation in `acert_validator.c:verify()` +will cause a NULL-pointer dereference via `issued_by()` (the lookup +with NULL identity will enumerate all trusted certificates). + +Fixes: 26930a8c3e42 ("certificate factory can load certs from file") +Fixes: CVE-2026-78130 + +CVE: CVE-2026-78130 +Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/bee6ce27761e1f38958be36ebe6688ef963c3d22] + +Signed-off-by: Ankur Tyagi +--- + src/libstrongswan/plugins/x509/x509_ac.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c +index 68b7cf9..11a847e 100644 +--- a/src/libstrongswan/plugins/x509/x509_ac.c ++++ b/src/libstrongswan/plugins/x509/x509_ac.c +@@ -898,7 +898,11 @@ METHOD(certificate_t, has_issuer, id_match_t, + { + return ID_MATCH_PERFECT; + } +- return this->issuerName->matches(this->issuerName, issuer); ++ if (this->issuerName) ++ { ++ return this->issuerName->matches(this->issuerName, issuer); ++ } ++ return ID_MATCH_NONE; + } + + METHOD(certificate_t, issued_by, bool, +@@ -935,7 +939,8 @@ METHOD(certificate_t, issued_by, bool, + } + else + { +- if (!this->issuerName->equals(this->issuerName, ++ if (!this->issuerName || ++ !this->issuerName->equals(this->issuerName, + issuer->get_subject(issuer))) + { + return FALSE; diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index af687f5e4d..4f6a5d2ae7 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -16,6 +16,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78129.patch \ file://CVE-2026-78133.patch \ file://CVE-2026-78131.patch \ + file://CVE-2026-78130.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Tue Oct 13 09:58:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100579 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 94746CC6B08 for ; Tue, 13 Oct 2026 10:00:08 +0000 (UTC) Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3525.1791885601239495571 for ; Tue, 13 Oct 2026 03:00:01 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=l+mr3Tl9; spf=pass (domain: gmail.com, ip: 209.85.216.44, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-3a80d1c98f5so1570049a91.0 for ; Tue, 13 Oct 2026 03:00:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885601; x=1792490401; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=MzhOadSLXEjkCZQf8kF0CiKxu747zV1HS66bc/YW6YM=; b=l+mr3Tl961hXhXqZw1yi0jfTkX++sUd9zG346LOyQZABRpB4H0h/KsA5lem8SVKQx1 ZkgzzIaASqYGxdU8gv3p/JLkwBwia39aDG1l9TrB8olw8Oyi9d2H5gu+v4269p6wrHfp DhlTQL2eE9TCPr3RirVcYpWH+NjKapVazdGXYntHjjnm+Mb59flKhWjGD2wtTVa/7urG +IqxkZH7yrp9+0I4mMn5m2lVAQ8PkXZpEbsfXTMH/Z7ed4ljL+Lfa2J7bGlc/8f/aI3x Xjt7L26u50LYUE/KC2Tw1hOnSrsqrjmZFBTGH24sbDeQx+2YAiLoVB++nqAKh8XStBHl 97mA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885601; x=1792490401; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=MzhOadSLXEjkCZQf8kF0CiKxu747zV1HS66bc/YW6YM=; b=nKAWow0iysSmp5IRPnUlaU8Lt1Ub/Ta8nuaMCFDIW8IwuSyghqVdD5vUbgUgNCngb0 bt88bgZBPBro+H0MIjRSji5ZD1VNBjlGXOz1cklmPL+Q2OelIf896WMddTaCJY1vKLfr zT//4fF/6WFQfBxXPSPAUpctCh/NILnkZSyrEBNV2vZuw7kUR51i1kKHUWLj+e0RGzPv BS1KqraL5qsoYTx3Mn2POr2QVBmjpO7fPqbUbi/ScJ6Tujyk0RRD2YePDlEyw5PbEa/R 6lMs8gQchnwZsEeJmoHB3S8pAVsgx9F5doWnhenO752k0bGDpEQr1L9LUnWRAVSGTsIY DVOg== X-Gm-Message-State: AFq9FYLud5uTU+hfMSIWL2Wkm6DigEUEqt/1wvCmBPD3/GtsIXlrW5VC O/DbQ/EGrzXudxgkSjCK6o8Ff3q8rDrbZwbNnK+MAu/qr3cWg8q9uIOgmG3GbQ== X-Gm-Gg: AYBFou3h3ubtcfkl+YpXp+pU9GIF0TbSzp3Sl0/zPRj0s2qv3oVBXJ4K3OHR2Xgf+kP irm9vlhCFkyugnbteOpnENWRN/FHA7pSKIawirD3RmpeEIzU6miw6g+gQNVEA9PCtLURn1LrcYD bO7/IcBYi4Xx1ooR4wc1T6dtu8RQ3Rb7SpikmuuFh3mrTzHhHomBUKeouuuDCg89NGcM9JrozHV Ztopp6AiTvujt2Re2sOuX7x6dC9tVZoYd4BEiIhoGwdZZmKVYAISF+YSMRkaZHfD7e6KOuLva5T J3PgeEohKiwCvmoZlNVcwKOR3/eE2HF2xF0LuIGE3UJ9bf7YfJ/pFrSlRaHr39EozZ5AguXgLZT w1TRpaLXyahiz4tqhEaNyWLX8r9ZcLHF9ADRAR0Aky+QA8LjyVT54mcWVbdyoak0jv1WCTgp8Rf BsVAzh9aEP3/4qN/srlL40PsRJw28bVONqeJYLxo4lV9sIUfW34G4woDXqU2wsJAagqjjcWF45G GhWI8QnngEu74jv9Gm6hq8yJmQN9BHh6ZewILI= X-Received: by 2002:a17:90b:4b92:b0:3a5:3f7:271 with SMTP id 98e67ed59e1d1-3ab3ac9b31bmr9272067a91.58.1791885600394; Tue, 13 Oct 2026 03:00:00 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.02.59.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 03:00:00 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 18/28] strongswan: patch CVE-2026-78132 Date: Tue, 13 Oct 2026 22:58:53 +1300 Message-ID: <20261013095903.3544906-18-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 10:00:08 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130851 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78132 [1]https://download.strongswan.org/security/CVE-2026-78132/strongswan-5.1.3-6.0.7_x509_ac_ietfattr_loop.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78132).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit dd3053a1a3806a37d1297e726d3eababfb539f8e) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78132.patch | 75 +++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 76 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78132.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78132.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78132.patch new file mode 100644 index 0000000000..f3ddd5b61a --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78132.patch @@ -0,0 +1,75 @@ +From d8144c609148eda1ca55eac2ecddcd81bbd799b5 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Wed, 1 Jul 2026 16:24:23 +0200 +Subject: [PATCH] x509: Prevent infinite loop when parsing ietfAttrSyntax in + attribute certificates + +This is the same issue that was fixed with 407fcca200fd ("asn1-parser: +Fix CHOICE parsing") for other CHOICE elements. This one was missed and +can be triggered pre-auth by sending an attribute certificate to a peer. +Since it's parsed before verifying it, the certificate doesn't have to +be valid. + +For versions older than 5.5.3, this patch requires prior application of +the fix for CVE-2017-9023, which introduced proper CHOICE handling in +the ASN.1 parser. + +Fixes: a17598bc6992 ("x509: Integrate IETF attribute handling, and obsolete ietf_attributes_t") +Fixes: CVE-2026-78132 + +CVE: CVE-2026-78132 +Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/86bf2cbf5d9941b7ef16a1b25f0baf5589e0b64e] + +Signed-off-by: Ankur Tyagi +--- + src/libstrongswan/plugins/x509/x509_ac.c | 36 +++++++++++------------- + 1 file changed, 17 insertions(+), 19 deletions(-) + +diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c +index 11a847e..46c1f58 100644 +--- a/src/libstrongswan/plugins/x509/x509_ac.c ++++ b/src/libstrongswan/plugins/x509/x509_ac.c +@@ -249,26 +249,24 @@ static void parse_roleSyntax(chunk_t blob, int level0) + */ + static const asn1Object_t ietfAttrSyntaxObjects[] = + { +- { 0, "ietfAttrSyntax", ASN1_SEQUENCE, ASN1_NONE }, /* 0 */ +- { 1, "policyAuthority", ASN1_CONTEXT_C_0, ASN1_OPT | +- ASN1_BODY }, /* 1 */ +- { 1, "end opt", ASN1_EOC, ASN1_END }, /* 2 */ +- { 1, "values", ASN1_SEQUENCE, ASN1_LOOP }, /* 3 */ +- { 2, "octets", ASN1_OCTET_STRING, ASN1_OPT | +- ASN1_BODY }, /* 4 */ +- { 2, "end choice", ASN1_EOC, ASN1_END }, /* 5 */ +- { 2, "oid", ASN1_OID, ASN1_OPT | +- ASN1_BODY }, /* 6 */ +- { 2, "end choice", ASN1_EOC, ASN1_END }, /* 7 */ +- { 2, "string", ASN1_UTF8STRING, ASN1_OPT | +- ASN1_BODY }, /* 8 */ +- { 2, "end choice", ASN1_EOC, ASN1_END }, /* 9 */ +- { 1, "end loop", ASN1_EOC, ASN1_END }, /* 10 */ +- { 0, "exit", ASN1_EOC, ASN1_EXIT } ++ { 0, "ietfAttrSyntax", ASN1_SEQUENCE, ASN1_NONE }, /* 0 */ ++ { 1, "policyAuthority", ASN1_CONTEXT_C_0, ASN1_OPT|ASN1_BODY }, /* 1 */ ++ { 1, "end opt", ASN1_EOC, ASN1_END }, /* 2 */ ++ { 1, "values", ASN1_SEQUENCE, ASN1_LOOP }, /* 3 */ ++ { 2, "value choice", ASN1_EOC, ASN1_CHOICE }, /* 4 */ ++ { 3, "octets", ASN1_OCTET_STRING, ASN1_OPT|ASN1_BODY }, /* 5 */ ++ { 3, "end choice", ASN1_EOC, ASN1_END|ASN1_CH }, /* 6 */ ++ { 3, "oid", ASN1_OID, ASN1_OPT|ASN1_BODY }, /* 7 */ ++ { 3, "end choice", ASN1_EOC, ASN1_END|ASN1_CH }, /* 8 */ ++ { 3, "string", ASN1_UTF8STRING, ASN1_OPT|ASN1_BODY }, /* 9 */ ++ { 3, "end choice", ASN1_EOC, ASN1_END|ASN1_CH }, /* 10 */ ++ { 2, "end choices", ASN1_EOC, ASN1_END|ASN1_CHOICE }, /* 11 */ ++ { 1, "end loop", ASN1_EOC, ASN1_END }, /* 12 */ ++ { 0, "exit", ASN1_EOC, ASN1_EXIT } + }; +-#define IETF_ATTR_OCTETS 4 +-#define IETF_ATTR_OID 6 +-#define IETF_ATTR_STRING 8 ++#define IETF_ATTR_OCTETS 5 ++#define IETF_ATTR_OID 7 ++#define IETF_ATTR_STRING 9 + + /** + * Parse group memberships, IETF attributes diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index 4f6a5d2ae7..b070ecf862 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -17,6 +17,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78133.patch \ file://CVE-2026-78131.patch \ file://CVE-2026-78130.patch \ + file://CVE-2026-78132.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Tue Oct 13 09:58:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100580 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3954CC6B13 for ; Tue, 13 Oct 2026 10:00:08 +0000 (UTC) Received: from mail-pg1-f175.google.com (mail-pg1-f175.google.com [209.85.215.175]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3526.1791885604234374801 for ; Tue, 13 Oct 2026 03:00:04 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=oRGBSmCL; spf=pass (domain: gmail.com, ip: 209.85.215.175, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f175.google.com with SMTP id 41be03b00d2f7-cc4b62d118aso1654656a12.2 for ; Tue, 13 Oct 2026 03:00:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885604; x=1792490404; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=YzDN2WXDjx/KHUzHrIsOFlDnmDHdBZPoZDvkvHLMd3o=; b=oRGBSmCLKyh2alNkonCmgPX/Xq9yTILUajOn0MChM2xwzBHE6H05niDZvnnftONSoa x85UejWzsQtMZ+LvZIibDJCfrYwPJ6QtjYwnS76G9G10yse4K1qoJyJ6ySnSqGM6J2hX b0oReiS44kHCmgTYDcnSuGbobBJCHb8fcFGmGClnRHMxtD1W8UxnCN1mGYCrKn8JSCid 9CHKQL9DXVkuYNYdCedYZ59jZkSfHcUkSBSMdUizjoWwD2hAN9Rzc4B5cSHm1ARYw6it irGa63pnqK+QyGIHQGzLLaC0i+eTeXGtT5TgvvbQkbckmzAEeSKtX7dUKM6aJkNdhLOZ AJyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885604; x=1792490404; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=YzDN2WXDjx/KHUzHrIsOFlDnmDHdBZPoZDvkvHLMd3o=; b=ddedBzihGCDMHxWqXzSG7sNfxbJ/ys34sPW6H5i73GYoJo/mreokUkG8ORlvXEZw4o GWYfYjtWLUOGrNZQE+CBA/xHka93VCsOk0XM/Qdw8yiRFMPb1uOrpJK2V9+eYdDrZ22I +/ZV5enrsiKZdzY7YpGCo5Ep4csdxHZE+LQfbWX+t2cNdOcthET5I+EE5cBvvQCXczlp m40GlfzgmuTGX3XPLYPOd64L8mROa1ZY53HEUYKnoZWQXSMzNac1gHc8bXibS38lUrJJ fjhJQM9pS/4nG9qSy/Yy66YqJ6iLv2PMQlwF/s8R1LDu4vjSCKyacrPG691W853ZxZmu f/Fw== X-Gm-Message-State: AFq9FYKkbpq1fJQJU0mlmqrex3hCbeTFkGyVWN+88jH5kAn4NvnW9RGK PC4zFnT1iGAAQtaSXdgMkzns9TWbi+4PNd0jDnWAOzfVYOQEDfikeqqSRb5giA== X-Gm-Gg: AYBFou0OsMHNKBjhk8adbNW8SQDQ+BrIgovJTc6xGdy3dwnv2KGXDll3saRPmUJ7vPQ Aw3YMUB1YZx7p6BBsQggMsuOIORuq92rEHQQN+i24QayY1Unl2uO48fP+9qRbQi1n8BSeI5/nvm zYEGKpZ7NaDtYzXC5JaQpreLkt90vFXhoCVMnsBelfpoGQIyOBzQMJrfyPB3voVUM9OrnTkv6t/ gpT4ZiprWUh8iYibEZZ/lQYIS9zAOZAcp5/7kmfas+MrKy21WGK3ITjR/HR+CX4GhpE25sumDVN eHfirN8T2w9CN88QdQkSWFOu3ybzzL3NG7BHU6uis3ido0GtsZRCi/RQuGtLB+Vnu+w3rhyQzv2 2GkNPSsdBSp4+z+vFFvd6WP++Afj72j5rILtU6v4cERB986j1JYkdu/G5499N5+RxswOzc8LxZT l3O6BFnpQwYtnmVB/VU48aiL47qcENiFuRTAaG+bZ1oGEbSKq0YJKZOVLpvLaqS3WuEvXz/fqL1 hNaTjK9w7PEv5SHfQgyFb6qK8z51yn6ws0ZduU= X-Received: by 2002:a17:90a:a8f:b0:3ab:413:49af with SMTP id 98e67ed59e1d1-3ab3a92850dmr7837326a91.49.1791885603540; Tue, 13 Oct 2026 03:00:03 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.03.00.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 03:00:03 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 19/28] strongswan: patch CVE-2026-78135 Date: Tue, 13 Oct 2026 22:58:54 +1300 Message-ID: <20261013095903.3544906-19-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 10:00:08 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130852 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78135 [1]https://download.strongswan.org/security/CVE-2026-78135/strongswan-5.9.7-6.0.7_early_create_child_sa.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78135).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 9b02fe48505f14e351e473e246d971d64eb84ad0) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78135.patch | 72 +++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 73 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78135.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78135.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78135.patch new file mode 100644 index 0000000000..1b6c472b30 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78135.patch @@ -0,0 +1,72 @@ +From 2c3d63bd7a05f88d25354dfe7805a5a6e474a699 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Mon, 27 Jul 2026 08:53:50 +0200 +Subject: [PATCH] ikev2: Properly reject CREATE_CHILD_SA requests on + unestablished IKE_SAs + +The previous check was not actually enforced as long as there were still +tasks in the passive queue (it was originally added to fix an issue on +initiators, so the passive queue was expected to be empty). This allowed +an unauthenticated attacker to potentially establish a usable Child SA +if certain preconditions were met. + +First, it required that the initiator is authenticated with EAP so the +authentication and the creation of the first Child SA is deferred. +Second, the responder must either not configure an IP address pool or +an explicit remote TS, otherwise, traffic selector negotiation fails. + +Note that the half-open IKE SA and the installed IPsec SA will be removed +after the default timeout of 30 seconds. + +Fixes: 8503077175cd ("ikev2: Reject CREATE_CHILD_SA exchange on unestablished IKE_SAs") +Fixes: c60c7694d2d8 ("merged tasking branch into trunk") +Fixes: CVE-2026-78135 + +CVE: CVE-2026-78135 +Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/4dcb132266a954202509a3b4b3be99378f3e3b4d] + +Signed-off-by: Ankur Tyagi +--- + src/libcharon/sa/ikev2/task_manager_v2.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c +index 5a19ce8..f9e9ab9 100644 +--- a/src/libcharon/sa/ikev2/task_manager_v2.c ++++ b/src/libcharon/sa/ikev2/task_manager_v2.c +@@ -1134,9 +1134,18 @@ static status_t process_request(private_task_manager_t *this, + delete_payload_t *delete; + ike_sa_state_t state; + ++ state = this->ike_sa->get_state(this->ike_sa); ++ if (message->get_exchange_type(message) == CREATE_CHILD_SA && ++ (state == IKE_CREATED || state == IKE_CONNECTING)) ++ { ++ DBG1(DBG_IKE, "received CREATE_CHILD_SA request for " ++ "unestablished IKE_SA, rejected"); ++ return FAILED; ++ } ++ ++ /* create tasks depending on request type, if not already some queued */ + if (array_count(this->passive_tasks) == 0) +- { /* create tasks depending on request type, if not already some queued */ +- state = this->ike_sa->get_state(this->ike_sa); ++ { + switch (message->get_exchange_type(message)) + { + case IKE_SA_INIT: +@@ -1177,14 +1186,6 @@ static status_t process_request(private_task_manager_t *this, + { /* FIXME: we should prevent this on mediation connections */ + bool notify_found = FALSE, ts_found = FALSE; + +- if (state == IKE_CREATED || +- state == IKE_CONNECTING) +- { +- DBG1(DBG_IKE, "received CREATE_CHILD_SA request for " +- "unestablished IKE_SA, rejected"); +- return FAILED; +- } +- + enumerator = message->create_payload_enumerator(message); + while (enumerator->enumerate(enumerator, &payload)) + { diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index b070ecf862..df0333b458 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -18,6 +18,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78131.patch \ file://CVE-2026-78130.patch \ file://CVE-2026-78132.patch \ + file://CVE-2026-78135.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Tue Oct 13 09:58:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100582 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C16F3CC6B0F for ; Tue, 13 Oct 2026 10:00:18 +0000 (UTC) Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3530.1791885609103225076 for ; Tue, 13 Oct 2026 03:00:09 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=R4Ob92GE; spf=pass (domain: gmail.com, ip: 209.85.216.46, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-383b4a3755fso1758816a91.3 for ; Tue, 13 Oct 2026 03:00:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885608; x=1792490408; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=lDzfUb7EUQSzzFg19JafujucagwpaQT3G62qx3at3mU=; b=R4Ob92GENwSNRybGUse40NYgMSEbc4fvtl3IMFP9WGnqkr3pNsv4uZxOzjilEd9fSZ bRt7fjeDlc6zC6PsLdjkgJgftCz7fQ/X0EvtDhZbT67Xl4BAi8jbL3Q7aSKB1ihzFUlR WZUndJd8j12GnAZ5WeWlzntQtHxrPGMpIxMVQ6nox+o5PEQSkK/eKO0BLQsM+Q8uHLmK MBrni5K1uOEv1hwje/u4b7VE3QuJ8N4wSOaxo3Ao3/23gc+fPpjBzlzSpoK7mZAARrR/ YtjPjlwXi05I1GJPYHtj/2i8jjPfgY/uR7HwO8VwV3x2RLWGfBEIQJPz+i715Y1V8Ogt w+pw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885608; x=1792490408; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=lDzfUb7EUQSzzFg19JafujucagwpaQT3G62qx3at3mU=; b=aSX+q/u/mi70EEE1Oa5apyShwt5daimztsuRLZzUXUPjyx7RtuNQVs6qSlMA8UQfSo WrsYPkNnIfoM+zB1zmMnneWNCzG9kStGNd+jkR1Lg0mhSsHlhFA93ViGp0NOp2QuYUev BzpgBlg9fJxhAQMuuhk+Z3DjXn74sz0Mm17nnX3XMp7Zj4PATCbvC/OUmPdU8QpJTOa1 OkUjTHTwwuguFoQ8FBeF32ZNXSWLc27y3TiCsRq/qNn30N2fAre0PPFzzemVmxhq5lLI FvJuH0fzl3tQrum7gTccUbjhVkUl+6Em4XQjDzeXqXo2b+N6PMUEKQp7Q0CmH+1m/a2N qyXg== X-Gm-Message-State: AFq9FYIG5BvGh+dcYocp+yH0S0XL41LSxKcFboGglyUFMtkjTB53NMoC Hut7DGSvdB2CBbXDFgN9tqU1ByYxeLxlyadWwknEjXO1pDUVTPS+rhhvlZrh1A== X-Gm-Gg: AYBFou06OuxnESFsOqKW5BY/B5p+Gqd9W7BmtX1plVA3Zpro0Gj6foH5n0RRDwHN3hN dK/Cx/H6D7L+GUKJ0wwBcwqGMIgqqunYW8y6xwp1JvDeyp/GomYyaAIWm+0Pdt7s8VcXDCT5jCw O2FzuQR0KAYdZOLkD9HgEmSjU8VOVxxPca5yBjPJUV03rZvZMi8pWS7Vv7S/r2YNkZg4+IbHxTQ sNpyhnOLaRehym6jJBgTQGVBcQzYg3imO9mOhHLhjhJtQUW6BUGwYsgPl4iyHCxTmMnVmcu2nH/ FSKvFE7sp8i9VY7zpiCsI06EtJqN0PRrw/mCp1pZv42mwu9fUx3T+NoW0QNaYHk6Oxm6TBo7nN+ A/P5LZmsKbXy1NbAv0S2b6XAUg1LU5Eucn3qS4WxyN4yhiHuPfR+3rjxW2yClR6Mjvq6faKp1Yv cG0XdKyGC1r0ZIjrQ7V1QwmD2cFePdhergGc3N1gy7BdezB6gn9odOnzuI3QoR+FjlgncVm21HV xkGppjxeG8lL/LTRzTDxvr9UVB1SgCATaQmc3sbeBkywbZm4Rhr X-Received: by 2002:a17:90b:224c:b0:3a8:bbc2:5551 with SMTP id 98e67ed59e1d1-3ab3a0f0a1dmr11581336a91.0.1791885608046; Tue, 13 Oct 2026 03:00:08 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.03.00.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 03:00:07 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 20/28] strongswan: patch CVE-2026-78134 Date: Tue, 13 Oct 2026 22:58:55 +1300 Message-ID: <20261013095903.3544906-20-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 10:00:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130853 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78134 [1]https://download.strongswan.org/security/CVE-2026-78134/strongswan-5.9.10-6.0.7_eap_inner_auth_cfg.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78134).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 2352f801006e75c74ac8892d88a38d4a2e3d2f32) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78134.patch | 712 ++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 713 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78134.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78134.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78134.patch new file mode 100644 index 0000000000..86646e5e96 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78134.patch @@ -0,0 +1,712 @@ +From d95e9d363b0e23d0ba3080bb518695e05a453748 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Mon, 27 Jul 2026 15:05:45 +0200 +Subject: [PATCH] eap-ttls/peap: Return auth-cfg with details on TLS and inner + EAP method + +This fixes several issues with binding identities to the IKE SA. + +If the client is authenticated with a certificate, the previous code still +used the client's proclaimed inner EAP-Identity when starting the EAP-TNC +method. So that method would potentially operate on an unverified +identity. + +Second, if the inner EAP method overrides the client identity (the only +one is currently EAP-MSCHAPV2), the missing merge meant that the outer +IKE/EAP identity could potentially be unconfirmed. + +For inner methods that don't override the identity (e.g. EAP-MD5), not +propagating the inner EAP-Identity could potentially have the same +effect. + +While the EAP-TTLS implementation returned the auth-cfg of the TLS +exchange since the first referenced commit, this was mainly intended to +enforce public key constraints. So it didn't cover the phase 2 EAP +methods. For some reason EAP-PEAP did not get that method at all in that +changeset, so we'll add that now. + +Additionally, the EAP-PEAP implementation now forwards the phase 2 EAP +method type to EAP-TNC like the EAP-TTLS implementation already did, +which allows a more informed decision on the client's identity. + +Fixes: 0864a31d13ff ("eap-ttls: Support EAP auth information getter in EAP-TTLS") +Fixes: 79f2102cb442 ("implemented server side support for EAP-TTLS") +Fixes: 2a421163bf4f ("make TNC client authentication type available to IMVs") +Fixes: 1be296dfb2af ("implemented the PEAP tunneling protocol as an EAP plugin") +Fixes: CVE-2026-78134 + +CVE: CVE-2026-78134 +Upstream-Status: Backport [1][2] + +[1]https://github.com/strongswan/strongswan/commit/e059077d3f3e307e78be7f91e5648aa5f94916a8 +[2]https://github.com/strongswan/strongswan/commit/6a7210731f6dd2889d22bf20310ab0ed7274d0d8 + +Signed-off-by: Ankur Tyagi +--- + src/libcharon/plugins/eap_peap/eap_peap.c | 49 ++++++++++- + .../plugins/eap_peap/eap_peap_peer.c | 20 +++++ + .../plugins/eap_peap/eap_peap_peer.h | 7 ++ + .../plugins/eap_peap/eap_peap_server.c | 81 ++++++++++++++++--- + .../plugins/eap_peap/eap_peap_server.h | 7 ++ + src/libcharon/plugins/eap_ttls/eap_ttls.c | 43 +++++++++- + .../plugins/eap_ttls/eap_ttls_peer.c | 19 +++++ + .../plugins/eap_ttls/eap_ttls_peer.h | 7 ++ + .../plugins/eap_ttls/eap_ttls_server.c | 56 +++++++++++-- + .../plugins/eap_ttls/eap_ttls_server.h | 7 ++ + 10 files changed, 278 insertions(+), 18 deletions(-) + +diff --git a/src/libcharon/plugins/eap_peap/eap_peap.c b/src/libcharon/plugins/eap_peap/eap_peap.c +index 3573cba..cd942f1 100644 +--- a/src/libcharon/plugins/eap_peap/eap_peap.c ++++ b/src/libcharon/plugins/eap_peap/eap_peap.c +@@ -40,6 +40,25 @@ struct private_eap_peap_t { + * TLS stack, wrapped by EAP helper + */ + tls_eap_t *tls_eap; ++ ++ /** ++ * Role ++ */ ++ bool is_server; ++ ++ /** ++ * Actual server/client implementation ++ */ ++ union { ++ tls_application_t *application; ++ eap_peap_server_t *server; ++ eap_peap_peer_t *client; ++ } impl; ++ ++ /** ++ * Cached auth data for TLS and inner EAP methods ++ */ ++ auth_cfg_t *auth; + }; + + /** Maximum number of EAP-PEAP messages/fragments allowed */ +@@ -113,10 +132,34 @@ METHOD(eap_method_t, is_mutual, bool, + return TRUE; + } + ++METHOD(eap_method_t, get_auth, auth_cfg_t*, ++ private_eap_peap_t *this) ++{ ++ if (!this->auth) ++ { ++ auth_cfg_t *inner; ++ ++ this->auth = auth_cfg_create(); ++ this->auth->merge(this->auth, ++ this->tls_eap->get_auth(this->tls_eap), FALSE); ++ if (this->is_server) ++ { ++ inner = this->impl.server->get_auth(this->impl.server); ++ } ++ else ++ { ++ inner = this->impl.client->get_auth(this->impl.client); ++ } ++ this->auth->merge(this->auth, inner, FALSE); ++ } ++ return this->auth; ++} ++ + METHOD(eap_method_t, destroy, void, + private_eap_peap_t *this) + { + this->tls_eap->destroy(this->tls_eap); ++ DESTROY_IF(this->auth); + free(this); + } + +@@ -135,6 +178,7 @@ static private_eap_peap_t *eap_peap_create_empty(void) + .get_type = _get_type, + .is_mutual = _is_mutual, + .get_msk = _get_msk, ++ .get_auth = _get_auth, + .get_identifier = _get_identifier, + .set_identifier = _set_identifier, + .destroy = _destroy, +@@ -147,7 +191,7 @@ static private_eap_peap_t *eap_peap_create_empty(void) + /** + * Generic private constructor + */ +-static eap_peap_t *eap_peap_create(private_eap_peap_t * this, ++static eap_peap_t *eap_peap_create(private_eap_peap_t *this, + identification_t *server, + identification_t *peer, bool is_server, + tls_application_t *application) +@@ -157,6 +201,9 @@ static eap_peap_t *eap_peap_create(private_eap_peap_t * this, + bool include_length; + tls_t *tls; + ++ this->is_server = is_server; ++ this->impl.application = application; ++ + if (is_server && !lib->settings->get_bool(lib->settings, + "%s.plugins.eap-peap.request_peer_auth", FALSE, + lib->ns)) +diff --git a/src/libcharon/plugins/eap_peap/eap_peap_peer.c b/src/libcharon/plugins/eap_peap/eap_peap_peer.c +index 95213a3..f6c087a 100644 +--- a/src/libcharon/plugins/eap_peap/eap_peap_peer.c ++++ b/src/libcharon/plugins/eap_peap/eap_peap_peer.c +@@ -52,6 +52,11 @@ struct private_eap_peap_peer_t { + */ + eap_method_t *ph2_method; + ++ /** ++ * Auth data for phase 2 methods ++ */ ++ auth_cfg_t *auth; ++ + /** + * Pending outbound EAP message + */ +@@ -166,6 +171,12 @@ METHOD(tls_application_t, process, status_t, + switch (status) + { + case SUCCESS: ++ if (this->ph2_method->get_auth) ++ { ++ this->auth->merge(this->auth, ++ this->ph2_method->get_auth(this->ph2_method), ++ FALSE); ++ } + this->ph2_method->destroy(this->ph2_method); + this->ph2_method = NULL; + /* fall through to NEED_MORE */ +@@ -220,11 +231,18 @@ METHOD(tls_application_t, build, status_t, + return INVALID_STATE; + } + ++METHOD(eap_peap_peer_t, get_auth, auth_cfg_t*, ++ private_eap_peap_peer_t *this) ++{ ++ return this->auth; ++} ++ + METHOD(tls_application_t, destroy, void, + private_eap_peap_peer_t *this) + { + this->server->destroy(this->server); + this->peer->destroy(this->peer); ++ this->auth->destroy(this->auth); + DESTROY_IF(this->ph2_method); + DESTROY_IF(this->out); + this->avp->destroy(this->avp); +@@ -247,10 +265,12 @@ eap_peap_peer_t *eap_peap_peer_create(identification_t *server, + .build = _build, + .destroy = _destroy, + }, ++ .get_auth = _get_auth, + }, + .server = server->clone(server), + .peer = peer->clone(peer), + .ph1_method = eap_method, ++ .auth = auth_cfg_create(), + .avp = eap_peap_avp_create(FALSE), + ); + +diff --git a/src/libcharon/plugins/eap_peap/eap_peap_peer.h b/src/libcharon/plugins/eap_peap/eap_peap_peer.h +index 53c25cd..7d16957 100644 +--- a/src/libcharon/plugins/eap_peap/eap_peap_peer.h ++++ b/src/libcharon/plugins/eap_peap/eap_peap_peer.h +@@ -38,6 +38,13 @@ struct eap_peap_peer_t { + * Implements the TLS application data handler. + */ + tls_application_t application; ++ ++ /** ++ * Get authentication details of this EAP method and its inner method(s). ++ * ++ * @return auth method, internal data ++ */ ++ auth_cfg_t *(*get_auth)(eap_peap_peer_t *this); + }; + + /** +diff --git a/src/libcharon/plugins/eap_peap/eap_peap_server.c b/src/libcharon/plugins/eap_peap/eap_peap_server.c +index 29ab9b4..388c3c6 100644 +--- a/src/libcharon/plugins/eap_peap/eap_peap_server.c ++++ b/src/libcharon/plugins/eap_peap/eap_peap_server.c +@@ -20,6 +20,8 @@ + #include + #include + ++#include ++ + typedef struct private_eap_peap_server_t private_eap_peap_server_t; + + /** +@@ -77,6 +79,16 @@ struct private_eap_peap_server_t { + */ + eap_method_t *ph2_method; + ++ /** ++ * Type of the completed phase 2 EAP method ++ */ ++ eap_type_t phase2_type; ++ ++ /** ++ * Auth data for phase 2 method ++ */ ++ auth_cfg_t *auth; ++ + /** + * Pending outbound EAP message + */ +@@ -132,8 +144,11 @@ static status_t start_phase2_auth(private_eap_peap_server_t *this) + /** + * If configured, start EAP-TNC protocol + */ +-static status_t start_phase2_tnc(private_eap_peap_server_t *this) ++static status_t start_phase2_tnc(private_eap_peap_server_t *this, ++ eap_type_t auth_type) + { ++ eap_inner_method_t *inner_method; ++ + if (this->start_phase2_tnc && lib->settings->get_bool(lib->settings, + "%s.plugins.eap-peap.phase2_tnc", FALSE, lib->ns)) + { +@@ -145,6 +160,8 @@ static status_t start_phase2_tnc(private_eap_peap_server_t *this) + DBG1(DBG_IKE, "%N method not available", eap_type_names, EAP_TNC); + return FAILED; + } ++ inner_method = (eap_inner_method_t *)this->ph2_method; ++ inner_method->set_auth_type(inner_method, auth_type); + this->start_phase2_tnc = FALSE; + + /* synchronize EAP message identifiers of inner protocol with outer */ +@@ -218,9 +235,13 @@ METHOD(tls_application_t, process, status_t, + DBG1(DBG_IKE, "received tunneled EAP-PEAP AVP [EAP/%N]", + eap_code_short_names, code); + in->destroy(in); +- /* if EAP_SUCCESS check if to continue phase2 with EAP-TNC */ +- return (this->phase2_result == EAP_SUCCESS && code == EAP_SUCCESS) ? +- start_phase2_tnc(this) : FAILED; ++ if (this->phase2_result == EAP_SUCCESS && code == EAP_SUCCESS) ++ { ++ /* only accept SUCCESS once after a successful inner method */ ++ this->phase2_result = EAP_FAILURE; ++ return start_phase2_tnc(this, this->phase2_type); ++ } ++ return FAILED; + } + + if (this->ph2_method) +@@ -245,6 +266,10 @@ METHOD(tls_application_t, process, status_t, + if (!received_vendor && received_type == EAP_IDENTITY) + { + chunk_t eap_id; ++ bool peer_auth; ++ ++ peer_auth = lib->settings->get_bool(lib->settings, ++ "%s.plugins.eap-peap.request_peer_auth", FALSE, lib->ns); + + if (this->ph2_method == NULL) + { +@@ -271,9 +296,22 @@ METHOD(tls_application_t, process, status_t, + + if (this->ph2_method->get_msk(this->ph2_method, &eap_id) == SUCCESS) + { +- this->peer->destroy(this->peer); +- this->peer = identification_create_from_data(eap_id); +- DBG1(DBG_IKE, "received EAP identity '%Y'", this->peer); ++ identification_t *id; ++ ++ id = identification_create_from_data(eap_id); ++ if (peer_auth && !id->equals(id, this->peer)) ++ { ++ DBG1(DBG_IKE, "received tunneled EAP identity '%Y', keeping " ++ "certificate-authenticated identity '%Y'", id, this->peer); ++ id->destroy(id); ++ } ++ else ++ { ++ DBG1(DBG_IKE, "received EAP identity '%Y'", id); ++ this->auth->add(this->auth, AUTH_RULE_EAP_IDENTITY, id); ++ this->peer->destroy(this->peer); ++ this->peer = id->clone(id); ++ } + } + + in->destroy(in); +@@ -281,10 +319,9 @@ METHOD(tls_application_t, process, status_t, + this->ph2_method = NULL; + + /* Start Phase 2 of EAP-PEAP authentication */ +- if (lib->settings->get_bool(lib->settings, +- "%s.plugins.eap-peap.request_peer_auth", FALSE, lib->ns)) ++ if (peer_auth) + { +- return start_phase2_tnc(this); ++ return start_phase2_tnc(this, EAP_TLS); + } + else + { +@@ -305,11 +342,26 @@ METHOD(tls_application_t, process, status_t, + switch (status) + { + case SUCCESS: ++ if (this->ph2_method->get_auth) ++ { ++ identification_t *id; ++ auth_cfg_t *auth; ++ ++ auth = this->ph2_method->get_auth(this->ph2_method); ++ id = auth->get(auth, AUTH_RULE_EAP_IDENTITY); ++ if (id) ++ { ++ this->peer->destroy(this->peer); ++ this->peer = id->clone(id); ++ } ++ this->auth->merge(this->auth, auth, FALSE); ++ } + DBG1(DBG_IKE, "%N phase2 authentication of '%Y' with %N successful", + eap_type_names, EAP_PEAP, this->peer, + eap_type_names, type); + this->ph2_method->destroy(this->ph2_method); + this->ph2_method = NULL; ++ this->phase2_type = type; + + /* EAP-PEAP requires the sending of an inner EAP_SUCCESS message */ + this->phase2_result = EAP_SUCCESS; +@@ -407,11 +459,18 @@ METHOD(eap_peap_server_t, set_tls, void, + this->tls = tls; + } + ++METHOD(eap_peap_server_t, get_auth, auth_cfg_t*, ++ private_eap_peap_server_t *this) ++{ ++ return this->auth; ++} ++ + METHOD(tls_application_t, destroy, void, + private_eap_peap_server_t *this) + { + this->server->destroy(this->server); + this->peer->destroy(this->peer); ++ this->auth->destroy(this->auth); + DESTROY_IF(this->ph2_method); + DESTROY_IF(this->out); + this->avp->destroy(this->avp); +@@ -435,10 +494,12 @@ eap_peap_server_t *eap_peap_server_create(identification_t *server, + .destroy = _destroy, + }, + .set_tls = _set_tls, ++ .get_auth = _get_auth, + }, + .server = server->clone(server), + .peer = peer->clone(peer), + .ph1_method = eap_method, ++ .auth = auth_cfg_create(), + .start_phase2 = TRUE, + .start_phase2_tnc = TRUE, + .start_phase2_id = lib->settings->get_bool(lib->settings, +diff --git a/src/libcharon/plugins/eap_peap/eap_peap_server.h b/src/libcharon/plugins/eap_peap/eap_peap_server.h +index 3abe88b..8080e9f 100644 +--- a/src/libcharon/plugins/eap_peap/eap_peap_server.h ++++ b/src/libcharon/plugins/eap_peap/eap_peap_server.h +@@ -47,6 +47,13 @@ struct eap_peap_server_t { + * @param tls TLS connection + */ + void (*set_tls)(eap_peap_server_t *this, tls_t *tls); ++ ++ /** ++ * Get authentication details of this EAP method and its inner method(s). ++ * ++ * @return auth method, internal data ++ */ ++ auth_cfg_t *(*get_auth)(eap_peap_server_t *this); + }; + + /** +diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls.c b/src/libcharon/plugins/eap_ttls/eap_ttls.c +index d8ad781..3df78bb 100644 +--- a/src/libcharon/plugins/eap_ttls/eap_ttls.c ++++ b/src/libcharon/plugins/eap_ttls/eap_ttls.c +@@ -40,6 +40,25 @@ struct private_eap_ttls_t { + * TLS stack, wrapped by EAP helper + */ + tls_eap_t *tls_eap; ++ ++ /** ++ * Role ++ */ ++ bool is_server; ++ ++ /** ++ * Actual server/client implementation ++ */ ++ union { ++ tls_application_t *application; ++ eap_ttls_server_t *server; ++ eap_ttls_peer_t *client; ++ } impl; ++ ++ /** ++ * Cached auth data for TLS and inner EAP methods ++ */ ++ auth_cfg_t *auth; + }; + + /** Maximum number of EAP-TTLS messages/fragments allowed */ +@@ -116,13 +135,31 @@ METHOD(eap_method_t, is_mutual, bool, + METHOD(eap_method_t, get_auth, auth_cfg_t*, + private_eap_ttls_t *this) + { +- return this->tls_eap->get_auth(this->tls_eap); ++ if (!this->auth) ++ { ++ auth_cfg_t *inner; ++ ++ this->auth = auth_cfg_create(); ++ this->auth->merge(this->auth, ++ this->tls_eap->get_auth(this->tls_eap), FALSE); ++ if (this->is_server) ++ { ++ inner = this->impl.server->get_auth(this->impl.server); ++ } ++ else ++ { ++ inner = this->impl.client->get_auth(this->impl.client); ++ } ++ this->auth->merge(this->auth, inner, FALSE); ++ } ++ return this->auth; + } + + METHOD(eap_method_t, destroy, void, + private_eap_ttls_t *this) + { + this->tls_eap->destroy(this->tls_eap); ++ DESTROY_IF(this->auth); + free(this); + } + +@@ -153,6 +190,10 @@ static eap_ttls_t *eap_ttls_create(identification_t *server, + .destroy = _destroy, + }, + }, ++ .is_server = is_server, ++ .impl = { ++ .application = application, ++ }, + ); + if (is_server && !lib->settings->get_bool(lib->settings, + "%s.plugins.eap-ttls.request_peer_auth", FALSE, +diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c +index 63126a5..f8229f5 100644 +--- a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c ++++ b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c +@@ -54,6 +54,11 @@ struct private_eap_ttls_peer_t { + */ + eap_method_t *method; + ++ /** ++ * Auth data for phase 2 method ++ */ ++ auth_cfg_t *auth; ++ + /** + * Pending outbound EAP message + */ +@@ -215,6 +220,11 @@ METHOD(tls_application_t, process, status_t, + switch (status) + { + case SUCCESS: ++ if (this->method->get_auth) ++ { ++ this->auth->merge(this->auth, ++ this->method->get_auth(this->method), FALSE); ++ } + this->method->destroy(this->method); + this->method = NULL; + /* fall through to NEED_MORE */ +@@ -275,11 +285,18 @@ METHOD(tls_application_t, build, status_t, + return INVALID_STATE; + } + ++METHOD(eap_ttls_peer_t, get_auth, auth_cfg_t*, ++ private_eap_ttls_peer_t *this) ++{ ++ return this->auth; ++} ++ + METHOD(tls_application_t, destroy, void, + private_eap_ttls_peer_t *this) + { + this->server->destroy(this->server); + this->peer->destroy(this->peer); ++ this->auth->destroy(this->auth); + DESTROY_IF(this->method); + DESTROY_IF(this->out); + this->avp->destroy(this->avp); +@@ -301,10 +318,12 @@ eap_ttls_peer_t *eap_ttls_peer_create(identification_t *server, + .build = _build, + .destroy = _destroy, + }, ++ .get_auth = _get_auth, + }, + .server = server->clone(server), + .peer = peer->clone(peer), + .start_phase2 = TRUE, ++ .auth = auth_cfg_create(), + .avp = eap_ttls_avp_create(), + ); + +diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h +index 0c3d90a..69a8435 100644 +--- a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h ++++ b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h +@@ -37,6 +37,13 @@ struct eap_ttls_peer_t { + * Implements the TLS application data handler. + */ + tls_application_t application; ++ ++ /** ++ * Get authentication details of this EAP method and its inner method(s). ++ * ++ * @return auth method, internal data ++ */ ++ auth_cfg_t *(*get_auth)(eap_ttls_peer_t *this); + }; + + /** +diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_server.c b/src/libcharon/plugins/eap_ttls/eap_ttls_server.c +index fc97f81..e1de1bf 100644 +--- a/src/libcharon/plugins/eap_ttls/eap_ttls_server.c ++++ b/src/libcharon/plugins/eap_ttls/eap_ttls_server.c +@@ -60,6 +60,11 @@ struct private_eap_ttls_server_t { + */ + eap_method_t *method; + ++ /** ++ * Auth data for phase 2 method ++ */ ++ auth_cfg_t *auth; ++ + /** + * Pending outbound EAP message + */ +@@ -220,6 +225,10 @@ METHOD(tls_application_t, process, status_t, + if (!received_vendor && received_type == EAP_IDENTITY) + { + chunk_t eap_id; ++ bool peer_auth; ++ ++ peer_auth = lib->settings->get_bool(lib->settings, ++ "%s.plugins.eap-ttls.request_peer_auth", FALSE, lib->ns); + + if (this->method == NULL) + { +@@ -244,9 +253,22 @@ METHOD(tls_application_t, process, status_t, + + if (this->method->get_msk(this->method, &eap_id) == SUCCESS) + { +- this->peer->destroy(this->peer); +- this->peer = identification_create_from_data(eap_id); +- DBG1(DBG_IKE, "received EAP identity '%Y'", this->peer); ++ identification_t *id; ++ ++ id = identification_create_from_data(eap_id); ++ if (peer_auth && !id->equals(id, this->peer)) ++ { ++ DBG1(DBG_IKE, "received tunneled EAP identity '%Y', keeping " ++ "certificate-authenticated identity '%Y'", id, this->peer); ++ id->destroy(id); ++ } ++ else ++ { ++ DBG1(DBG_IKE, "received EAP identity '%Y'", id); ++ this->auth->add(this->auth, AUTH_RULE_EAP_IDENTITY, id); ++ this->peer->destroy(this->peer); ++ this->peer = id->clone(id); ++ } + } + + in->destroy(in); +@@ -254,8 +276,7 @@ METHOD(tls_application_t, process, status_t, + this->method = NULL; + + /* Start Phase 2 of EAP-TTLS authentication */ +- if (lib->settings->get_bool(lib->settings, +- "%s.plugins.eap-ttls.request_peer_auth", FALSE, lib->ns)) ++ if (peer_auth) + { + return start_phase2_tnc(this, EAP_TLS); + } +@@ -278,6 +299,20 @@ METHOD(tls_application_t, process, status_t, + switch (status) + { + case SUCCESS: ++ if (this->method->get_auth) ++ { ++ identification_t *id; ++ auth_cfg_t *auth; ++ ++ auth = this->method->get_auth(this->method); ++ id = auth->get(auth, AUTH_RULE_EAP_IDENTITY); ++ if (id) ++ { ++ this->peer->destroy(this->peer); ++ this->peer = id->clone(id); ++ } ++ this->auth->merge(this->auth, auth, FALSE); ++ } + DBG1(DBG_IKE, "%N phase2 authentication of '%Y' with %N successful", + eap_type_names, EAP_TTLS, this->peer, + eap_type_names, type); +@@ -348,11 +383,18 @@ METHOD(tls_application_t, build, status_t, + return INVALID_STATE; + } + ++METHOD(eap_ttls_server_t, get_auth, auth_cfg_t*, ++ private_eap_ttls_server_t *this) ++{ ++ return this->auth; ++} ++ + METHOD(tls_application_t, destroy, void, + private_eap_ttls_server_t *this) + { + this->server->destroy(this->server); + this->peer->destroy(this->peer); ++ this->auth->destroy(this->auth); + DESTROY_IF(this->method); + DESTROY_IF(this->out); + this->avp->destroy(this->avp); +@@ -374,11 +416,13 @@ eap_ttls_server_t *eap_ttls_server_create(identification_t *server, + .build = _build, + .destroy = _destroy, + }, ++ .get_auth = _get_auth, + }, + .server = server->clone(server), +- .peer = peer->clone(peer), ++ .auth = auth_cfg_create(), + .start_phase2 = TRUE, + .start_phase2_tnc = TRUE, ++ .peer = peer->clone(peer), + .avp = eap_ttls_avp_create(), + ); + +diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_server.h b/src/libcharon/plugins/eap_ttls/eap_ttls_server.h +index 1e13f55..3348706 100644 +--- a/src/libcharon/plugins/eap_ttls/eap_ttls_server.h ++++ b/src/libcharon/plugins/eap_ttls/eap_ttls_server.h +@@ -37,6 +37,13 @@ struct eap_ttls_server_t { + * Implements the TLS application data handler. + */ + tls_application_t application; ++ ++ /** ++ * Get authentication details of this EAP method and its inner method(s). ++ * ++ * @return auth method, internal data ++ */ ++ auth_cfg_t *(*get_auth)(eap_ttls_server_t *this); + }; + + /** diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index df0333b458..bb6c6bf2a3 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -19,6 +19,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78130.patch \ file://CVE-2026-78132.patch \ file://CVE-2026-78135.patch \ + file://CVE-2026-78134.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Tue Oct 13 09:58:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100583 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CDAA0CC6B10 for ; Tue, 13 Oct 2026 10:00:19 +0000 (UTC) Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3439.1791885612287283224 for ; Tue, 13 Oct 2026 03:00:12 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=YACoJImQ; spf=pass (domain: gmail.com, ip: 209.85.216.45, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-3ab33730821so1524778a91.3 for ; Tue, 13 Oct 2026 03:00:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885612; x=1792490412; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=RqoBVTvuWIA3oRwlp4pXxdSlrh9dq7DOjEbbCIaPUvY=; b=YACoJImQMHK+yMjPtgHKSESef7NTU6ooeS30eCmVdgJ+Dd39PocovWLlguBk8fdIE3 dzA9QizsyZZWfBce17J5XqYkV72SvlufWcrHOHIssZZhQKxwnCPdUv1xGuhdeFfHPbkQ cCAqYyGJeiXS/hptwbH+GAaDYNinfzMLrqBwNpVTfUN0tcxfdUThysvU9Fzcbtbs9Tgn Gn+213HGOO440QyWyFJ4qdstmlUStj6eX/aysfMRLJK+97V0yQ73HfG6oP/vpm8uXlWC n8a6Dw3jWrs6Rb9OptnOq1bts9nYgWh815uN1lN97QRKZWOPYgJDtWEoAVeqj2z60RXp YJSQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885612; x=1792490412; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=RqoBVTvuWIA3oRwlp4pXxdSlrh9dq7DOjEbbCIaPUvY=; b=Y/v5DTbLHlx3EHw+ce8skQM9FBn1+zGYlEe8HRhxb/e1IsCxs6yqkXOWNMANKapEYO MsdnMDRiu3izpgrXY638O20cZL836aKAwu8jLDE/9+1CPjl3h28vsVRi/kd9MYf2042u KyykxZldRPfROBITEu31TIeTLUbdA1fXWevySLSOJkmBmGqofFuH4I/LD5K88O1iQFYk 1QCgPF28Gjc8bWYgCxvzw+DQFrV0SNvA3bYnfl2q9gXAo7Afaj1qi2Z+EGEKvFRqYsz2 Y9hRwroQVGxrxyZXR1taXwy+HO50uji2JDZy/9KlLbX7v/skZ5nOwzPFW1wE/t0C4PFJ lnGA== X-Gm-Message-State: AFq9FYIWtt5ZWLhau3UafLckiffM6bfQTD9bEGVJoki7q/9ZDwCJ1rXh Q4fHCGZV9VS3j49SIPjDmpiam9uOsdwiJd+ip9TvKksuKlbRDqQ0f3sHJDtcvg== X-Gm-Gg: AYBFou0RC/qOxfx6SmnxbPQxUSEYXpaUUbFh1WY1fJFHy/YifZXvOAUIZkLjc5dBQHh f9L8u+WL+oH5w0j8C6QmobnqmtBks5pQFM8LDLsFCwR0xeO6vQO/Trdr/9khZbWry7ktM8AvC4+ tlZseP1FCUc5JnQW7Eii2kIfdG3dfInTb9oAvT+ILMbaSxOVgQfdpo7TuPTteOz238rLynBTJW1 jgnhSA8GEaMHxUEk/f4I0jkmtkJXyHuu0/sfKocqux7FNe9p7/XMmkR2O/u4pmIaMyO3TagcZoI t3tm1ofFY/DlnJTlofciRsJH+Cpljafzt1cwlivTIpXGpuYdiiuSlhslMi+7VRfZia8ozfqNoTx BSEKaYTMoVqLaAE06Ad4wXr+vb6jo9pAFSc9/EtRR9rCxxmJh+OHUdo4xP58PF632qSZi+ZbS6n UCvvPW5rkQmdqeG5GAZS/s+bZJU125zXuvdFbXx3GOOsdmi5Sk4vcXRkiBk1bSLRn0QouyUhqHz EYcgqRwrhWR2JkA1beqcWX9JTxh/d3pmS+XTpc= X-Received: by 2002:a17:90b:4fcb:b0:3a6:dc2f:f07f with SMTP id 98e67ed59e1d1-3ab3a609f14mr10005233a91.10.1791885611288; Tue, 13 Oct 2026 03:00:11 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.03.00.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 03:00:10 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 21/28] tesseract: patch CVE-2026-88052 Date: Tue, 13 Oct 2026 22:58:56 +1300 Message-ID: <20261013095903.3544906-21-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 10:00:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130854 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88052 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 251dd7f80d1fc19515e162f5afd1eb889839bbaf) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88052.patch | 165 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 5 +- 2 files changed, 168 insertions(+), 2 deletions(-) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88052.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88052.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88052.patch new file mode 100644 index 0000000000..e55968135a --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88052.patch @@ -0,0 +1,165 @@ +From c60ad589ff3a645a3fdf13cb24fe719313145a06 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Fri, 21 Aug 2026 18:34:33 +0200 +Subject: [PATCH] Reject unicharset files whose inserts desync id from unichars + +UNICHARSET::load_via_fgets reads the unichar count via sscanf and +trusts it as the loop bound, indexing the unichars vector with the +loop index id via the unchecked set_* accessors. unichar_insert is a +no-op for duplicate (or empty) representations, so once any insert +no-ops, unichars.size() falls behind id and the subsequent +set_*(id, ...) and unichars[id].properties writes land past the end +of the vector - a deterministic heap out-of-bounds write (including a +std::string assignment via set_normed) for every remaining line, on +both the LSTM and legacy init paths. A malformed unicharset with a +duplicate line (e.g. two identical entries) triggers it; a +non-positive header count likewise loads an empty unicharset +"successfully". + +Key changes: +- unicharset.cpp: reject unicharset_size <= 0, and after each insert + verify the vector actually grew to id + 1; on mismatch report the + offending line and reject the file instead of writing out of bounds. +- unittest: add unicharset_load_test with a duplicate-representation + unicharset (on unpatched code the test dies on the + container-overflow in load_via_fgets), a zero and a negative count, + and a positive control that a valid unicharset still loads. + +Reported-by: Zhixi "Jace" Sun +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit 2d04d640db2e8c7e3bab2369d599343b5a8b8443) + +CVE: CVE-2026-88052 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/2d04d640db2e8c7e3bab2369d599343b5a8b8443] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 +++ + src/ccutil/unicharset.cpp | 12 ++++++ + unittest/unicharset_load_test.cc | 64 ++++++++++++++++++++++++++++++++ + 3 files changed, 81 insertions(+) + create mode 100644 unittest/unicharset_load_test.cc + +diff --git a/Makefile.am b/Makefile.am +index bec9ab0e..22c2c7a0 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1220,6 +1220,7 @@ check_PROGRAMS += tfile_test + if ENABLE_TRAINING + check_PROGRAMS += unichar_test + check_PROGRAMS += unicharcompress_test ++check_PROGRAMS += unicharset_load_test + check_PROGRAMS += unicharset_test + check_PROGRAMS += validate_grapheme_test + check_PROGRAMS += validate_indic_test +@@ -1493,6 +1494,10 @@ unicharcompress_test_SOURCES = unittest/unicharcompress_test.cc + unicharcompress_test_CPPFLAGS = $(unittest_CPPFLAGS) + unicharcompress_test_LDADD = $(TRAINING_LIBS) $(ICU_UC_LIBS) + ++unicharset_load_test_SOURCES = unittest/unicharset_load_test.cc ++unicharset_load_test_CPPFLAGS = $(unittest_CPPFLAGS) ++unicharset_load_test_LDADD = $(TESS_LIBS) ++ + unicharset_test_SOURCES = unittest/unicharset_test.cc + unicharset_test_CPPFLAGS = $(unittest_CPPFLAGS) + unicharset_test_LDADD = $(TRAINING_LIBS) $(ICU_UC_LIBS) +diff --git a/src/ccutil/unicharset.cpp b/src/ccutil/unicharset.cpp +index b29ec3b7..0e72ae48 100644 +--- a/src/ccutil/unicharset.cpp ++++ b/src/ccutil/unicharset.cpp +@@ -791,6 +791,9 @@ bool UNICHARSET::load_via_fgets( + sscanf(buffer, "%d", &unicharset_size) != 1) { + return false; + } ++ if (unicharset_size <= 0) { ++ return false; ++ } + for (UNICHAR_ID id = 0; id < unicharset_size; ++id) { + char unichar[256]; + unsigned int properties; +@@ -884,6 +887,15 @@ bool UNICHARSET::load_via_fgets( + } else { + this->unichar_insert_backwards_compatible(unichar); + } ++ // A duplicate or empty representation makes the insert a no-op, ++ // desynchronizing id from the unichars vector; the set_* calls and ++ // unichars[id] below would then write out of bounds. The file is ++ // malformed, so reject it. ++ if (size() != static_cast(id) + 1) { ++ fprintf(stderr, "%s:%d unichar %d has a duplicate or empty representation\n", ++ __FILE__, __LINE__, id); ++ return false; ++ } + + this->set_isalpha(id, properties & ISALPHA_MASK); + this->set_islower(id, properties & ISLOWER_MASK); +diff --git a/unittest/unicharset_load_test.cc b/unittest/unicharset_load_test.cc +new file mode 100644 +index 00000000..d775e233 +--- /dev/null ++++ b/unittest/unicharset_load_test.cc +@@ -0,0 +1,64 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: unicharset_load_test.cc ++// Description: Tests that UNICHARSET::load_via_fgets rejects unicharset ++// files whose insertions desynchronize the id loop index ++// from the unichars vector (duplicate or empty ++// representations), which would make the subsequent set_* ++// calls write out of bounds, and non-positive size counts. ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include "serialis.h" // for TFile ++#include "unicharset.h" ++ ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Loads the given unicharset text via the TFile-based loader. ++bool LoadUnicharset(const char *text, UNICHARSET *unicharset) { ++ TFile fp; ++ if (!fp.Open(text, std::strlen(text))) { ++ return false; ++ } ++ return unicharset->load_from_file(&fp, false); ++} ++ ++// A duplicate representation makes the second insert a no-op, so on ++// unpatched code the set_* calls for the remaining lines write past ++// the end of the unichars vector (ASan container-overflow). ++TEST(UnicharsetLoadTest, RejectsDuplicateRepresentation) { ++ const char *text = "3\nA 0 Latin\nA 0 Latin\nB 0 Latin\n"; ++ UNICHARSET unicharset; ++ EXPECT_FALSE(LoadUnicharset(text, &unicharset)); ++} ++ ++// A non-positive size count must be rejected; on unpatched code a ++// zero or negative count loads an empty unicharset successfully. ++TEST(UnicharsetLoadTest, RejectsNonPositiveCount) { ++ const char *texts[] = {"0\n", "-1\n"}; ++ for (const char *text : texts) { ++ UNICHARSET unicharset; ++ EXPECT_FALSE(LoadUnicharset(text, &unicharset)); ++ } ++} ++ ++// A valid unicharset must still be accepted. ++TEST(UnicharsetLoadTest, AcceptsValidUnicharset) { ++ const char *text = "3\nA 0 Latin\nB 0 Latin\nC 0 Latin\n"; ++ UNICHARSET unicharset; ++ ASSERT_TRUE(LoadUnicharset(text, &unicharset)); ++ EXPECT_EQ(unicharset.size(), 3u); ++ EXPECT_STREQ(unicharset.id_to_unichar(1), "B"); ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index 0d9b178dc9..81359b761b 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -6,8 +6,9 @@ LICENSE = "Apache-2.0" LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57" SRCREV = "db0ec62f81b0737fbbe184d8fea40af5738f8eef" -SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag=${PV}" - +SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag=${PV} \ + file://CVE-2026-88052.patch \ +" DEPENDS = "leptonica" From patchwork Tue Oct 13 09:58:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100581 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C0A5FCC6B08 for ; Tue, 13 Oct 2026 10:00:18 +0000 (UTC) Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3532.1791885616991431697 for ; Tue, 13 Oct 2026 03:00:17 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=YEWrlzYI; spf=pass (domain: gmail.com, ip: 209.85.216.47, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-3ab33730821so1524856a91.3 for ; Tue, 13 Oct 2026 03:00:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885616; x=1792490416; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=9Xu+zkfTcubefsRDXfR68Hr9MeQvRbPWzNonwptWFoY=; b=YEWrlzYIhIO+oSuBCT8kXP/FZtBz9wQKyJ/x6aYUDPVbplzwkh6IbqZDM95uysiymP HTQ/vcaPjrJDEHYyHdo1k6RrPCnlZWp5GHVFWg55jmOoMpOxgnYuExc8QMmt7wIto9af 8ldXj50V4wofrvkqlmlDPO/YzKtVaWIcdMPaPdaKLaDUqPfKcjDMKrf7hmSoTzXocuOg NX9AC3XZniMIGr4ZNcft8OoW5rfL8jzA9nrWecp5YxT9PBsAhcLTyxWAKQgJDWbwHe8W a0JD/JSRH/8ippsytYXRRyKujOT4th7kMesbiOkWUVCZ+xAmOVXbzEq4v0XZ5EBinjZ+ nw1Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885616; x=1792490416; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=9Xu+zkfTcubefsRDXfR68Hr9MeQvRbPWzNonwptWFoY=; b=Iux68rrTU3Grnr7BgnOtXLBXSFoCqDypCNS6CvDDM+etfClK55nGsEAIdBJcRNmvjd 6K1h/0wrBwm4/5WNZnbcBg5GPYuOHcJZEEL++Ffq+BQeiPxaySF+zgEN/vbh8Wv5E9zT w/vvhKr77Y4S9Z/EXLvF+5XgCuOnxjekuFMcK1z6YKJFDnezMzfjjy62e7YlaAKdQPh4 WclsOYLkThU9bXS59WkhzGJf8kjMyd7vB71sVRi+WaxSu60nRjewAv2lQCVexj54UL/w c/AlsZ2QQXmFn1PdXJI52r+Ox926WWzIUHV2G6YeMzNnOuo2RZu0ExCrCLrlk27mlWds Udiw== X-Gm-Message-State: AFq9FYJoF5doOod1SDjsZhI42o+FUpotFHjF0qNa0b1aDx8hrN5zDyQH JnTFw1sia9BkM7WKNI/3BadnZkWeWh5ZgqquikxP6/CSNW2uUwtWTTd0J/wCtQ== X-Gm-Gg: AYBFou0wFrBLgZKnFjKb+WKipDKn1n/dYFU/GMe3W2+ww+HQLxn+HcoERVIcNy/ya8R U6y/61nmZbiguM2sYNRBoBAw2lnk1Zu0qo97llgxi1STr3Mt7A872ODoDD3l2wyQBupDR4JX9Mb kalQxRUVqnQuhO6/+yR5+Nj+LWt1IdsAFFC+w3BONzOjYjiORVcgIDl9qPjbi7NzUjA2LT34LBP THbNlC2IgrJf37C4DZahekkoe5ZppnqyJwMqluyPAIrHlq8fwPQt64FfBnZLtz+P/M4n7S6B+wz EYXhtlQe/+YG/wrntiTc4HO1z/wrIXc+Xy3bmn+/oY53i3gX2663d5aTx0zydYMdNaMyi1n2Eul 9dxdBYEzsBjjAwF9QnrE4QA7qcMVTMLCDqysLWq15mx+sL1VqniQVpheOlZplUM77K0nj6q3FlU Rl7cKrfWnIG8RvJX+dxyUcaOv16U+cytSR8qj7TPk86/fd78dLcVKyIKTVGyK0YlAei63iCB40N qIOvfI0SzwjM4tviahSvSHGb6F5/ybsmhTwcl8= X-Received: by 2002:a17:90b:4acc:b0:3a0:e1f7:9b04 with SMTP id 98e67ed59e1d1-3ab3a60ac9amr11144585a91.12.1791885616063; Tue, 13 Oct 2026 03:00:16 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.03.00.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 03:00:13 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 22/28] tesseract: patch CVE-2026-88048 Date: Tue, 13 Oct 2026 22:58:57 +1300 Message-ID: <20261013095903.3544906-22-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 10:00:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130855 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88048 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 9e544d6e5087f701a0d6a9d66ae3f87b6dcc8c5e) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88048.patch | 227 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 1 + 2 files changed, 228 insertions(+) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88048.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88048.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88048.patch new file mode 100644 index 0000000000..abfd502667 --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88048.patch @@ -0,0 +1,227 @@ +From b2fbc8282c34f0a5a426622a9eb6a79ad0df0fe4 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Fri, 21 Aug 2026 15:23:59 +0200 +Subject: [PATCH] Validate FullyConnected weight matrix dimensions at load + +FullyConnected::DeSerialize read the WeightMatrix without checking +that its dimensions match the layer's declared ni/no. MatrixDotVector +drives the dot product from the matrix dimensions (writes w.dim1() +results, reads w.dim2()-1 inputs) while the scratch buffers are sized +from no_ and ni_, so a crafted .traineddata with a mismatched matrix +performed a heap out-of-bounds write (up to 65535 rows) and out-of- +bounds read on the first recognition step (crash, or heap corruption +with attacker-influenced size and content). + +Key changes: +- weightmatrix.h: add Dim1()/Dim2() accessors for the active weight + matrix (int or float), alongside the existing NumOutputs(). +- fullyconnected.cpp: reject the layer in DeSerialize unless + Dim1() == no_ and Dim2() == ni_ + 1 (the second dimension + includes the bias column), the layout that InitWeightsFloat + always produces. +- unittest: new fullyconnected_test that builds a Softmax network + with mismatched matrix dimensions and expects CreateFromFile to + return nullptr; on unpatched code the test reaches Forward and + ASan catches the out-of-bounds write in MatrixDotVector. A + second test verifies that matching dimensions are still accepted. + +Reported-by: Zhixi "Jace" Sun +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit 103dc134eb36411ddc6833ec20aa2c76795bd0ff) + +CVE: CVE-2026-88048 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/103dc134eb36411ddc6833ec20aa2c76795bd0ff] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 ++ + src/lstm/fullyconnected.cpp | 11 ++- + src/lstm/weightmatrix.h | 7 ++ + unittest/fullyconnected_test.cc | 115 ++++++++++++++++++++++++++++++++ + 4 files changed, 137 insertions(+), 1 deletion(-) + create mode 100644 unittest/fullyconnected_test.cc + +diff --git a/Makefile.am b/Makefile.am +index 22c2c7a0..284f8b53 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1158,6 +1158,7 @@ if !DISABLED_LEGACY_ENGINE + check_PROGRAMS += equationdetect_test + endif # !DISABLED_LEGACY_ENGINE + check_PROGRAMS += fileio_test ++check_PROGRAMS += fullyconnected_test + check_PROGRAMS += heap_test + check_PROGRAMS += imagedata_test + if !DISABLED_LEGACY_ENGINE +@@ -1290,6 +1291,10 @@ fileio_test_SOURCES = unittest/fileio_test.cc + fileio_test_CPPFLAGS = $(unittest_CPPFLAGS) + fileio_test_LDADD = $(TRAINING_LIBS) + ++fullyconnected_test_SOURCES = unittest/fullyconnected_test.cc ++fullyconnected_test_CPPFLAGS = $(unittest_CPPFLAGS) ++fullyconnected_test_LDADD = $(TESS_LIBS) ++ + heap_test_SOURCES = unittest/heap_test.cc + heap_test_CPPFLAGS = $(unittest_CPPFLAGS) + heap_test_LDADD = $(TESS_LIBS) +diff --git a/src/lstm/fullyconnected.cpp b/src/lstm/fullyconnected.cpp +index a0ee1b02..d999f575 100644 +--- a/src/lstm/fullyconnected.cpp ++++ b/src/lstm/fullyconnected.cpp +@@ -121,7 +121,16 @@ bool FullyConnected::Serialize(TFile *fp) const { + + // Reads from the given file. Returns false in case of error. + bool FullyConnected::DeSerialize(TFile *fp) { +- return weights_.DeSerialize(IsTraining(), fp); ++ if (!weights_.DeSerialize(IsTraining(), fp)) { ++ return false; ++ } ++ // The weight matrix must match the declared sizes (the second dimension ++ // includes the bias column); otherwise Forward would read or write ++ // outside the scratch buffers sized from ni_ and no_. ++ if (weights_.Dim1() != no_ || weights_.Dim2() != ni_ + 1) { ++ return false; ++ } ++ return true; + } + + // Runs forward propagation of activations on the input line. +diff --git a/src/lstm/weightmatrix.h b/src/lstm/weightmatrix.h +index eaca3ffb..6c5ab236 100644 +--- a/src/lstm/weightmatrix.h ++++ b/src/lstm/weightmatrix.h +@@ -107,6 +107,13 @@ public: + int NumOutputs() const { + return int_mode_ ? wi_.dim1() : wf_.dim1(); + } ++ // The dimensions of the active weight matrix (wi_ in int mode, else wf_). ++ int Dim1() const { ++ return int_mode_ ? wi_.dim1() : wf_.dim1(); ++ } ++ int Dim2() const { ++ return int_mode_ ? wi_.dim2() : wf_.dim2(); ++ } + // Provides one set of weights. Only used by peep weight maxpool. + const TFloat *GetWeights(int index) const { + return wf_[index]; +diff --git a/unittest/fullyconnected_test.cc b/unittest/fullyconnected_test.cc +new file mode 100644 +index 00000000..f9697de4 +--- /dev/null ++++ b/unittest/fullyconnected_test.cc +@@ -0,0 +1,115 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: fullyconnected_test.cc ++// Description: Tests that a FullyConnected (softmax) network layer with ++// weight-matrix dimensions that do not match the declared ++// ni/no is rejected at load. Without the check, ++// MatrixDotVector writes w.dim1() results into a scratch ++// buffer sized from no_ and reads w.dim2()-1 inputs from ++// a buffer sized from ni_ (heap out-of-bounds write/read) ++// on the first recognition step. ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include "network.h" // for Network, NetworkType ++#include "networkio.h" ++#include "networkscratch.h" ++#include "serialis.h" // for TFile ++ ++#include ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Appends raw little-endian values to a byte buffer. ++class ByteWriter { ++public: ++ void PutU8(uint32_t v) { data_.push_back(static_cast(v & 0xFF)); } ++ void PutU32(uint32_t v) { ++ for (int i = 0; i < 4; ++i) { ++ data_.push_back(static_cast((v >> (8 * i)) & 0xFF)); ++ } ++ } ++ void PutS32(int32_t v) { PutU32(static_cast(v)); } ++ const std::vector &data() const { return data_; } ++ ++private: ++ std::vector data_; ++}; ++ ++void PutDoubleLE(ByteWriter *w, double d) { ++ union { ++ double d; ++ uint64_t u; ++ } conv; ++ conv.d = d; ++ w->PutU32(static_cast(conv.u & 0xFFFFFFFF)); ++ w->PutU32(static_cast(conv.u >> 32)); ++} ++ ++// Builds a serialized NT_SOFTMAX network: header with the given ni/no, ++// then a float-mode WeightMatrix with the given (corrupt) dimensions. ++// The matrix is stored as doubles on disk (see WeightMatrix::DeSerialize). ++std::vector MakeSoftmaxNetwork(int ni, int no, int32_t dim1, int32_t dim2) { ++ ByteWriter w; ++ w.PutU8(static_cast(NT_SOFTMAX)); ++ w.PutU8(0); // training: TS_DISABLED ++ w.PutU8(0); // needs_to_backprop ++ w.PutU32(0); // network_flags ++ w.PutU32(static_cast(ni)); ++ w.PutU32(static_cast(no)); ++ w.PutU32(0); // num_weights (not cross-checked, kept consistent anyway) ++ w.PutU32(0); // name (empty string) ++ // WeightMatrix::DeSerialize: ++ w.PutU8(128); // mode: kDoubleFlag, float mode ++ w.PutS32(dim1); ++ w.PutS32(dim2); ++ PutDoubleLE(&w, 0.0); // empty_ cell ++ for (int32_t i = 0; i < dim1 * dim2; ++i) { ++ PutDoubleLE(&w, 0.0); // weight data ++ } ++ return w.data(); ++} ++ ++// A FullyConnected layer whose weight matrix does not match the declared ++// sizes must be rejected by CreateFromFile; on unpatched code the test ++// reaches Forward, where MatrixDotVector performs the out-of-bounds ++// write this regression test guards against. ++TEST(FullyconnectedTest, RejectsWeightMatrixDimensionMismatch) { ++ // ni_=no_=1 but dim1=3 (OOB write of 3 results into a 1-result buffer) ++ // and dim2=5 (OOB read of 4 inputs from a 1-input buffer). ++ std::vector bytes = MakeSoftmaxNetwork(1, 1, 3, 5); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ Network *net = Network::CreateFromFile(&fp); ++ if (net == nullptr) { ++ return; // Fixed: the mismatched layer is rejected at load. ++ } ++ NetworkIO input; ++ input.Resize2d(false, /*width=*/1, /*num_features=*/1); ++ NetworkScratch scratch; ++ NetworkIO output; ++ net->Forward(false, input, nullptr, &scratch, &output); ++ delete net; ++ FAIL() << "crafted FullyConnected layer with mismatched weight matrix was accepted"; ++} ++ ++// Consistent dimensions must still be accepted. ++TEST(FullyconnectedTest, AcceptsMatchingDimensions) { ++ std::vector bytes = MakeSoftmaxNetwork(1, 2, 2, 2); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ Network *net = Network::CreateFromFile(&fp); ++ ASSERT_NE(net, nullptr); ++ delete net; ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index 81359b761b..bed16f9806 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -8,6 +8,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57" SRCREV = "db0ec62f81b0737fbbe184d8fea40af5738f8eef" SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag=${PV} \ file://CVE-2026-88052.patch \ + file://CVE-2026-88048.patch \ " DEPENDS = "leptonica" From patchwork Tue Oct 13 09:58:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100585 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id F2A47CC6B0F for ; Tue, 13 Oct 2026 10:00:28 +0000 (UTC) Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3441.1791885621487294053 for ; Tue, 13 Oct 2026 03:00:21 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=HZQM2RSB; spf=pass (domain: gmail.com, ip: 209.85.216.41, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-3ab868eb9cfso1144692a91.0 for ; Tue, 13 Oct 2026 03:00:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885621; x=1792490421; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=0jtEXI6DzBOUNNFoHZSKvXiTIYRqf/dnrlUdsu1s60M=; b=HZQM2RSBlqk12bxmZF+YNy1ry+mHPqk4F00PmjJq+0w3GQ64zOdJ4GAdTn5qARWuB+ nI+lGa/jXg30VMoFgXtDwyle4+OBVPWm2GKLaQSYRAu3Y8P11hJl5jk9eAJKG7aFfEKg u9VSl0UWA8kk0NbOyl5KNzM2Nx55dEeJo8LYb4NwN4lha2QN0vJdyokaGiZMj8+keOzG md7+oBKL1Be3cK4amiOvQ62VZldV7jaMYAUYiRX/NJZS4s5G6Jw3fokzUcLyyFjuPxG4 vjU76StuENlMDWUqi8zowS9AVdD6W9HKITb/g5KzVrAeE9jhvCdf02E+nOHpri5QNZ22 G9bw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885621; x=1792490421; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=0jtEXI6DzBOUNNFoHZSKvXiTIYRqf/dnrlUdsu1s60M=; b=tev+EZQci/TrZ4/EenTpvrdU/d0j4AeFVaAZ3Gcy4ybzCkT+SSLwE2zKleBktVa3+K OWgQq/ROrqScguxgGeovzIP61oncpK0XZ6oV0E131OOmeHwJkC3Lkog8o2bsHx2cg5Zx fkyU3AdHXJgcCxGnt1pg7pYRcYsEpFGug0ticWHr311vrh1yXW59foU0OfVbrRpaf5JN KOkNNwgZZA5cvTNjGOw4RXuICRyTTnjJPr2yJ9t37WovTXXfhsFLlXIx+KBhtQlGhZkv lrCscouG1Xriu8QJKJaB5wLMgW4XfjHvjMi7jg+WvbAzE4DFCQyHXzVQMFuIv6uvzeHu TQgA== X-Gm-Message-State: AFq9FYJkwrR38lrw0S30xZARbqvGnDEq9uyB+l2n5M4dJrfrsC1DXLb1 MGICE/9X7/0Y9yKBb7L/jbaI4deUtMhSegXxOWZjUORzK51SiL5Zs+xorMeGJw== X-Gm-Gg: AYBFou1CUq7iNf88x0cY8lq8Rbzo0+9S0g0xVr+uEjaVdcsNRFH0mAFJUugIzY0m5Oj 1JUuf2iKfhTinz3oRJlzLmXFMUXA8kTuBtyFOIGdJCn83ofcGDEP96cEYuCZvnxB6LL6nHn+oSC 69p9nQGZXUlz1kO/VepWwLkYB/VZn7P0Dy8/ViKYzjObC25Lzx59ZRexMo/cm9/8jUIXfGdWten m9uMQrIT0mYHs3u5NMiUFu8xIVozsGOJn/12dqSSI1CZn7K3/N43dBg/mR7KWAvuJRd6Nlm2P4k 6KQWDCEhgdqvxVUEOCqBLCGN0l7RhKkWBdH7bQb2ZtSb6zlUL0nlaSLkxyn0wxs6YmkmfoF9+Q0 p653YKXc9yqZ1rJoCvjIkJJ1+J9q5MACq4KgBqRj3N6va6Lsuia/MkxclBAdCOZtXPWMG59sO8Y FPUF53PM33a7Yhq3fBTKhPTq6yXBEogaE2bWuQZlScdgEzAyBwUBIg0gvDACIyV9frb0YPggOOw RdaMDKekEuY8opufBxhppQyNrVtuUp+Osu8YLd6AMC+NMbcGg== X-Received: by 2002:a17:90b:2b50:b0:3a8:609c:7a6 with SMTP id 98e67ed59e1d1-3ab3a8e9100mr9386830a91.44.1791885620048; Tue, 13 Oct 2026 03:00:20 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.03.00.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 03:00:19 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 23/28] tesseract: patch CVE-2026-88049 Date: Tue, 13 Oct 2026 22:58:58 +1300 Message-ID: <20261013095903.3544906-23-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 10:00:28 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130856 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88049 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 218b6a19b168587a67d1eab85160c302013164db) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88049.patch | 315 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 1 + 2 files changed, 316 insertions(+) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88049.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88049.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88049.patch new file mode 100644 index 0000000000..b6a5e5275d --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88049.patch @@ -0,0 +1,315 @@ +From 62fabbca097d127e7d5a8fe3869102d2e4918b80 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Fri, 21 Aug 2026 16:41:51 +0200 +Subject: [PATCH] Validate LSTM gate matrix dimensions against na_/no_ at load + +LSTM::DeSerialize read na_ from the untrusted TESSDATA_LSTM component +and derived ns_ from the CI gate matrix's dim1, but never checked that +the deserialized dimensions were mutually consistent. The forward pass +sizes its buffers from na_, no_ and ns_ while the gate matrices drive +their own dimensions, so a crafted .traineddata performed heap +out-of-bounds writes and reads during the first recognition step, e.g. +WriteTimeStepPart writing ns_ floats at offset ni_+nf_ into a source_ +buffer sized from na_ (up to ~256 KB with an attacker-chosen gate +matrix dim1). + +The bounds assertions added by 2f4d2f4 (CVE-2026-73066) covered only +NetworkIO::CopyTimeStepGeneral and Randomize, leaving +WriteTimeStepPart and AddTimeStepPart unguarded. + +Key changes: +- weightmatrix.h: add Dim1()/Dim2() accessors for the active weight + matrix (int or float), alongside the existing NumOutputs(). +- lstm.cpp: reject the layer in DeSerialize unless na_ == + ni_ + nf_ + (is_2d_ ? 2 : 1) * ns_, every deserialized gate has + Dim1() == ns_ and Dim2() == na_ + 1 (the layout InitWeightsFloat + always produces), ns_ == no_ for plain NT_LSTM/NT_LSTM_SUMMARY, and + the softmax layer's sizes match ns_/no_ for the softmax variants. +- networkio.cpp: add the same defense-in-depth bounds assertions to + WriteTimeStepPart and AddTimeStepPart as 2f4d2f4 added to + CopyTimeStepGeneral and Randomize. +- unittest: add lstm_layer_test with crafted NT_LSTM layers for the + na_ mismatch, gate dim1 mismatch, and gate dim2 mismatch cases + (each rejected at load; on unpatched code the tests reach Forward + and ASan catches the out-of-bounds write in WriteTimeStepPart), + plus a positive control that a consistent layer loads and runs. + +Reported-by: Zhixi "Jace" Sun +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit b494ac18925f9d9aff9ef5815475de9943ab19bf) + +CVE: CVE-2026-88049 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/b494ac18925f9d9aff9ef5815475de9943ab19bf] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 + + src/lstm/lstm.cpp | 20 ++++ + src/lstm/networkio.cpp | 2 + + unittest/lstm_layer_test.cc | 177 ++++++++++++++++++++++++++++++++++++ + 4 files changed, 204 insertions(+) + create mode 100644 unittest/lstm_layer_test.cc + +diff --git a/Makefile.am b/Makefile.am +index 284f8b53..4bcc858b 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1171,6 +1171,7 @@ check_PROGRAMS += layout_test + check_PROGRAMS += ligature_table_test + check_PROGRAMS += linlsq_test + check_PROGRAMS += list_test ++check_PROGRAMS += lstm_layer_test + if ENABLE_TRAINING + check_PROGRAMS += lstm_recode_test + check_PROGRAMS += lstm_squashed_test +@@ -1352,6 +1353,10 @@ loadlang_test_SOURCES = unittest/loadlang_test.cc + loadlang_test_CPPFLAGS = $(unittest_CPPFLAGS) + loadlang_test_LDADD = $(TESS_LIBS) $(LEPTONICA_LIBS) + ++lstm_layer_test_SOURCES = unittest/lstm_layer_test.cc ++lstm_layer_test_CPPFLAGS = $(unittest_CPPFLAGS) ++lstm_layer_test_LDADD = $(TESS_LIBS) ++ + lstm_recode_test_SOURCES = unittest/lstm_recode_test.cc + lstm_recode_test_CPPFLAGS = $(unittest_CPPFLAGS) + lstm_recode_test_LDADD = $(TRAINING_LIBS) +diff --git a/src/lstm/lstm.cpp b/src/lstm/lstm.cpp +index 7bfd19b5..bfffa5de 100644 +--- a/src/lstm/lstm.cpp ++++ b/src/lstm/lstm.cpp +@@ -274,12 +274,32 @@ bool LSTM::DeSerialize(TFile *fp) { + is_2d_ = na_ - nf_ == ni_ + 2 * ns_; + } + } ++ // The deserialized dimensions must be mutually consistent: the forward ++ // pass sizes its buffers from na_, no_ and ns_ while the gate matrices ++ // drive their own dimensions. ++ if (na_ != ni_ + nf_ + (is_2d_ ? 2 : 1) * ns_) { ++ return false; ++ } ++ for (int w = 0; w < WT_COUNT; ++w) { ++ if (w == GFS && !Is2D()) { ++ continue; ++ } ++ if (gate_weights_[w].Dim1() != ns_ || gate_weights_[w].Dim2() != na_ + 1) { ++ return false; ++ } ++ } ++ if ((type_ == NT_LSTM || type_ == NT_LSTM_SUMMARY) && ns_ != no_) { ++ return false; ++ } + delete softmax_; + if (type_ == NT_LSTM_SOFTMAX || type_ == NT_LSTM_SOFTMAX_ENCODED) { + softmax_ = static_cast(Network::CreateFromFile(fp)); + if (softmax_ == nullptr) { + return false; + } ++ if (softmax_->NumInputs() != ns_ || softmax_->NumOutputs() != no_) { ++ return false; ++ } + } else { + softmax_ = nullptr; + } +diff --git a/src/lstm/networkio.cpp b/src/lstm/networkio.cpp +index 8e1c6679..7a31034b 100644 +--- a/src/lstm/networkio.cpp ++++ b/src/lstm/networkio.cpp +@@ -641,6 +641,7 @@ void NetworkIO::AddTimeStep(int t, TFloat *inout) const { + + // Adds part of a single timestep to floats. + void NetworkIO::AddTimeStepPart(int t, int offset, int num_features, float *inout) const { ++ ASSERT_HOST(offset + num_features <= NumFeatures()); + if (int_mode_) { + const int8_t *line = i_[t] + offset; + for (int i = 0; i < num_features; ++i) { +@@ -662,6 +663,7 @@ void NetworkIO::WriteTimeStep(int t, const TFloat *input) { + // Writes a single timestep from floats in the range [-1, 1] writing only + // num_features elements of input to (*this)[t], starting at offset. + void NetworkIO::WriteTimeStepPart(int t, int offset, int num_features, const TFloat *input) { ++ ASSERT_HOST(offset + num_features <= NumFeatures()); + if (int_mode_) { + int8_t *line = i_[t] + offset; + for (int i = 0; i < num_features; ++i) { +diff --git a/unittest/lstm_layer_test.cc b/unittest/lstm_layer_test.cc +new file mode 100644 +index 00000000..2c874995 +--- /dev/null ++++ b/unittest/lstm_layer_test.cc +@@ -0,0 +1,177 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: lstm_layer_test.cc ++// Description: Tests that an NT_LSTM network layer with mutually ++// inconsistent deserialized dimensions is rejected at ++// load. The forward pass sizes its buffers from na_, no_ ++// and ns_ while the gate weight matrices drive their own ++// dimensions, so a crafted .traineddata performs heap ++// out-of-bounds writes/reads during the first ++// recognition step (e.g. WriteTimeStepPart writing ns_ ++// floats into a source_ buffer sized from na_). ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include "network.h" // for Network, NetworkType ++#include "networkio.h" ++#include "networkscratch.h" ++#include "serialis.h" // for TFile ++#include "stridemap.h" ++ ++#include ++#include ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Appends raw little-endian values to a byte buffer. ++class ByteWriter { ++public: ++ void PutU8(uint32_t v) { data_.push_back(static_cast(v & 0xFF)); } ++ void PutU32(uint32_t v) { ++ for (int i = 0; i < 4; ++i) { ++ data_.push_back(static_cast((v >> (8 * i)) & 0xFF)); ++ } ++ } ++ void PutS32(int32_t v) { PutU32(static_cast(v)); } ++ const std::vector &data() const { return data_; } ++ ++private: ++ std::vector data_; ++}; ++ ++void PutDoubleLE(ByteWriter *w, double d) { ++ union { ++ double d; ++ uint64_t u; ++ } conv; ++ conv.d = d; ++ w->PutU32(static_cast(conv.u & 0xFFFFFFFF)); ++ w->PutU32(static_cast(conv.u >> 32)); ++} ++ ++// A serialized float-mode WeightMatrix with the given dimensions, ++// all weight data zeroed. ++void PutGateMatrix(ByteWriter *w, int32_t dim1, int32_t dim2) { ++ w->PutU8(128); // mode: kDoubleFlag, float mode ++ w->PutS32(dim1); ++ w->PutS32(dim2); ++ PutDoubleLE(w, 0.0); // empty_ cell ++ for (int32_t i = 0; i < dim1 * dim2; ++i) { ++ PutDoubleLE(w, 0.0); ++ } ++} ++ ++// A serialized 1-D NT_LSTM network: header with the given ni/no, na_, ++// then the four gates CI, GI, GF1, GO (GFS is not serialized for 1-D). ++std::vector MakeLstmNetwork(int ni, int no, int32_t na, ++ const int32_t gate_dim1[4], const int32_t gate_dim2[4]) { ++ ByteWriter w; ++ w.PutU8(static_cast(NT_LSTM)); ++ w.PutU8(0); // training: TS_DISABLED ++ w.PutU8(0); // needs_to_backprop ++ w.PutU32(0); // network_flags ++ w.PutU32(static_cast(ni)); ++ w.PutU32(static_cast(no)); ++ w.PutU32(0); // num_weights ++ w.PutU32(0); // name (empty string) ++ w.PutS32(na); ++ for (int g = 0; g < 4; ++g) { ++ PutGateMatrix(&w, gate_dim1[g], gate_dim2[g]); ++ } ++ return w.data(); ++} ++ ++// Builds the input a standalone LSTM layer would receive: one row of ++// the given width with ni features. ++NetworkIO MakeInput(int ni, int width) { ++ StrideMap stride_map; ++ stride_map.SetStride({{1, width}}); ++ NetworkIO input; ++ input.ResizeToMap(false, stride_map, ni); ++ return input; ++} ++ ++// Runs Forward on the loaded network; on unpatched code the out-of- ++// bounds access this regression test guards against fires here. ++void RunForward(Network *net, int ni, int width) { ++ NetworkIO input = MakeInput(ni, width); ++ NetworkScratch scratch; ++ NetworkIO output; ++ net->Forward(false, input, nullptr, &scratch, &output); ++ delete net; ++} ++ ++// na_ must equal ni_ + nf_ + ns_ for a 1-D LSTM; here na_=2 but the ++// CI matrix makes ns_=64, so the layer must be rejected. On unpatched ++// code Forward writes 64 floats at offset ni_=1 into a source_ buffer ++// sized for na_=2 (heap out-of-bounds write). ++TEST(LstmLayerTest, RejectsInconsistentNa) { ++ const int32_t dim1[4] = {64, 64, 64, 64}; ++ const int32_t dim2[4] = {3, 3, 3, 3}; ++ std::vector bytes = MakeLstmNetwork(1, 1, 2, dim1, dim2); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ Network *net = Network::CreateFromFile(&fp); ++ if (net == nullptr) { ++ return; // Fixed: the inconsistent layer is rejected at load. ++ } ++ RunForward(net, 1, 2); ++ FAIL() << "crafted LSTM layer with inconsistent na_ was accepted"; ++} ++ ++// All gate matrices must have dim1 == ns_; here the GI matrix has ++// dim1=9 while ns_=5. On unpatched code the GI gate dot product writes ++// 9 results into a temp line sized for 5 (heap out-of-bounds write). ++TEST(LstmLayerTest, RejectsGateDim1Mismatch) { ++ const int32_t dim1[4] = {5, 9, 5, 5}; ++ const int32_t dim2[4] = {7, 7, 7, 7}; ++ std::vector bytes = MakeLstmNetwork(1, 5, 6, dim1, dim2); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ Network *net = Network::CreateFromFile(&fp); ++ if (net == nullptr) { ++ return; // Fixed: the inconsistent layer is rejected at load. ++ } ++ RunForward(net, 1, 2); ++ FAIL() << "crafted LSTM layer with inconsistent gate dim1 was accepted"; ++} ++ ++// All gate matrices must have dim2 == na_ + 1; here the GI matrix has ++// dim2=9 while na_=6. On unpatched code the GI gate dot product reads ++// 8 inputs from a buffer sized for 6 (heap out-of-bounds read). ++TEST(LstmLayerTest, RejectsGateDim2Mismatch) { ++ const int32_t dim1[4] = {5, 5, 5, 5}; ++ const int32_t dim2[4] = {7, 9, 7, 7}; ++ std::vector bytes = MakeLstmNetwork(1, 5, 6, dim1, dim2); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ Network *net = Network::CreateFromFile(&fp); ++ if (net == nullptr) { ++ return; // Fixed: the inconsistent layer is rejected at load. ++ } ++ RunForward(net, 1, 2); ++ FAIL() << "crafted LSTM layer with inconsistent gate dim2 was accepted"; ++} ++ ++// A fully consistent 1-D LSTM layer must still be accepted and usable. ++TEST(LstmLayerTest, AcceptsConsistentLayer) { ++ const int32_t dim1[4] = {5, 5, 5, 5}; ++ const int32_t dim2[4] = {7, 7, 7, 7}; ++ std::vector bytes = MakeLstmNetwork(1, 5, 6, dim1, dim2); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ Network *net = Network::CreateFromFile(&fp); ++ ASSERT_NE(net, nullptr); ++ RunForward(net, 1, 2); ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index bed16f9806..24c8312552 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -9,6 +9,7 @@ SRCREV = "db0ec62f81b0737fbbe184d8fea40af5738f8eef" SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag=${PV} \ file://CVE-2026-88052.patch \ file://CVE-2026-88048.patch \ + file://CVE-2026-88049.patch \ " DEPENDS = "leptonica" From patchwork Tue Oct 13 09:58:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100586 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0206ECC6B10 for ; Tue, 13 Oct 2026 10:00:30 +0000 (UTC) Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3534.1791885623587896006 for ; Tue, 13 Oct 2026 03:00:23 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=arj/CMPC; spf=pass (domain: gmail.com, ip: 209.85.216.41, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-3a0aaa0fd13so1897207a91.2 for ; Tue, 13 Oct 2026 03:00:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885623; x=1792490423; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=3R3PIVwduR84cNu++N7KgpS36Y6qS/pdF5Wj1ZB5rm8=; b=arj/CMPCimk1RMgFaI77LeUlH0cewQoT/xsBeHi6+ZeP0p5pTO8/H6OvwIwb/e9O9e msrrAUBvVuDyvnfpxr2OTZGubu9Lcfkb03sPu/dYZY6swKY6PmUWiC8eo4PSxDzo3034 w1l5ww6qQjMbSbxTxkpPWUtxP9YGJCf8Z7rDBgLl0uZqoLIRrf9KynxSLcAEIM4Ttc2s JmdzOa5cUcDf+BSUdtSYgx4H12mzA3QdLXAbs05ynAYzVRAXS70fA8j842hkjIinaZSW +W2z8ljwED9ZfMilO9zsmseMz6ZzFykfbRviT50NfYf1qI5JypCjTWGEZRNcSAQJopkJ NqgA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885623; x=1792490423; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=3R3PIVwduR84cNu++N7KgpS36Y6qS/pdF5Wj1ZB5rm8=; b=Cl+pchhdl/V3VQyB4a4J8cBbPoPJhYFLHZvb2BAui3fH2CWGNXIB/U8QGzt7o19acD uzmbsIqLNZ0V4quVZZihDVNGA34qTEh0gaAGQMtNwPCs3Xo04QY0NhAr9LugIxK2lKEw OC66WSJsUhzcrRJpH2GKp7fnx53Gek4ZL35OjxlvPJO/dopxFJP/NadWy78rDiObIXWb TsKqMktZbEj7/b7xwgemUtfL8j1p48gw9Cq72LW2oOfI3Ezf2mYpqIPPopm33xzOFvIm tx5uZWf/yZ4om7UhVK0rh/Zo+wqW/FvArZe9isZWsCVsy4WfALlbQNgydCHxwOY4Vc9N dxlg== X-Gm-Message-State: AFq9FYICuXkJ8VUX1eNMTesxQLieY69iXygxjGr31uGQGMxJrncxp7K7 lPmkEsRHYu81uXBb23yrZsmiVsSklPwuAzJ38sf0AULtgW8QFlw0xz7MO2u+7A== X-Gm-Gg: AYBFou3kIsbjVmD5qkpDIvlKHZsJVtCWYHXgIfgkjYnoXJpGJBmvSDWxphPOtv44EiI PxeDSidZeZME2EROO5kc6mAvg/UHsP4t418fG7najHZ+VYp2HmTSWcdC7QLmfjENY8wFY7u8ZyG 4lot+osXJqTUrseDw0G83AVjEZo0sk+v6MxEv2ZmwjXhULpxixQNAIUGIQG+3P6NvPoBGCGjMgn pzGthi2OLmd6stoYaf2YYKeGRr6pA9l0mOk7fXLpkB8yRgLrBaCfFN067/AK1+ZnPJru8sBWjwF P2nHx5Axrn3hDRFYXVW3TjjnGbopbqw49uDjBg4g7fjBlUbU4sTdLDnmWLyehcqLbaMHs213mV6 y5Il8SE8C+0AMpUNJFdD4EVvp5GaJa0xBZUjs5KR9OanLtRPcu1aIlWBPatkT+umwgapZfhf7/Q pYhv3SIoYY+qm2AC4YHRL/mEQI4spPgCvB1U0KzMQ1OweMU3sfNHh5L9DdlRDVgE8r2WwPyBsf3 oDE2iOYvA8FK/zchdJ3b1wc60nxcqXE5OGLCIOxOg== X-Received: by 2002:a17:90b:4fd0:b0:3a0:9640:8039 with SMTP id 98e67ed59e1d1-3ab3a778837mr10624981a91.30.1791885622642; Tue, 13 Oct 2026 03:00:22 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.03.00.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 03:00:22 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 24/28] tesseract: patch CVE-2026-88050 Date: Tue, 13 Oct 2026 22:58:59 +1300 Message-ID: <20261013095903.3544906-24-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 10:00:30 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130857 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88050 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 4aab0847c2e6b786437d140dd3c589e6773b9224) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88050.patch | 209 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 1 + 2 files changed, 210 insertions(+) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88050.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88050.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88050.patch new file mode 100644 index 0000000000..21fa5e9a67 --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88050.patch @@ -0,0 +1,209 @@ +From 5426c23fe7fe32b62bd5694f68f71772f273c821 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Fri, 21 Aug 2026 16:56:51 +0200 +Subject: [PATCH] Reject recoder code values outside the sane range at load + +RecodedCharID::DeSerialize (hardened by 82727cc to check length_ +only) still read the individual code values as raw signed int32. +UnicharCompress::ComputeCodeRange computes code_range_ as 1 plus the +maximum code using a signed > comparison, so a code value of -1 +never raises the maximum and yields code_range_ = 0. SetupDecoder +then resizes is_valid_start_ to 0 and writes is_valid_start_[code(0)] +on the size-0 vector, an out-of-bounds write at a wild wrapped +index (deterministic crash) on LSTMRecognizer load. A code value of +INT32_MAX instead wraps code_range_ negative and makes resize() +throw. + +Key changes: +- unicharcompress.h: validate each deserialized code value to be + within [0, UINT16_MAX), the same arbitrary cap used elsewhere for + .traineddata counts; reject the recoder otherwise. +- unicharcompress.h/.cpp: add defense-in-depth bounds assertions to + IsValidFirstCode and SetupDecoder, matching the style of the + NetworkIO assertions from 2f4d2f4. +- unittest: add recoder_test, which feeds a crafted UnicharCompress + with a -1 code and an INT32_MAX code and expects DeSerialize to + fail (on unpatched code the -1 case dies on the SEGV in + SetupDecoder, the huge case on the uncaught length_error), plus a + positive control that valid codes load and answer + code_range()/IsValidFirstCode() correctly. + +Reported-by: Zhixi "Jace" Sun +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit c94a5532ee04db5a4919542832fd94caee5ea58f) + +CVE: CVE-2026-88050 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/c94a5532ee04db5a4919542832fd94caee5ea58f] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 ++ + src/ccutil/unicharcompress.cpp | 1 + + src/ccutil/unicharcompress.h | 13 ++++- + unittest/recoder_test.cc | 91 ++++++++++++++++++++++++++++++++++ + 4 files changed, 109 insertions(+), 1 deletion(-) + create mode 100644 unittest/recoder_test.cc + +diff --git a/Makefile.am b/Makefile.am +index 4bcc858b..63ca6686 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1202,6 +1202,7 @@ endif # !DISABLED_LEGACY_ENGINE + check_PROGRAMS += progress_test + check_PROGRAMS += qrsequence_test + check_PROGRAMS += recodebeam_test ++check_PROGRAMS += recoder_test + check_PROGRAMS += rect_test + check_PROGRAMS += resultiterator_test + check_PROGRAMS += scanutils_test +@@ -1435,6 +1436,10 @@ recodebeam_test_SOURCES = unittest/recodebeam_test.cc + recodebeam_test_CPPFLAGS = $(unittest_CPPFLAGS) + recodebeam_test_LDADD = $(TRAINING_LIBS) $(ICU_I18N_LIBS) $(ICU_UC_LIBS) + ++recoder_test_SOURCES = unittest/recoder_test.cc ++recoder_test_CPPFLAGS = $(unittest_CPPFLAGS) ++recoder_test_LDADD = $(TESS_LIBS) ++ + rect_test_SOURCES = unittest/rect_test.cc + rect_test_CPPFLAGS = $(unittest_CPPFLAGS) + rect_test_LDADD = $(TESS_LIBS) +diff --git a/src/ccutil/unicharcompress.cpp b/src/ccutil/unicharcompress.cpp +index f909f76e..b3dd440f 100644 +--- a/src/ccutil/unicharcompress.cpp ++++ b/src/ccutil/unicharcompress.cpp +@@ -400,6 +400,7 @@ void UnicharCompress::SetupDecoder() { + for (unsigned c = 0; c < encoder_.size(); ++c) { + const RecodedCharID &code = encoder_[c]; + decoder_[code] = c; ++ ASSERT_HOST(code(0) >= 0 && code(0) < code_range_); + is_valid_start_[code(0)] = true; + RecodedCharID prefix = code; + uint32_t len = code.length(); +diff --git a/src/ccutil/unicharcompress.h b/src/ccutil/unicharcompress.h +index 9b696d03..6919b7d2 100644 +--- a/src/ccutil/unicharcompress.h ++++ b/src/ccutil/unicharcompress.h +@@ -84,7 +84,17 @@ public: + if (length_ > kMaxCodeLen) { + return false; + } +- return fp->DeSerialize(&code_[0], length_); ++ if (!fp->DeSerialize(&code_[0], length_)) { ++ return false; ++ } ++ // Code values index arrays sized from the maximum code; reject values ++ // that are out of the sane range for a recoded alphabet. ++ for (uint32_t i = 0; i < length_; ++i) { ++ if (code_[i] < 0 || code_[i] >= static_cast(UINT16_MAX)) { ++ return false; ++ } ++ } ++ return true; + } + bool operator==(const RecodedCharID &other) const { + if (length_ != other.length_) { +@@ -190,6 +200,7 @@ public: + int DecodeUnichar(const RecodedCharID &code) const; + // Returns true if the given code is a valid start or single code. + bool IsValidFirstCode(int code) const { ++ ASSERT_HOST(code >= 0 && code < code_range_); + return is_valid_start_[code]; + } + // Returns a list of valid non-final next codes for a given prefix code, +diff --git a/unittest/recoder_test.cc b/unittest/recoder_test.cc +new file mode 100644 +index 00000000..48dfa7ea +--- /dev/null ++++ b/unittest/recoder_test.cc +@@ -0,0 +1,91 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: recoder_test.cc ++// Description: Tests that a UnicharCompress (LSTM recoder) with code ++// values outside the sane range is rejected at load. ++// Negative code values leave code_range_ at zero, so ++// SetupDecoder writes is_valid_start_[code(0)] out of ++// bounds on a size-0 vector; huge code values wrap ++// code_range_ and make resize() throw. ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include "serialis.h" // for TFile ++#include "unicharcompress.h" ++ ++#include ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Appends raw little-endian values to a byte buffer. ++class ByteWriter { ++public: ++ void PutU8(uint32_t v) { data_.push_back(static_cast(v & 0xFF)); } ++ void PutU32(uint32_t v) { ++ for (int i = 0; i < 4; ++i) { ++ data_.push_back(static_cast((v >> (8 * i)) & 0xFF)); ++ } ++ } ++ void PutS32(int32_t v) { PutU32(static_cast(v)); } ++ const std::vector &data() const { return data_; } ++ ++private: ++ std::vector data_; ++}; ++ ++// A serialized UnicharCompress with one length-1 RecodedCharID per ++// given code value (self-normalizing). ++std::vector MakeRecoder(const std::vector &codes) { ++ ByteWriter w; ++ w.PutU32(codes.size()); ++ for (int32_t code : codes) { ++ w.PutU8(1); // self_normalized_ ++ w.PutU32(1); // length_ ++ w.PutS32(code); // code_[0] ++ } ++ return w.data(); ++} ++ ++// A recoder code of -1 keeps code_range_ at 0, so on unpatched code ++// SetupDecoder performs an out-of-bounds write into the size-0 ++// is_valid_start_ vector. ++TEST(RecoderTest, RejectsNegativeCode) { ++ std::vector bytes = MakeRecoder({-1}); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ UnicharCompress recoder; ++ EXPECT_FALSE(recoder.DeSerialize(&fp)); ++} ++ ++// A recoder code of INT32_MAX wraps code_range_ to a negative value, ++// so on unpatched code SetupDecoder's resize() throws. ++TEST(RecoderTest, RejectsHugeCode) { ++ std::vector bytes = MakeRecoder({INT32_MAX}); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ UnicharCompress recoder; ++ EXPECT_FALSE(recoder.DeSerialize(&fp)); ++} ++ ++// A valid recoder must still be accepted and usable. ++TEST(RecoderTest, AcceptsValidCodes) { ++ std::vector bytes = MakeRecoder({0, 1}); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ UnicharCompress recoder; ++ ASSERT_TRUE(recoder.DeSerialize(&fp)); ++ EXPECT_EQ(recoder.code_range(), 2); ++ EXPECT_TRUE(recoder.IsValidFirstCode(0)); ++ EXPECT_TRUE(recoder.IsValidFirstCode(1)); ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index 24c8312552..6acedcee98 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -10,6 +10,7 @@ SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag file://CVE-2026-88052.patch \ file://CVE-2026-88048.patch \ file://CVE-2026-88049.patch \ + file://CVE-2026-88050.patch \ " DEPENDS = "leptonica" From patchwork Tue Oct 13 09:59:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100584 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id EDD43CC6B08 for ; Tue, 13 Oct 2026 10:00:28 +0000 (UTC) Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3442.1791885626963285157 for ; Tue, 13 Oct 2026 03:00:27 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=gwMbKof2; spf=pass (domain: gmail.com, ip: 209.85.216.49, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-3ab2bf5e75bso1418905a91.3 for ; Tue, 13 Oct 2026 03:00:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885626; x=1792490426; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=W2azljDXcg9TEmoasMdOM7wxqWIT/xnZVzzgM+sCy6w=; b=gwMbKof2y/J9QUyAXBaBdeyQbUCZFP7n9Kc3myglCkw/QMjBy80mYbZTK7UKcKDHIf PgUCvqc1lB6109jDcqRbFWeOusikw5sSuLYKiDrKEUEeSrIRil2h8PfdnbeJH49MblF7 2f7M25MQbIBk+nvPffs5eQFIFWe8Msnnndn+fN+3SaayWyP4HES1Jmn+Zngn14cxmRcN oah0MF3ywpzMN0zgiA7KHfju9fFJW3HUFQAd5L2DxABFi8x24MOifU7e5rG4jsApfwSp py3/ZsZ0dAsx03rvQBEHPdYD8BSVoUR0TwSGPjxZvGeAUu9lXhUKLb5Vg5MQ+g3pKTha +FJw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885626; x=1792490426; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=W2azljDXcg9TEmoasMdOM7wxqWIT/xnZVzzgM+sCy6w=; b=dPXd7GVSIP3403ELLrTbhhNMRp1Q5BtPPMxSfwBzpjaJ++oX3tTLDWfrV6IUWQjqE0 kJlUZaW/jdZHs7gj/FVvMUiXiurfLiL3KPC/5h4u47m9BxiICjJJrQYzJIrbdW9uJZYV mhAm4O39D5FQfGzaz/lZ+TzFDWFP4cAY0qxtZoIFJUXnFojH1Q9OVGbC5ctSIYgbe5NI bpAx/nR2MuZ9+B7tYuJvEvaKgxB7Oo3BPeCw4R1cUH/2SQSOY/zW0Y438LUdY6+M+jNj q6ul66ZdLigosV3GG/NvLIYWfVU59KbLsda70TqFzHxF5WVTf/m+elrieNlfy/9vL0g3 MbVA== X-Gm-Message-State: AFq9FYITXu1NX2F9Vkmo7XQFempNOQq041417BgEmE/7rGDcbO6EzlIF +6KvIxwafrSsIOeHYNtOWrm81faMxkK32TBwCKw18txJi8iGubmVmtQMbzsAeQ== X-Gm-Gg: AYBFou0Hgje3ab25KARHjQpt5HNDq72f4/fRy0dVHhi710UdCZXct8YvSFwX/xGDhZk Mxjf+az9YsMstXMXTa3OjTydzSw1BLacZWr4wkjbTS2CmtJLqqhsQAahbgGwDjBx3mGiQyDUI3c hzhBKPx6f9usCD79LnV8FXQrinbR0Nlz5CsIIwB8qWxziRE2EIEz7j64hSYB2K65o/G1NfuOyXx Wa32+d9V4zfFny9ziWdiI4peWwXMYDI5bsktJtLwPOGUPZgh8hTMThJUoegBgVKznesyngrhjIf 1KGzZgEtGfV1bD+/FqA7cANeOLWgj+txZgFeIcpIjTTHRePIXR1sMARG0D6ZL8XGITzfRoZAOXr HU2lCE5k4MB8u5IUnxTV3pSvtC95a+v8oWdb6PZhB7v0B8WVecOsKg0OmgrOMdpJlFIaDtZdz1r 1Dud8ckOJQsX/Yh9iMRrA83WldU4NMfDIehOGEeVln/AHyi4f01zJFiB0GKka/P80/7rAlN3w2n V72NhPyIN/ESH0aVlTZjZkUl/SuQAbY0r9tz6X5BefUdh/6Vg== X-Received: by 2002:a17:90b:134c:b0:3a8:92a3:8baa with SMTP id 98e67ed59e1d1-3ab3a953bd3mr9926494a91.27.1791885625797; Tue, 13 Oct 2026 03:00:25 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.03.00.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 03:00:25 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 25/28] tesseract: patch CVE-2026-88047 Date: Tue, 13 Oct 2026 22:59:00 +1300 Message-ID: <20261013095903.3544906-25-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 10:00:28 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130858 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88047 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit b8fa7aac9168b6ebfdcc2ea3493c332f0db69491) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88047.patch | 225 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 1 + 2 files changed, 226 insertions(+) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88047.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88047.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88047.patch new file mode 100644 index 0000000000..780f686e61 --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88047.patch @@ -0,0 +1,225 @@ +From e974684acbe3aeb6bc6192b06a048537c345b713 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Mon, 24 Aug 2026 13:39:22 +0200 +Subject: [PATCH] Limit unichar extraction in ReadNormProtos to the buffer size + +Classify::ReadNormProtos parsed each normproto line with +`stream >> unichar >> NumProtos` into a char unichar[2 * UNICHAR_LEN + 1] +stack buffer, but char* extraction from an istream has no length limit +(the stream width was never set). A crafted TESSDATA_NORMPROTO component +in a .traineddata file whose first proto-line token exceeds 60 +characters (the 100-byte line buffer allows up to 99) overflows the +stack buffer during legacy engine initialization (CWE-121). + +Toolchain note: Apple's libc++ provides a C++20 array overload of +operator>>(basic_istream&, char(&)[N]) that implicitly bounds the +extraction to the array size, so builds against that standard library +are incidentally protected. Standard libraries without that overload +(e.g. libstdc++) still take the unbounded char* overload, so the +explicit width limit below makes the behavior defined on all +toolchains. + +Key changes: +- normmatch.cpp: read the unichar token with + std::setw(2 * UNICHAR_LEN + 1); char* extraction takes at most + width - 1 characters, which fits the buffer exactly. Overlong + tokens are truncated and the line is rejected like any other + unparseable line. +- unittest: add normproto_test covering a 99-character token (the + maximum a 100-byte line can hold), a token of exactly 2 * + UNICHAR_LEN characters, and a well-formed component. A minimal + reproduction of the unbounded extraction crashes an ASan build + with a stack-buffer-overflow. + +Reported-by: Tristan Madani +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit 1bda5079b1c8a7e25f523486837426903d29ce84) + +CVE: CVE-2026-88047 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/1bda5079b1c8a7e25f523486837426903d29ce84] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 ++ + src/classify/normmatch.cpp | 6 +- + unittest/CMakeLists.txt | 1 + + unittest/normproto_test.cc | 111 +++++++++++++++++++++++++++++++++++++ + 4 files changed, 122 insertions(+), 1 deletion(-) + create mode 100644 unittest/normproto_test.cc + +diff --git a/Makefile.am b/Makefile.am +index 63ca6686..cc748455 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1184,6 +1184,7 @@ check_PROGRAMS += mastertrainer_test + endif # !DISABLED_LEGACY_ENGINE + check_PROGRAMS += matrix_test + check_PROGRAMS += networkio_test ++check_PROGRAMS += normproto_test + if ENABLE_TRAINING + check_PROGRAMS += normstrngs_test + endif # ENABLE_TRAINING +@@ -1388,6 +1389,10 @@ networkio_test_SOURCES = unittest/networkio_test.cc + networkio_test_CPPFLAGS = $(unittest_CPPFLAGS) + networkio_test_LDADD = $(TESS_LIBS) + ++normproto_test_SOURCES = unittest/normproto_test.cc ++normproto_test_CPPFLAGS = $(unittest_CPPFLAGS) ++normproto_test_LDADD = $(TESS_LIBS) ++ + normstrngs_test_SOURCES = unittest/normstrngs_test.cc + normstrngs_test_CPPFLAGS = $(unittest_CPPFLAGS) + normstrngs_test_LDADD = $(TRAINING_LIBS) $(ICU_I18N_LIBS) $(ICU_UC_LIBS) +diff --git a/src/classify/normmatch.cpp b/src/classify/normmatch.cpp +index d5bd7e6a..1ce7c928 100644 +--- a/src/classify/normmatch.cpp ++++ b/src/classify/normmatch.cpp +@@ -28,6 +28,7 @@ + + #include + #include ++#include // for std::setw + #include // for std::istringstream + + namespace tesseract { +@@ -190,7 +191,10 @@ NORM_PROTOS *Classify::ReadNormProtos(TFile *fp) { + while (fp->FGets(line, kMaxLineSize) != nullptr) { + std::istringstream stream(line); + stream.imbue(std::locale::classic()); +- stream >> unichar >> NumProtos; ++ // unichar holds at most 2 * UNICHAR_LEN characters; the width limit ++ // (width - 1 characters for char* extraction) keeps the extraction ++ // from overflowing the buffer on overlong lines. ++ stream >> std::setw(2 * UNICHAR_LEN + 1) >> unichar >> NumProtos; + if (stream.fail()) { + continue; + } +diff --git a/unittest/CMakeLists.txt b/unittest/CMakeLists.txt +index a660c9b1..4c677a60 100644 +--- a/unittest/CMakeLists.txt ++++ b/unittest/CMakeLists.txt +@@ -59,6 +59,7 @@ set(LEGACY_TESTS + indexmapbidi_test.cc + intfeaturemap_test.cc + mastertrainer_test.cc ++ normproto_test.cc + osd_test.cc + params_model_test.cc + shapetable_test.cc +diff --git a/unittest/normproto_test.cc b/unittest/normproto_test.cc +new file mode 100644 +index 00000000..574b2f3d +--- /dev/null ++++ b/unittest/normproto_test.cc +@@ -0,0 +1,111 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: normproto_test.cc ++// Description: Tests that Classify::ReadNormProtos handles a normproto ++// line whose first (unichar) token exceeds the ++// unichar[2 * UNICHAR_LEN + 1] stack buffer. The ++// istream extraction has no intrinsic length limit, so a ++// crafted NORMPROTO component in a .traineddata file ++// could overflow the stack buffer during legacy engine ++// initialization. ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include "classify.h" ++#include "serialis.h" // for TFile ++ ++#include ++#include ++#include ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Minimal unicharset (space and 'a'). ++const char kMinUnicharset[] = ++ "2\n" ++ "NULL 1 0,255,0,255,0,0,0,0,0,0 Latin 2 0 2\n" ++ "a 1 0,255,0,255,0,0,0,0,0,0 Latin 2 0 2\n"; ++ ++// Builds a normproto component: a sample-size line (5), five parameter ++// description lines, then the given raw proto lines. ++std::vector MakeNormproto(const std::string &lines) { ++ std::string data = "5\n"; ++ for (int i = 0; i < 5; ++i) { ++ data += "e e 0 1\n"; ++ } ++ data += lines; ++ return std::vector(data.begin(), data.end()); ++} ++ ++class NormprotoTest : public testing::Test { ++protected: ++ void SetUp() override { ++ tmpl_ = "/tmp/tess_normproto_test_XXXXXX"; ++ char *dir = mkdtemp(tmpl_.data()); ++ ASSERT_NE(dir, nullptr); ++ dir_ = dir; ++ std::string uc_path = dir_ + "/eng.unicharset"; ++ FILE *f = fopen(uc_path.c_str(), "w"); ++ ASSERT_NE(f, nullptr); ++ ASSERT_EQ(fwrite(kMinUnicharset, 1, sizeof(kMinUnicharset) - 1, f), ++ sizeof(kMinUnicharset) - 1); ++ fclose(f); ++ // Load the minimal unicharset into the classifier's inherited ++ // unicharset member. ++ ASSERT_TRUE(classifier_.unicharset.load_from_file(uc_path.c_str())); ++ } ++ void TearDown() override { ++ std::remove((dir_ + "/eng.unicharset").c_str()); ++ rmdir(dir_.c_str()); ++ } ++ std::string dir_; ++ std::string tmpl_; ++ Classify classifier_; ++}; ++ ++// A 99-character first token (the maximum FGets can return) overflows ++// unichar[2 * UNICHAR_LEN + 1] on unpatched code; the width-limited ++// extraction must reject the line instead. ++TEST_F(NormprotoTest, ToleratesOverlongUnicharToken) { ++ std::vector bytes = MakeNormproto(std::string(99, 'A') + "\n"); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ classifier_.NormProtos = classifier_.ReadNormProtos(&fp); ++ ASSERT_NE(classifier_.NormProtos, nullptr); ++ classifier_.FreeNormProtos(); ++ EXPECT_EQ(classifier_.NormProtos, nullptr); ++} ++ ++// A token of exactly 2 * UNICHAR_LEN characters is the maximum legitimate ++// size; it must not be truncated or rejected by the width limit. ++TEST_F(NormprotoTest, ToleratesMaxLenUnicharToken) { ++ std::vector bytes = MakeNormproto(std::string(2 * UNICHAR_LEN, 'A') + " 0\n"); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ classifier_.NormProtos = classifier_.ReadNormProtos(&fp); ++ ASSERT_NE(classifier_.NormProtos, nullptr); ++ classifier_.FreeNormProtos(); ++ EXPECT_EQ(classifier_.NormProtos, nullptr); ++} ++ ++// A well-formed normproto component must still parse. ++TEST_F(NormprotoTest, ReadsValidNormprotos) { ++ std::vector bytes = MakeNormproto("a 0\n"); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ classifier_.NormProtos = classifier_.ReadNormProtos(&fp); ++ ASSERT_NE(classifier_.NormProtos, nullptr); ++ classifier_.FreeNormProtos(); ++ EXPECT_EQ(classifier_.NormProtos, nullptr); ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index 6acedcee98..25d357d903 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -11,6 +11,7 @@ SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag file://CVE-2026-88048.patch \ file://CVE-2026-88049.patch \ file://CVE-2026-88050.patch \ + file://CVE-2026-88047.patch \ " DEPENDS = "leptonica" From patchwork Tue Oct 13 09:59:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100588 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E0B2CC6B08 for ; Tue, 13 Oct 2026 10:00:39 +0000 (UTC) Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3538.1791885629822119334 for ; Tue, 13 Oct 2026 03:00:29 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=mudIBfqm; spf=pass (domain: gmail.com, ip: 209.85.216.45, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-3aacde0cc0fso1041897a91.2 for ; Tue, 13 Oct 2026 03:00:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885629; x=1792490429; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=4LFV5BDa5k3G5pVC9Yn1kpg0hPNqgW+fbIO2Z4XRXf0=; b=mudIBfqmIr2AVmABVoUpk7Jg45AAsqyODjvYU/110bMcvxdq9aSBhJujYxBR44ZvKv 3dh2HlPKDrdWbjTxE/7fU6ZdGZwi6yelEFqApIlSVAqbe1H7YZPlW34h+P+9UdQSGCyV S/svILzVvRuQxvQUT92oCkBA7sB1zzxPlMYHwYzE5RoPGrXu8XwVJPhTeHp4lnTykpTP HVe1eEycTcBFhLVpfjGERPc+efh+sTeaHazeTiNdzFxZOgBLUikJZTHA0j9+ezg+q3Ow BdSkgdIb0LA9yn76uZf14Yls+rbfkksEwgleXbFRKB0RcxiAxSQAiqrTKNqFQOY+TMPl PWkA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885629; x=1792490429; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=4LFV5BDa5k3G5pVC9Yn1kpg0hPNqgW+fbIO2Z4XRXf0=; b=C6kFizoM4j6EiUXBoszKmWAJOC9fR0As9foYj0Tj1J/CMgrCHsZJC+dMCAc6zcpCF8 pg/ms/9TBlwIs7MgkE2krAFiNU/zaZkWFtus3gekt0Zcgc4DoSRCBR48SpOo+1Mr05bC u96cq8ld8anZoI5TnKU1F/mg/HZ8spfcS6BHM1Xtk1m/VBgmsF2Eid+dbBeLhoJfQbxF 40vWsWER3u0LyaoOU0XE4arTmtiwJYvZ+Hh82S41flbK/210rHhjRLCFup632njVvqgJ ggcb/RD9OBHa3sSWw3Kg/JZT8Zu+Muau8N3eAvenEMz5bmpOui0pHBD2OX1u3vpMFYGF 0/Ew== X-Gm-Message-State: AFq9FYJLkRcyVZfwNPF3AayMuGp8/KKaekZ+8ARGhN0kt+nIOLS9n/Vb 2tgMdzewV9pR3oIpdPDuMK1nAJosr2rtVjZ9fbL6xg+OqpvGZX4HAiAYPCqAlQ== X-Gm-Gg: AYBFou0TgyloIS5A78F9YMzaKep9WleIwDGyoLOfSOwUW1iOlrCLuIVlgJSn9mUu3D/ j8Dod3TKknhcl00eSv6VnsSiDNparyjfqs9ujvBceM5DzZ98ecSDyxu0apvMGbSc2bqJTLyXtgK gcRE0B3PeW4sMFhOoS0tpTemPWbRRBI3CWlFglNeOmQ2BI2fxokuAWo9jqmgmr00dvxZd8YlSBW RDg+loSZZ2UluTsXGgUxxlP8bQjzU+53tKdsst1pbRrDh5kSOfj7/2fqlVy495NbApOFz9+zZHb SFclNtTZRf+cC6Bn5o/nKDUFvmZ9pR+mSw7pWvsuJ1QQ1MKwJxqv7Pl8HZlA+uy/C9o/ESywuZq 8D3ZxDgSqXR8fKBtWUkBbnfJ9kctArbe69/UKvRg1DYIZNybZARQ9ppH+NTuh37utFoZhbcKM2W rY3dWfcT4yF57KiGTAPxlMNISpxqNn9eMGCQisN2HIYTEZUPhjfx/vOYHvqNWWCw+nnhdWmyPya wIGkRZuMeALAjfQkKQeFCOYT80jnVqT7jnZQKY= X-Received: by 2002:a17:90a:ec87:b0:3ac:5ca:c7a8 with SMTP id 98e67ed59e1d1-3ac05cac819mr3354335a91.60.1791885628858; Tue, 13 Oct 2026 03:00:28 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.03.00.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 03:00:27 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 26/28] tesseract: patch CVE-2026-88051 Date: Tue, 13 Oct 2026 22:59:01 +1300 Message-ID: <20261013095903.3544906-26-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 10:00:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130859 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88051 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 727354dae2ee3075ad388bcfe22156ab1ea6fcf5) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88051.patch | 184 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 1 + 2 files changed, 185 insertions(+) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88051.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88051.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88051.patch new file mode 100644 index 0000000000..1956d49672 --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88051.patch @@ -0,0 +1,184 @@ +From 79bf602b0cd5216c125f86eaf3c768daae256930 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Fri, 21 Aug 2026 20:29:37 +0200 +Subject: [PATCH] Validate vector counts in GenericVector::read + +The callback form of GenericVector::read read two independent int32 +fields from the file: reserved sized the allocation via reserve(), +while size_used_ drove the element loop. Neither was capped and no +size_used_ <= reserved invariant was checked, so a crafted +.traineddata (e.g. the fontinfo table of a version >= 4 inttemp +component) performed a heap out-of-bounds write during legacy +engine initialization. + +Key changes: +- genericvector.h: reject negative or over-limit reserved + (matching the 50000000 cap of the DeSerialize overloads) and + reject size_used_ < 0 or size_used_ > reserved before entering + the read loop. Legit files always satisfy size_used_ <= reserved, + as write() persists size_reserved_ first. +- unittest: add genericvector_test covering size_used_ beyond + reserved (on unpatched code the ASan build dies on a + heap-buffer-overflow in the read loop), negative counts, and a + consistent vector that must still load. + +Reported-by: Zhixi "Jace" Sun +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit 56e09ca12e751623fe796ce1554ce704bffd2ef0) + +CVE: CVE-2026-88051 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/56e09ca12e751623fe796ce1554ce704bffd2ef0] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 ++ + src/ccutil/genericvector.h | 10 ++++ + unittest/genericvector_test.cc | 91 ++++++++++++++++++++++++++++++++++ + 3 files changed, 106 insertions(+) + create mode 100644 unittest/genericvector_test.cc + +diff --git a/Makefile.am b/Makefile.am +index cc748455..c67f0f63 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1159,6 +1159,7 @@ check_PROGRAMS += equationdetect_test + endif # !DISABLED_LEGACY_ENGINE + check_PROGRAMS += fileio_test + check_PROGRAMS += fullyconnected_test ++check_PROGRAMS += genericvector_test + check_PROGRAMS += heap_test + check_PROGRAMS += imagedata_test + if !DISABLED_LEGACY_ENGINE +@@ -1298,6 +1299,10 @@ fullyconnected_test_SOURCES = unittest/fullyconnected_test.cc + fullyconnected_test_CPPFLAGS = $(unittest_CPPFLAGS) + fullyconnected_test_LDADD = $(TESS_LIBS) + ++genericvector_test_SOURCES = unittest/genericvector_test.cc ++genericvector_test_CPPFLAGS = $(unittest_CPPFLAGS) ++genericvector_test_LDADD = $(TESS_LIBS) ++ + heap_test_SOURCES = unittest/heap_test.cc + heap_test_CPPFLAGS = $(unittest_CPPFLAGS) + heap_test_LDADD = $(TESS_LIBS) +diff --git a/src/ccutil/genericvector.h b/src/ccutil/genericvector.h +index 4a5bbe12..cbe1e203 100644 +--- a/src/ccutil/genericvector.h ++++ b/src/ccutil/genericvector.h +@@ -654,10 +654,20 @@ bool GenericVector::read(TFile *f, const std::function &c + if (f->FReadEndian(&reserved, sizeof(reserved), 1) != 1) { + return false; + } ++ // Arbitrarily limit the number of elements to protect against bad data. ++ const uint32_t limit = 50000000; ++ if (reserved < 0 || static_cast(reserved) > limit) { ++ return false; ++ } + reserve(reserved); + if (f->FReadEndian(&size_used_, sizeof(size_used_), 1) != 1) { + return false; + } ++ // size_used_ is an independent file field; without this check the reads ++ // below land past the end of the buffer sized from reserved. ++ if (size_used_ < 0 || size_used_ > reserved) { ++ return false; ++ } + if (cb != nullptr) { + for (int i = 0; i < size_used_; ++i) { + if (!cb(f, data_ + i)) { +diff --git a/unittest/genericvector_test.cc b/unittest/genericvector_test.cc +new file mode 100644 +index 00000000..269b00f0 +--- /dev/null ++++ b/unittest/genericvector_test.cc +@@ -0,0 +1,91 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: genericvector_test.cc ++// Description: Tests that the callback form of GenericVector::read ++// rejects vectors whose size_used_ exceeds reserved (or ++// whose counts are negative). reserved sizes the buffer ++// while size_used_ is an independent file field driving ++// the element loop, so a crafted .traineddata (e.g. the ++// fontinfo table of a version >= 4 inttemp component) ++// performs a heap out-of-bounds write during legacy ++// engine initialization. ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include "genericvector.h" ++#include "serialis.h" // for TFile ++ ++#include ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Appends raw little-endian values to a byte buffer. ++class ByteWriter { ++public: ++ void PutS32(int32_t v) { ++ uint32_t u = static_cast(v); ++ for (int i = 0; i < 4; ++i) { ++ data_.push_back(static_cast((u >> (8 * i)) & 0xFF)); ++ } ++ } ++ const std::vector &data() const { return data_; } ++ ++private: ++ std::vector data_; ++}; ++ ++// A serialized vector header (reserved, size_used_) followed by the ++// given number of int32 elements. ++std::vector MakeVector(int32_t reserved, int32_t size_used, int32_t num_elements) { ++ ByteWriter w; ++ w.PutS32(reserved); ++ w.PutS32(size_used); ++ for (int32_t i = 0; i < num_elements; ++i) { ++ w.PutS32(i); ++ } ++ return w.data(); ++} ++ ++// reserved=4 but size_used_=0x10000: on unpatched code the callback ++// loop writes 65536 ints past the 4-int buffer (heap out-of-bounds ++// write). ++TEST(GenericVectorTest, RejectsSizeUsedBeyondReserved) { ++ std::vector bytes = MakeVector(4, 0x10000, 0x10000); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ GenericVector v; ++ EXPECT_FALSE(v.read(&fp, [](TFile *f, int *p) { return f->DeSerialize(p); })); ++} ++ ++// Negative counts must be rejected; on unpatched code the read ++// "succeeds" and leaves size_used_ negative. ++TEST(GenericVectorTest, RejectsNegativeCounts) { ++ std::vector bytes = MakeVector(-1, -1, 0); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ GenericVector v; ++ EXPECT_FALSE(v.read(&fp, [](TFile *f, int *p) { return f->DeSerialize(p); })); ++} ++ ++// A consistent vector must still be accepted. ++TEST(GenericVectorTest, AcceptsConsistentVector) { ++ std::vector bytes = MakeVector(4, 2, 2); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ GenericVector v; ++ ASSERT_TRUE(v.read(&fp, [](TFile *f, int *p) { return f->DeSerialize(p); })); ++ EXPECT_EQ(v.size(), 2); ++ EXPECT_EQ(v[0], 0); ++ EXPECT_EQ(v[1], 1); ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index 25d357d903..be6ec1e463 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -12,6 +12,7 @@ SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag file://CVE-2026-88049.patch \ file://CVE-2026-88050.patch \ file://CVE-2026-88047.patch \ + file://CVE-2026-88051.patch \ " DEPENDS = "leptonica" From patchwork Tue Oct 13 09:59:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100589 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id EF62ECC6B10 for ; Tue, 13 Oct 2026 10:00:39 +0000 (UTC) Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3444.1791885633627271504 for ; Tue, 13 Oct 2026 03:00:33 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=KxBJ4m0f; spf=pass (domain: gmail.com, ip: 209.85.216.54, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-3ab98332238so1358115a91.3 for ; Tue, 13 Oct 2026 03:00:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885633; x=1792490433; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Ug9eKCO58Y4VLl98m5Gdv4zQb9sK2CAyt5HE5vVxfgI=; b=KxBJ4m0fEeE7dVMoVhH4gMZsFw5tRcKkOxcM+VsTjUhvsvit8sAc2uPatwQYb4d+5J 0eaUYTzubtEafbepr+32+/GMBlKGyBlwZ1dod3i7AoA0GaGG4WO8qABsMPOu3sfsv4vO XmsO2rwEzubpFnDQzjSsU8xe1oURMTRQ4G4Ofoo7AmEMZhi5w5ycE1i+1F8Xlu+AQTEq PFdyQ+FLg5cFjtGChmwubbAPz3wWcjcfWMfIilWLPKJSzr5jr3Qt5UEUlGe5PU9lbQBR 60+oRL7W8+jrrxj380t/Yqko85RyXonPe9d8gkhRo/6IaziRjLbJHxqNturKPbWZoB7k x8gA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885633; x=1792490433; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Ug9eKCO58Y4VLl98m5Gdv4zQb9sK2CAyt5HE5vVxfgI=; b=SvIIlw2UzgpeMU9aL813vyRZAkLay2oiZrCfNBRNUSeKdL1wunUsZBkTHjH04aJFvV jL/lQ97soap+B5GoKIgwY27cAo3PHZxsHa5UgVDpFDPFa5i+DeiMLb9eX4SgnvkSdb0W tZt0OLEVZhxAaD1QH+wiezDGXVupEIaCXAVKn/1fA6AJvjWFWEOU8R+PB9800cCRxhdz d3PQnyTmbLpfXaSB6ubYDQnulLyZXUywVYJJoNPu4hEBRvDKaDjdBDIpy3BCAyGf3OdI Yd4bfO0rhMYVN/A6Q9b6vUBrmSuzPyj+Uy/M3/u6GPznpM9uQxbVAfAMmjflREdooUS7 ptUA== X-Gm-Message-State: AFq9FYK1+ndHhT8vvIJ6C7nV3nVSEW3vLvfX0Xt+ymNxcMEKans5N2x7 2t3s2A/VWOUR3w/W+3ZUIyC6uEmGHfuldshR2PC+46tHqrXjqOnagqYWhM7cTQ== X-Gm-Gg: AYBFou3QuvWmQH0b0wQIDttBPXtLq5n8Sdx38YkDI5djYuUqojrIIP5xY2x+d2hWnC1 8vtJW+oUNtFsiWVqux25OwDBQ7NVvOIsKokn1Zz4PC33LNuhTd1t0kFq2pWTP36Qw3rz70JJYec oTbs1I43UDYhTU4WaEMrkjX9JRok8FKOLpU9I2apS6AawyVnHL5MTEhdu/PtqI144DsqWEmmo/X J7x//tCF5DykBnziYu9kidfYfu+2bLvWOk14PXS5TJjTzelWxTt6Y7LI5vOp1kQtnP6P5soyd/T q9fgRzyxLNkVncSE7AwInPXjIG7XO3sChm8H6YZbfsLJVHgP2YEhqK0VXKzJ42xYW8GLElF7pTw O9Ehsot+tGbazxbOh/Rby8R4HFG66vzZ7q+EcF/S//YtmPj9sKnt+mPcRfNqD8Z9Rah3whDAaZ9 zNBOOOmHumM57q/uIK6+nHjv4ZNJAYS9UD3Ec8A2pmslkxk6CkufubtktMhg9WVYr1PVmLVR7PH KNjuOnQZPBETF+Wr/uV1dUVfAXWYYdwgewaOCc= X-Received: by 2002:a17:90b:3a48:b0:3a7:8350:3f7e with SMTP id 98e67ed59e1d1-3ab3ae76c0bmr8669282a91.44.1791885632641; Tue, 13 Oct 2026 03:00:32 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.03.00.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 03:00:31 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 27/28] tesseract: patch CVE-2026-88054 Date: Tue, 13 Oct 2026 22:59:02 +1300 Message-ID: <20261013095903.3544906-27-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 10:00:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130860 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88054 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 4c00053135fb03b6043c960dc96a839b675f7eec) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88054.patch | 274 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 1 + 2 files changed, 275 insertions(+) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88054.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88054.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88054.patch new file mode 100644 index 0000000000..32e70c0f6f --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88054.patch @@ -0,0 +1,274 @@ +From 83bbac0975f52a5171776fddcc800a2aaa5206a3 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Fri, 21 Aug 2026 14:38:55 +0200 +Subject: [PATCH] Reject empty network stacks in LSTM .traineddata + deserialization + +Plumbing::DeSerialize read the network stack size from the untrusted +TESSDATA_LSTM component and only rejected size > 10000. A crafted +.traineddata with a top-level Series/Parallel/Reversed layer with an +empty stack survived load; LSTMRecognizer initialization then called +network_->CacheXScaleFactor(network_->XScaleFactor()), which +dereferences stack_[0] on the empty vector: +- Series: Series::CacheXScaleFactor (series.cpp) +- Parallel/Reversed: inherited Plumbing::XScaleFactor +The virtual call through the wild pointer crashed the process at +initialization (deterministic denial of service). + +Key changes: +- plumbing.cpp: reject size == 0 for all plumbing types, and + size < 2 for NT_SERIES (Series::Forward requires two or more + networks and always aborts on one). +- tessedit.cpp: fail the language load gracefully when the LSTM model + cannot be loaded, instead of aborting via ASSERT_HOST, so + TessBaseAPI::Init returns -1 on corrupt traineddata. +- unittest: add plumbing_test, which builds a minimal traineddata + with empty/undersized LSTM plumbing stacks and expects a graceful + init failure. On unpatched code the tests die on the original + SEGV in Series::CacheXScaleFactor / Plumbing::XScaleFactor. + +Reported-by: Zhixi "Jace" Sun +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit 552771236b0d80cbdb0c7dd856120fa21a4672e5) + +CVE: CVE-2026-88054 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/552771236b0d80cbdb0c7dd856120fa21a4672e5] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 ++ + src/ccmain/tessedit.cpp | 7 +- + src/lstm/plumbing.cpp | 6 ++ + unittest/plumbing_test.cc | 165 ++++++++++++++++++++++++++++++++++++++ + 4 files changed, 182 insertions(+), 1 deletion(-) + create mode 100644 unittest/plumbing_test.cc + +diff --git a/Makefile.am b/Makefile.am +index c67f0f63..a6ee0931 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1198,6 +1198,7 @@ if ENABLE_TRAINING + check_PROGRAMS += pango_font_info_test + endif # ENABLE_TRAINING + check_PROGRAMS += paragraphs_test ++check_PROGRAMS += plumbing_test + if !DISABLED_LEGACY_ENGINE + check_PROGRAMS += params_model_test + endif # !DISABLED_LEGACY_ENGINE +@@ -1427,6 +1428,10 @@ paragraphs_test_SOURCES = unittest/paragraphs_test.cc + paragraphs_test_CPPFLAGS = $(unittest_CPPFLAGS) + paragraphs_test_LDADD = $(TESS_LIBS) + ++plumbing_test_SOURCES = unittest/plumbing_test.cc ++plumbing_test_CPPFLAGS = $(unittest_CPPFLAGS) ++plumbing_test_LDADD = $(TESS_LIBS) ++ + if !DISABLED_LEGACY_ENGINE + params_model_test_SOURCES = unittest/params_model_test.cc + params_model_test_CPPFLAGS = $(unittest_CPPFLAGS) +diff --git a/src/ccmain/tessedit.cpp b/src/ccmain/tessedit.cpp +index 7ec89bd9..722ed09b 100644 +--- a/src/ccmain/tessedit.cpp ++++ b/src/ccmain/tessedit.cpp +@@ -169,7 +169,12 @@ bool Tesseract::init_tesseract_lang_data(const std::string &language, OcrEngineM + #endif // ndef DISABLED_LEGACY_ENGINE + if (mgr->IsComponentAvailable(TESSDATA_LSTM)) { + lstm_recognizer_ = new LSTMRecognizer(language_data_path_prefix.c_str()); +- ASSERT_HOST(lstm_recognizer_->Load(this->params(), lstm_use_matrix ? language : "", mgr)); ++ if (!lstm_recognizer_->Load(this->params(), lstm_use_matrix ? language : "", mgr)) { ++ delete lstm_recognizer_; ++ lstm_recognizer_ = nullptr; ++ tprintf("Error: Failed to load the LSTM model from %s\n", tessdata_path.c_str()); ++ return false; ++ } + } else { + #ifdef DISABLED_LEGACY_ENGINE + // The legacy engine is compiled out, so we cannot fall back to it. +diff --git a/src/lstm/plumbing.cpp b/src/lstm/plumbing.cpp +index f0133148..15cf3d62 100644 +--- a/src/lstm/plumbing.cpp ++++ b/src/lstm/plumbing.cpp +@@ -226,6 +226,12 @@ bool Plumbing::DeSerialize(TFile *fp) { + if (size > 10000) { + return false; + } ++ // Reject empty stacks: XScaleFactor, CacheXScaleFactor and other methods ++ // unconditionally dereference stack_[0] during network initialization. ++ // A Series needs at least two networks (see Series::Forward). ++ if (size == 0 || (type() == NT_SERIES && size == 1)) { ++ return false; ++ } + for (uint32_t i = 0; i < size; ++i) { + Network *network = CreateFromFile(fp); + if (network == nullptr) { +diff --git a/unittest/plumbing_test.cc b/unittest/plumbing_test.cc +new file mode 100644 +index 00000000..27486f86 +--- /dev/null ++++ b/unittest/plumbing_test.cc +@@ -0,0 +1,165 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: plumbing_test.cc ++// Description: Tests that a corrupt TESSDATA_LSTM component in a ++// .traineddata file is rejected without crashing. A ++// plumbing layer (Series/Parallel/Reversed) with an ++// empty or undersized network stack would make ++// XScaleFactor/CacheXScaleFactor dereference stack_[0] ++// during engine initialization. ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include ++ ++#include "network.h" // for NetworkType ++#include "tessdatamanager.h" // for TessdataManager, TESSDATA_LSTM ++ ++#include ++#include ++#include ++#include ++#include ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Minimal unicharset with the special codes (space, Joined, Broken) that ++// UNICHARSET::load_from_file expects, as embedded in the TESSDATA_LSTM ++// component by LSTMRecognizer::Serialize. ++const char kMinUnicharset[] = ++ "3\n" ++ "NULL 0 NULL 0\n" ++ "Joined 7 0,69,188,255,486,1218,0,30,486,1188 Latin 26 0 98 Joined\n" ++ "|Broken|0|1 f 0,69,186,255,892,2138,0,80,892,2058 Common 84 10 84 |Broken|0|1\n"; ++ ++// Appends raw little-endian values to a byte buffer. ++class ByteWriter { ++public: ++ void PutU8(uint32_t v) { data_.push_back(static_cast(v & 0xFF)); } ++ void PutU32(uint32_t v) { ++ for (int i = 0; i < 4; ++i) { ++ data_.push_back(static_cast((v >> (8 * i)) & 0xFF)); ++ } ++ } ++ void PutS32(int32_t v) { PutU32(static_cast(v)); } ++ void PutString(const char *s) { ++ PutU32(static_cast(std::strlen(s))); ++ data_.insert(data_.end(), s, s + std::strlen(s)); ++ } ++ void PutRaw(const char *s) { data_.insert(data_.end(), s, s + std::strlen(s)); } ++ const std::vector &data() const { return data_; } ++ ++private: ++ std::vector data_; ++}; ++ ++// Serialized network header as written by Network::Serialize: ++// int8 type, int8 training, int8 needs_to_backprop, int32 network_flags, ++// int32 ni, int32 no, int32 num_weights, string name. ++void AppendNetworkHeader(ByteWriter *w, NetworkType type) { ++ w->PutU8(static_cast(type)); ++ w->PutU8(0); // training: TS_DISABLED ++ w->PutU8(0); // needs_to_backprop ++ w->PutU32(0); // network_flags ++ w->PutU32(0); // ni ++ w->PutU32(0); // no ++ w->PutU32(0); // num_weights ++ w->PutString(""); // name ++} ++ ++// A minimal valid child network (NT_INPUT with a 1x1x1x1 shape). ++void AppendInputChild(ByteWriter *w) { ++ AppendNetworkHeader(w, NT_INPUT); ++ w->PutS32(1); // batch ++ w->PutS32(1); // height ++ w->PutS32(1); // width ++ w->PutS32(1); // depth ++ w->PutS32(0); // loss type ++} ++ ++// Builds a TESSDATA_LSTM component whose top-level network is a plumbing ++// layer of the given type with the given (corrupt) stack size, followed by ++// the remaining fields of LSTMRecognizer::DeSerialize. ++std::vector MakeLstmComponent(NetworkType type, uint32_t stack_size) { ++ ByteWriter w; ++ AppendNetworkHeader(&w, type); ++ w.PutU32(stack_size); // Plumbing::DeSerialize reads this as uint32 ++ for (uint32_t i = 0; i < stack_size; ++i) { ++ AppendInputChild(&w); ++ } ++ w.PutRaw(kMinUnicharset); // unicharset (raw text, no recoder/unicharset components) ++ w.PutString(""); // network_str_ ++ w.PutS32(0); // training_flags_ ++ w.PutS32(0); // training_iteration_ ++ w.PutS32(0); // sample_iteration_ ++ w.PutS32(0); // null_char_ ++ w.PutU32(0); // adam_beta_ (float 0.0) ++ w.PutU32(0); // learning_rate_ (float 0.0) ++ w.PutU32(0); // momentum_ (float 0.0) ++ return w.data(); ++} ++ ++// Writes a traineddata file with the given (corrupt) LSTM component to ++// dir/eng.traineddata. ++bool WriteCorruptTraineddata(const std::string &dir, const std::vector &lstm) { ++ TessdataManager mgr; ++ mgr.OverwriteEntry(TESSDATA_LSTM, lstm.data(), static_cast(lstm.size())); ++ return mgr.SaveFile((dir + "/eng.traineddata").c_str(), nullptr); ++} ++ ++class PlumbingTest : public testing::Test { ++protected: ++ void SetUp() override { ++ tmpl_ = "/tmp/tess_plumbing_test_XXXXXX"; ++ char *dir = mkdtemp(tmpl_.data()); ++ ASSERT_NE(dir, nullptr); ++ dir_ = dir; ++ } ++ void TearDown() override { ++ std::remove((dir_ + "/eng.traineddata").c_str()); ++ rmdir(dir_.c_str()); ++ } ++ // Expects the LSTM engine to reject the corrupted traineddata ++ // gracefully (init failure) instead of crashing. ++ void ExpectInitFails(const std::vector &lstm) { ++ ASSERT_TRUE(WriteCorruptTraineddata(dir_, lstm)); ++ tesseract::TessBaseAPI api; ++ EXPECT_EQ(api.Init(dir_.c_str(), "eng", tesseract::OEM_LSTM_ONLY), -1); ++ } ++ std::string dir_; ++ std::string tmpl_; ++}; ++ ++// Empty NT_SERIES stack: Series::CacheXScaleFactor would dereference ++// stack_[0] on the empty vector during initialization. ++TEST_F(PlumbingTest, RejectsEmptySeriesStack) { ++ ExpectInitFails(MakeLstmComponent(NT_SERIES, 0)); ++} ++ ++// Empty NT_PARALLEL stack: Plumbing::XScaleFactor would dereference ++// stack_[0] on the empty vector during initialization. ++TEST_F(PlumbingTest, RejectsEmptyParallelStack) { ++ ExpectInitFails(MakeLstmComponent(NT_PARALLEL, 0)); ++} ++ ++// Empty NT_XREVERSED stack: same crash as the parallel case. ++TEST_F(PlumbingTest, RejectsEmptyReversedStack) { ++ ExpectInitFails(MakeLstmComponent(NT_XREVERSED, 0)); ++} ++ ++// A Series with a single network: Series::Forward requires at least two ++// networks, so such a model can never work. ++TEST_F(PlumbingTest, RejectsSingleNetworkSeries) { ++ ExpectInitFails(MakeLstmComponent(NT_SERIES, 1)); ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index be6ec1e463..c96aca1dde 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -13,6 +13,7 @@ SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag file://CVE-2026-88050.patch \ file://CVE-2026-88047.patch \ file://CVE-2026-88051.patch \ + file://CVE-2026-88054.patch \ " DEPENDS = "leptonica" From patchwork Tue Oct 13 09:59:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100587 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E14CCC6B0F for ; Tue, 13 Oct 2026 10:00:39 +0000 (UTC) Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3447.1791885636768278674 for ; Tue, 13 Oct 2026 03:00:36 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Jqp7Y8fc; spf=pass (domain: gmail.com, ip: 209.85.216.41, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-398a4dcf289so1381364a91.2 for ; Tue, 13 Oct 2026 03:00:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791885636; x=1792490436; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=JI5SPv4Mgvuqc1EQWVSgRUqv2OsgGWNzaQr9ubcQptE=; b=Jqp7Y8fcZzhxTBBewYfbc1rzFQa4ZD6J0/VWuAcr00TMHz86OqRqfubvxfqo6xQt1M suntflDvhy+gTEdO0q4FmFebCCug7zqKfZis5PYzoaQITj0sieN8DBUrbk2tx9vvcyay GumeU/y+smi/BLI58cXvvvRYIV0LaiSdUd7mS3kPx0HSugsm9Yjm5Twt5hOxzOtZNN3c xGj8z7QXYY+H2S0/faeFWdqvo7PX4pK2Et9RNxkQeSA1TpXpIy75SWg9190itRSifUNn 2sCJlujsLqxRLPNjOzZAL6ZTna6TymYa28VpQM32+BmFznbpw0zUWUZ9h+099HOqqlIP RhFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791885636; x=1792490436; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=JI5SPv4Mgvuqc1EQWVSgRUqv2OsgGWNzaQr9ubcQptE=; b=kXMXY2jUfxVt4aTkfeXr1psLs0ThzxxmEAdLSt5dPP7HBNSm2fWapA+MVlpyrJggWa XVn6v9CdnpQo9Q8GoET9Xk03hhFrdrieQ0v7Jel4yuXNXaE/Rxt52zs8UMVNYNcw+6SV iB2SGSFTxbE9U+hCUljxOqwb91VR6gi91Wt7VG21/wl9T0axBNTx+2lvu6j13z78O+Du 4ILAbx35bocaPlPwfPQ6m/tbhcNwNKO53JLJZfcWCJToX1WwB8hlPCxY0WtJMaXItOPo ZWMAIyxhcgB/ph2IABySCjA3fn0zA7xipptfXjbw6qmgW5JE/+LcOJ05yreJBxao8gwR JvEg== X-Gm-Message-State: AFq9FYIsSdWzxjxaNkLz2cq6+vfnrAZBhuwrFnv9iwDtjEnc2mfiZ+cs iD0ggL+Z30uD3xTf8deb3rhmmcsHGTsfkXGi7GsZga3Xp/Eh67AeaIdcNBbUGg== X-Gm-Gg: AYBFou1YMiaLL/w2MoknYH26jHdkFEYCtqGpmILM7lC3fOlq55/GFy/9prU7styjV6I 519cMUV62BFCNPYwKrxOcs+e15d5T7Yrwu2m280Qve7E26nx8rGd62pFIijoYN1o86XhaPIvG4X eEZFdXhXyqU7uV1TAAy6EwHLHvjyT6ugRFG3WeEA8ggfYfWgpvMZnz85vJoRnk69dNggBU52RYG Hcc7aAF4G+nQcMTyPurQ+wBI3mQXUVHXd0HgzTje/vfEc8RBTf0gS9o3QUoPow2WY73tInjegH4 gRXR1doarLSKvBQRQdFbeqrix3OviGagOBOgbd0or9xChL+lZa2efihYL/SgCrdbFoUOxiwJfFZ pD8+tt2MYNFM8LSKnpSBW+ylSKAmtlbMN6JYzuBnjFvERKxFELc1MMpPa+LOtw8gfaEE69oKVTN zYbZJCfnvUkqZ/1JY5ieseXmuarjvHxVfSsVWQCrZhH/XTeCITLvwtWTkwoVbHh/GhBrwqLIJei jTUBIWjnAPuvVjhz7QNUkqdE54fAxV5KN/r3fyI7k0AcQCQHg== X-Received: by 2002:a17:90b:1d4f:b0:3ab:c80:936f with SMTP id 98e67ed59e1d1-3ab3a94ffa7mr8903496a91.16.1791885635772; Tue, 13 Oct 2026 03:00:35 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab37817414sm21282398a91.2.2026.10.13.03.00.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 03:00:35 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 28/28] gpsd: patch CVE-2026-60122 Date: Tue, 13 Oct 2026 22:59:03 +1300 Message-ID: <20261013095903.3544906-28-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> References: <20261013095903.3544906-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 13 Oct 2026 10:00:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130861 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-60122 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit da527bb6ba21025da9ff5eafc758156d659f6c9f) Signed-off-by: Ankur Tyagi --- .../gpsd/gpsd/CVE-2026-60122.patch | 45 +++++++++++++++++++ .../recipes-navigation/gpsd/gpsd_3.27.5.bb | 1 + 2 files changed, 46 insertions(+) create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch new file mode 100644 index 0000000000..da8fa5f4d2 --- /dev/null +++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch @@ -0,0 +1,45 @@ +From 50bf98d0240b94bbec6ce06be33cdaf99e2f6214 Mon Sep 17 00:00:00 2001 +From: "Gary E. Miller" +Date: Mon, 20 Jul 2026 20:12:16 -0700 +Subject: [PATCH] clients/gpsprof.py.in: ensure sats.used is boolean. Issue + 406 + +Prevfent command injection by sates.used. Force to boolean. + +(cherry picked from commit 5a9c44a42136b9bb98d460a8a716e9fd344a8d93) + +CVE: CVE-2026-60122 +Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/5a9c44a42136b9bb98d460a8a716e9fd344a8d93] +Signed-off-by: Ankur Tyagi +--- + clients/gpsprof.py.in | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index e91367ee3..07123d417 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -334,8 +334,11 @@ class spaceplot(plotter): + # get sat used count + sats_used = 0 + for sat in self.session.satellites: +- if sat.used: ++ if sat.used is True: + sats_used += 1 ++ else: ++ # ensure it is boolean. ++ sat.used = False + + if 'altHAE' not in self.session.data: + self.session.data['altHAE'] = gps.NaN +@@ -783,6 +786,10 @@ class polarplot(plotter): + used += 1 + if 'polarunused' == self.name: + continue ++ else: ++ # ensure it is boolean. ++ sat['used'] = False; ++ + if (('polarused' == self.name and + sat['used'] is False)): + continue diff --git a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb index 52d86503a1..2bb70aca46 100644 --- a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb +++ b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb @@ -11,6 +11,7 @@ SRC_URI = "${SAVANNAH_GNU_MIRROR}/${BPN}/${BP}.tar.gz \ file://CVE-2026-58459-1.patch \ file://CVE-2026-58459-2.patch \ file://CVE-2026-58459-3.patch \ + file://CVE-2026-60122.patch \ file://gpsd.init \ " SRC_URI[sha256sum] = "409873f5048462ef1ac413a51ab35caa8b50b31be62b3347bee1cc2994e7c649"