From 586e5ddf269e701828d989f9ac421109e6c08ae6 Mon Sep 17 00:00:00 2001 From: Roland Kovacs Date: Fri, 21 Aug 2026 10:58:20 +0200 Subject: [PATCH] gnutls: Backport fix for CVE-2026-33846 Backport patch [1] referenced in [2]. The difference in upstream and the backport is skipping of intermediate patch [3] which essentially just aliases `session->internals.handshake_recv_buffer -> recv_buf'. NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-33846 [1] https://gitlab.com/gnutls/gnutls/-/commit/65ab33fa54e34fba69d793735b7df3d383d1ff78 [2] https://security-tracker.debian.org/tracker/CVE-2026-33846 [3] https://gitlab.com/gnutls/gnutls/-/commit/9deffca528c23bbb218f5ec3bd4bb1bf4cbd1fc0 (From OE-Core rev: 5b4292b3fc1586709dcdc27d7cfa3d880e6f338a) Signed-off-by: Roland Kovacs Signed-off-by: Yoann Congal Signed-off-by: Richard Purdie --- .../gnutls/gnutls/CVE-2026-33846.patch | 66 +++++++++++++++++++ meta/recipes-support/gnutls/gnutls_3.8.4.bb | 1 + 2 files changed, 67 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-33846.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-33846.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-33846.patch new file mode 100644 index 0000000000..81c928c872 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-33846.patch @@ -0,0 +1,66 @@ +From f83c50305b4186075aeea26c7d8d64fdad95f381 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Fri, 17 Apr 2026 18:21:36 +0200 +Subject: [PATCH] buffers: add more checks to DTLS reassembly + +Previously, gnutls didn't check that DTLS fragments claimed +a consistent message_length value. +Additionally, a crucial array size check was missing, +enabling an attacker to cause a heap overwrite. +The updated version rejects fragments with mismatching length +and adds a missing boundary check. + +Reported-by: Haruto Kimura (Stella) +Reported-by: Oscar Reparaz +Reported-by: Zou Dikai +Fixes: #1816 +Fixes: #1838 +Fixes: #1839 +Fixes: CVE-2026-33846 +Fixes: GNUTLS-SA-2026-04-29-1 +CVSS: 7.4 High CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H +CVSS: 7.5 High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H +Signed-off-by: Alexander Sosedkin + +CVE: CVE-2026-33846 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/65ab33fa54e34fba69d793735b7df3d383d1ff78] +Signed-off-by: Roland Kovacs +--- + lib/buffers.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/lib/buffers.c b/lib/buffers.c +index 672380b05..2934fd366 100644 +--- a/lib/buffers.c ++++ b/lib/buffers.c +@@ -1009,6 +1009,27 @@ static int merge_handshake_packet(gnutls_session_t session, + &session->internals.handshake_recv_buffer[pos], hsk); + + } else { ++ if (hsk->length != ++ session->internals.handshake_recv_buffer[pos].length) { ++ /* inconsistent across fragments */ ++ _gnutls_handshake_buffer_clear(hsk); ++ return gnutls_assert_val( ++ GNUTLS_E_UNEXPECTED_PACKET_LENGTH); ++ } ++ /* start_offset + data.length <= hsk->length <= max_length */ ++ if (hsk->length < hsk->start_offset + hsk->data.length) { ++ /* impossible claims, overflow requested */ ++ _gnutls_handshake_buffer_clear(hsk); ++ return gnutls_assert_val( ++ GNUTLS_E_UNEXPECTED_PACKET_LENGTH); ++ } ++ if (hsk->length > ++ session->internals.handshake_recv_buffer[pos].data.max_length) { ++ /* we don't have this much allocated, overflow guard */ ++ _gnutls_handshake_buffer_clear(hsk); ++ return gnutls_assert_val( ++ GNUTLS_E_UNEXPECTED_PACKET_LENGTH); ++ } + if (hsk->start_offset < + session->internals.handshake_recv_buffer[pos] + .start_offset && +-- +2.47.3 + diff --git a/meta/recipes-support/gnutls/gnutls_3.8.4.bb b/meta/recipes-support/gnutls/gnutls_3.8.4.bb index 2d88bc181d..0aa1eef513 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.4.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.4.bb @@ -49,6 +49,7 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://CVE-2026-42010.patch \ file://CVE-2026-42011_p1.patch \ file://CVE-2026-42011_p2.patch \ + file://CVE-2026-33846.patch \ " SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b"