mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-28 13:00:23 +00:00
Code Issues Projects Releases Wiki Activity

wolfssl: patch CVE-2026-6094

Browse Source 
Details
https://nvd.nist.gov/vuln/detail/cve-2026-6094

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-09-15 10:13:39 +05:30
committed by Anuj Mittal
parent 4b124297a2
commit 140b51ee66
6 changed files with 220 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-6094-1.patch
+32
View File
@@ -0,0 +1,32 @@
From f162b7679bafacd5b9866d72400b1115f8fbc7b7 Mon Sep 17 00:00:00 2001
From: Kareem <kareem@wolfssl.com>
Date: Fri, 3 Apr 2026 16:05:44 -0700
Subject: [PATCH] Ensure esd->signedAttribsCount contains the correct count in
case some are skipped by using the current idx rather than the total array
size.
Thanks to Zou Dikai for the report.
(cherry picked from commit 7f218574c4d30a8aa8c520c7023c3d017fc13b86)
CVE: CVE-2026-6094
Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/7f218574c4d30a8aa8c520c7023c3d017fc13b86]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
wolfcrypt/src/pkcs7.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
index 3f6649d0a..67803f84d 100644
--- a/wolfcrypt/src/pkcs7.c
+++ b/wolfcrypt/src/pkcs7.c
@@ -2253,7 +2253,7 @@ static int wc_PKCS7_BuildSignedAttributes(wc_PKCS7* pkcs7, ESD* esd,
idx++;
}
- esd->signedAttribsCount += cannedAttribsCount;
+ esd->signedAttribsCount += idx;
esd->signedAttribsSz += (word32)EncodeAttributes(
&esd->signedAttribs[atrIdx], (int)idx, cannedAttribs,
(int)cannedAttribsCount);
meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-6094-2.patch
+35
View File
@@ -0,0 +1,35 @@
From 6d7fe2926a18982278c53b4ec413fe7b2349a019 Mon Sep 17 00:00:00 2001
From: Kareem <kareem@wolfssl.com>
Date: Fri, 3 Apr 2026 16:06:35 -0700
Subject: [PATCH] In wc_PKCS7_DecodeEnvelopedData, confirm
encryptedContentTotalSz does not exceed the total message size before using
it in the non-streaming case.
Thanks to Zou Dikai for the report.
(cherry picked from commit 1397268aa12e2cf3f80c3acfa9b6036b809c08ef)
CVE: CVE-2026-6094
Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/1397268aa12e2cf3f80c3acfa9b6036b809c08ef]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
wolfcrypt/src/pkcs7.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
index 67803f84d..43bcf3ee4 100644
--- a/wolfcrypt/src/pkcs7.c
+++ b/wolfcrypt/src/pkcs7.c
@@ -13231,6 +13231,11 @@ int wc_PKCS7_DecodeEnvelopedData(wc_PKCS7* pkcs7, byte* in,
}
wc_PKCS7_DecryptContentFree(pkcs7, encOID, pkcs7->heap);
} else {
+ if ((idx + (word32)encryptedContentTotalSz) > pkiMsgSz) {
+ ret = BUFFER_E;
+ break;
+ }
+
pkcs7->cachedEncryptedContentSz =
(word32)encryptedContentTotalSz;
pkcs7->totalEncryptedContentSz =
meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-6094-3.patch
+39
View File
@@ -0,0 +1,39 @@
From c7f7a8ef00e6a7a33a623543507f8fa089f6037b Mon Sep 17 00:00:00 2001
From: Kareem <kareem@wolfssl.com>
Date: Fri, 3 Apr 2026 16:56:04 -0700
Subject: [PATCH] Code review feedback
(cherry picked from commit ebdcc03b718cd7175355097b1a3831a0eb4875b2)
CVE: CVE-2026-6094
Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/ebdcc03b718cd7175355097b1a3831a0eb4875b2]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
wolfcrypt/src/pkcs7.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
index 43bcf3ee4..50d33bdb8 100644
--- a/wolfcrypt/src/pkcs7.c
+++ b/wolfcrypt/src/pkcs7.c
@@ -2256,7 +2256,7 @@ static int wc_PKCS7_BuildSignedAttributes(wc_PKCS7* pkcs7, ESD* esd,
esd->signedAttribsCount += idx;
esd->signedAttribsSz += (word32)EncodeAttributes(
&esd->signedAttribs[atrIdx], (int)idx, cannedAttribs,
- (int)cannedAttribsCount);
+ (int)idx);
atrIdx += idx;
} else {
esd->signedAttribsCount = 0;
@@ -13231,7 +13231,9 @@ int wc_PKCS7_DecodeEnvelopedData(wc_PKCS7* pkcs7, byte* in,
}
wc_PKCS7_DecryptContentFree(pkcs7, encOID, pkcs7->heap);
} else {
- if ((idx + (word32)encryptedContentTotalSz) > pkiMsgSz) {
+ word32 tmpSum;
+ if (!WC_SAFE_SUM_WORD32(idx, (word32)encryptedContentTotalSz, tmpSum) ||
+ tmpSum > pkiMsgSz) {
ret = BUFFER_E;
break;
}
meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-6094-4.patch
+36
View File
@@ -0,0 +1,36 @@
From a9015491db03d415f766f47c139841249adce843 Mon Sep 17 00:00:00 2001
From: Kareem <kareem@wolfssl.com>
Date: Mon, 6 Apr 2026 11:58:12 -0700
Subject: [PATCH] Fix unused variable error
(cherry picked from commit 3e04475875a4942652fdf6794a01fdfd65801fdc)
CVE: CVE-2026-6094
Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/3e04475875a4942652fdf6794a01fdfd65801fdc]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
wolfcrypt/src/pkcs7.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
index 50d33bdb8..2cde73846 100644
--- a/wolfcrypt/src/pkcs7.c
+++ b/wolfcrypt/src/pkcs7.c
@@ -2197,7 +2197,6 @@ static int wc_PKCS7_BuildSignedAttributes(wc_PKCS7* pkcs7, ESD* esd,
#endif
word32 idx = 0;
word32 atrIdx = 0;
- word32 cannedAttribsCount;
if (pkcs7 == NULL || esd == NULL || contentType == NULL ||
contentTypeOid == NULL || messageDigestOid == NULL ||
@@ -2220,8 +2219,6 @@ static int wc_PKCS7_BuildSignedAttributes(wc_PKCS7* pkcs7, ESD* esd,
return timeSz;
#endif
- cannedAttribsCount = sizeof(cannedAttribs)/sizeof(PKCS7Attrib);
-
XMEMSET(&cannedAttribs[idx], 0, sizeof(cannedAttribs[idx]));
if ((pkcs7->defaultSignedAttribs & WOLFSSL_CONTENT_TYPE_ATTRIBUTE) ||
meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-6094-5.patch
+73
View File
@@ -0,0 +1,73 @@
From c27fbdecfd2f4a31acdc73229a5bc631184265f1 Mon Sep 17 00:00:00 2001
From: Kareem <kareem@wolfssl.com>
Date: Mon, 6 Apr 2026 16:41:32 -0700
Subject: [PATCH] Add additional checks for encryptedContentSz exceeding
pkiMsgSz.
(cherry picked from commit b3c2877a146e0c75715368ca5dfe2387bfc2cadf)
CVE: CVE-2026-6094
Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/b3c2877a146e0c75715368ca5dfe2387bfc2cadf]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
wolfcrypt/src/pkcs7.c | 38 ++++++++++++++++++++++++++------------
1 file changed, 26 insertions(+), 12 deletions(-)
diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
index 2cde73846..8df3a2430 100644
--- a/wolfcrypt/src/pkcs7.c
+++ b/wolfcrypt/src/pkcs7.c
@@ -14380,9 +14380,17 @@ int wc_PKCS7_DecodeAuthEnvelopedData(wc_PKCS7* pkcs7, byte* in,
}
if (ret == 0) {
- XMEMCPY(encryptedContent, &pkiMsg[idx],
+ word32 tmpSum;
+ if (!WC_SAFE_SUM_WORD32(idx, (word32)encryptedContentSz,
+ tmpSum) ||
+ tmpSum > pkiMsgSz) {
+ ret = BUFFER_E;
+ break;
+ } else {
+ XMEMCPY(encryptedContent, &pkiMsg[idx],
(word32)encryptedContentSz);
- idx += (word32)encryptedContentSz;
+ idx += (word32)encryptedContentSz;
+ }
}
#ifndef NO_PKCS7_STREAM
pkcs7->stream->bufferPt = encryptedContent;
@@ -15316,16 +15324,22 @@ int wc_PKCS7_DecodeEncryptedData(wc_PKCS7* pkcs7, byte* in, word32 inSz,
}
if (ret == 0) {
- XMEMCPY(encryptedContent, &pkiMsg[idx],
- (unsigned int)encryptedContentSz);
- idx += (word32)encryptedContentSz;
-
- /* decrypt encryptedContent */
- ret = wc_PKCS7_DecryptContent(pkcs7, encOID,
- pkcs7->encryptionKey, pkcs7->encryptionKeySz,
- tmpIv, expBlockSz, NULL, 0, NULL, 0,
- encryptedContent, encryptedContentSz,
- encryptedContent, pkcs7->devId, pkcs7->heap);
+ word32 tmpSum;
+ if (!WC_SAFE_SUM_WORD32(idx, (word32)encryptedContentSz, tmpSum) ||
+ tmpSum > pkiMsgSz) {
+ ret = BUFFER_E;
+ } else {
+ XMEMCPY(encryptedContent, &pkiMsg[idx],
+ (unsigned int)encryptedContentSz);
+ idx += (word32)encryptedContentSz;
+
+ /* decrypt encryptedContent */
+ ret = wc_PKCS7_DecryptContent(pkcs7, encOID,
+ pkcs7->encryptionKey, pkcs7->encryptionKeySz,
+ tmpIv, expBlockSz, NULL, 0, NULL, 0,
+ encryptedContent, encryptedContentSz,
+ encryptedContent, pkcs7->devId, pkcs7->heap);
+ }
if (ret != 0) {
XFREE(encryptedContent, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
}
meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb
+5
View File
@@ -23,6 +23,11 @@ SRC_URI = " \
file://CVE-2026-6091-2.patch \
file://CVE-2026-6091-3.patch \
file://CVE-2026-6092.patch \
file://CVE-2026-6094-1.patch \
file://CVE-2026-6094-2.patch \
file://CVE-2026-6094-3.patch \
file://CVE-2026-6094-4.patch \
file://CVE-2026-6094-5.patch \
"
SRCREV = "1d363f3adceba9d1478230ede476a37b0dcdef24"