mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-12 06:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

gnutls: Backport fix for CVE-2026-33846

Browse Source 
Backport patch [1] referenced in [2]. The difference in upstream and the backport
is skipping of intermediate patch [3] which essentially just aliases
`session->internals.handshake_recv_buffer -> recv_buf'.

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-33846

[1] 65ab33fa54
[2] https://security-tracker.debian.org/tracker/CVE-2026-33846
[3] 9deffca528

(From OE-Core rev: 5b4292b3fc1586709dcdc27d7cfa3d880e6f338a)

Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Roland Kovacs
2026-08-21 10:58:20 +02:00
committed by Richard Purdie
parent 260984ba5e
commit 586e5ddf26
2 changed files with 67 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

66
meta/recipes-support/gnutls/gnutls/CVE-2026-33846.patch Normal file
View File

@@ -0,0 +1,66 @@
From f83c50305b4186075aeea26c7d8d64fdad95f381 Mon Sep 17 00:00:00 2001
From: Alexander Sosedkin <asosedkin@redhat.com>
Date: Fri, 17 Apr 2026 18:21:36 +0200
Subject: [PATCH] buffers: add more checks to DTLS reassembly
Previously, gnutls didn't check that DTLS fragments claimed
a consistent message_length value.
Additionally, a crucial array size check was missing,
enabling an attacker to cause a heap overwrite.
The updated version rejects fragments with mismatching length
and adds a missing boundary check.
Reported-by: Haruto Kimura (Stella)
Reported-by: Oscar Reparaz
Reported-by: Zou Dikai
Fixes: #1816
Fixes: #1838
Fixes: #1839
Fixes: CVE-2026-33846
Fixes: GNUTLS-SA-2026-04-29-1
CVSS: 7.4 High CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS: 7.5 High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
CVE: CVE-2026-33846
Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/65ab33fa54e34fba69d793735b7df3d383d1ff78]
Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
---
lib/buffers.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/lib/buffers.c b/lib/buffers.c
index 672380b05..2934fd366 100644
--- a/lib/buffers.c
+++ b/lib/buffers.c
@@ -1009,6 +1009,27 @@ static int merge_handshake_packet(gnutls_session_t session,
&session->internals.handshake_recv_buffer[pos], hsk);
} else {
+ if (hsk->length !=
+ session->internals.handshake_recv_buffer[pos].length) {
+ /* inconsistent across fragments */
+ _gnutls_handshake_buffer_clear(hsk);
+ return gnutls_assert_val(
+ GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
+ }
+ /* start_offset + data.length <= hsk->length <= max_length */
+ if (hsk->length < hsk->start_offset + hsk->data.length) {
+ /* impossible claims, overflow requested */
+ _gnutls_handshake_buffer_clear(hsk);
+ return gnutls_assert_val(
+ GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
+ }
+ if (hsk->length >
+ session->internals.handshake_recv_buffer[pos].data.max_length) {
+ /* we don't have this much allocated, overflow guard */
+ _gnutls_handshake_buffer_clear(hsk);
+ return gnutls_assert_val(
+ GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
+ }
if (hsk->start_offset <
session->internals.handshake_recv_buffer[pos]
.start_offset &&
--
2.47.3

1
meta/recipes-support/gnutls/gnutls_3.8.4.bb
View File

@@ -49,6 +49,7 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar
file://CVE-2026-42010.patch \
file://CVE-2026-42011_p1.patch \
file://CVE-2026-42011_p2.patch \
file://CVE-2026-33846.patch \
"
SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b"