mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-03-06 23:39:40 +01:00
Code Issues Packages Projects Releases Wiki Activity

avahi: patch CVE-2026-24401

Browse Source 
Details https://nvd.nist.gov/vuln/detail/CVE-2026-24401

(From OE-Core rev: 6930162c44ae94824ff66b0a0fcb02a0a92c02e8)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 183d0ee54f1c194e245a7bbf243c19b3c2acf4f5)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Ankur Tyagi
2026-02-20 20:11:32 +01:00
committed by Paul Barker
parent e7763a1e0a
commit b600216fd2
2 changed files with 75 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-connectivity/avahi/avahi_0.8.bb
View File

@@ -40,6 +40,7 @@ SRC_URI = "https://github.com/lathiat/avahi/releases/download/v${PV}/avahi-${PV}
file://CVE-2025-68276.patch \
file://CVE-2025-68468.patch \
file://CVE-2025-68471.patch \
file://CVE-2026-24401.patch \
"
UPSTREAM_CHECK_URI = "https://github.com/lathiat/avahi/releases/"

74
meta/recipes-connectivity/avahi/files/CVE-2026-24401.patch Normal file
View File

@@ -0,0 +1,74 @@
From 5eea2640324928c15936b7a2bcbf8ea0de7b08f7 Mon Sep 17 00:00:00 2001
From: Hugo Muis <198191869+friendlyhugo@users.noreply.github.com>
Date: Sun, 2 Mar 2025 18:06:24 +0100
Subject: [PATCH] core: fix uncontrolled recursion bug using a simple loop
detection algorithm
Closes https://github.com/avahi/avahi/issues/501
CVE: CVE-2026-24401
Upstream-Status: Backport [https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524]
(cherry picked from commit 78eab31128479f06e30beb8c1cbf99dd921e2524)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
avahi-core/browse.c | 40 ++++++++++++++++++++++++++++++++++++++++
1 file changed, 40 insertions(+)
diff --git a/avahi-core/browse.c b/avahi-core/browse.c
index f461083..975b3e9 100644
--- a/avahi-core/browse.c
+++ b/avahi-core/browse.c
@@ -401,6 +401,40 @@ static int lookup_go(AvahiSRBLookup *l) {
return n;
}
+static int lookup_exists_in_path(AvahiSRBLookup* lookup, AvahiSRBLookup* from, AvahiSRBLookup* to) {
+ AvahiRList* rl;
+ if (from == to)
+ return 0;
+ for (rl = from->cname_lookups; rl; rl = rl->rlist_next) {
+ int r = lookup_exists_in_path(lookup, rl->data, to);
+ if (r == 1) {
+ /* loop detected, propagate result */
+ return r;
+ } else if (r == 0) {
+ /* is loop detected? */
+ return lookup == from;
+ } else {
+ /* `to` not found, continue */
+ continue;
+ }
+ }
+ /* no path found */
+ return -1;
+}
+
+static int cname_would_create_loop(AvahiSRBLookup* l, AvahiSRBLookup* n) {
+ int ret;
+ if (l == n)
+ /* Loop to self */
+ return 1;
+
+ ret = lookup_exists_in_path(n, l->record_browser->root_lookup, l);
+
+ /* Path to n always exists */
+ assert(ret != -1);
+ return ret;
+}
+
static void lookup_handle_cname(AvahiSRBLookup *l, AvahiIfIndex interface, AvahiProtocol protocol, AvahiLookupFlags flags, AvahiRecord *r) {
AvahiKey *k;
AvahiSRBLookup *n;
@@ -420,6 +454,12 @@ static void lookup_handle_cname(AvahiSRBLookup *l, AvahiIfIndex interface, Avahi
return;
}
+ if (cname_would_create_loop(l, n)) {
+ /* CNAME loops are not allowed */
+ lookup_unref(n);
+ return;
+ }
+
l->cname_lookups = avahi_rlist_prepend(l->cname_lookups, lookup_ref(n));
lookup_go(n);