mirror of
https://git.yoctoproject.org/poky
synced 2026-09-29 07:36:20 +02:00
2e86ebbfde
Pick patch according to [2] [1] https://nvd.nist.gov/vuln/detail/cve-2026-18938 [2] https://ubuntu.com/security/CVE-2026-18938 (From OE-Core rev: 65db9618c3e80ca3fb6d87bea1153de554144165) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
53 lines
1.9 KiB
Diff
53 lines
1.9 KiB
Diff
From 3e64244e538550c6a7fcf826fa8c50a4604416dc Mon Sep 17 00:00:00 2001
|
|
From: Zoltan Fridrich <zfridric@redhat.com>
|
|
Date: Thu, 6 Aug 2026 11:39:22 +0200
|
|
Subject: [PATCH] rpc: guard against overflow when decoding nested attributes
|
|
(CVE-2026-18938)
|
|
|
|
A local attacker, or one with equivalent access to a reachable RPC channel,
|
|
could exploit an integer overflow vulnerability. By sending specially crafted
|
|
messages, the attacker can cause the system to miscalculate memory allocation
|
|
for nested attributes. This leads to a memory corruption issue, specifically
|
|
a heap out-of-bounds write, which can crash the p11-kit RPC parsing process,
|
|
resulting in a Denial of Service (DoS). This vulnerability is only exploitable
|
|
on 32 bit systems.
|
|
|
|
Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
|
|
|
|
Upstream-Status: Backport [https://github.com/p11-glue/p11-kit/commit/3e64244e538550c6a7fcf826fa8c50a4604416dc]
|
|
CVE: CVE-2026-18938
|
|
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
|
|
---
|
|
p11-kit/rpc-message.c | 8 ++++++++
|
|
1 file changed, 8 insertions(+)
|
|
|
|
diff --git a/p11-kit/rpc-message.c b/p11-kit/rpc-message.c
|
|
index d6f0aad..105a4f1 100644
|
|
--- a/p11-kit/rpc-message.c
|
|
+++ b/p11-kit/rpc-message.c
|
|
@@ -1160,6 +1160,10 @@ p11_rpc_buffer_get_attribute_array_value (p11_buffer *buffer,
|
|
if (!p11_rpc_buffer_get_uint32 (buffer, offset, &count))
|
|
return false;
|
|
|
|
+ /* Guard against overflow */
|
|
+ if (count != 0 && (SIZE_MAX / count) < sizeof (CK_ATTRIBUTE))
|
|
+ return false;
|
|
+
|
|
if (!value) {
|
|
memset (&temp, 0, sizeof (CK_ATTRIBUTE));
|
|
attr = &temp;
|
|
@@ -1191,6 +1195,10 @@ p11_rpc_buffer_get_mechanism_type_array_value (p11_buffer *buffer,
|
|
if (!p11_rpc_buffer_get_uint32 (buffer, offset, &count))
|
|
return false;
|
|
|
|
+ /* Guard against overflow */
|
|
+ if (count != 0 && (SIZE_MAX / count) < sizeof (CK_MECHANISM_TYPE))
|
|
+ return false;
|
|
+
|
|
if (!value) {
|
|
memset (&temp, 0, sizeof (CK_MECHANISM_TYPE));
|
|
mech = &temp;
|
|
--
|
|
2.43.0
|
|
|