wolfssl: patch CVE-2026-6094

Details
https://nvd.nist.gov/vuln/detail/cve-2026-6094

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-6094-1.patch

@@ -0,0 +1,32 @@
+From f162b7679bafacd5b9866d72400b1115f8fbc7b7 Mon Sep 17 00:00:00 2001
+From: Kareem <kareem@wolfssl.com>
+Date: Fri, 3 Apr 2026 16:05:44 -0700
+Subject: [PATCH] Ensure esd->signedAttribsCount contains the correct count in
+ case some are skipped by using the current idx rather than the total array
+ size.
+
+Thanks to Zou Dikai for the report.
+
+(cherry picked from commit 7f218574c4d30a8aa8c520c7023c3d017fc13b86)
+
+CVE: CVE-2026-6094
+Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/7f218574c4d30a8aa8c520c7023c3d017fc13b86]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ wolfcrypt/src/pkcs7.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
+index 3f6649d0a..67803f84d 100644
+--- a/wolfcrypt/src/pkcs7.c
++++ b/wolfcrypt/src/pkcs7.c
+@@ -2253,7 +2253,7 @@ static int wc_PKCS7_BuildSignedAttributes(wc_PKCS7* pkcs7, ESD* esd,
+             idx++;
+         }
+ 
+-        esd->signedAttribsCount += cannedAttribsCount;
++        esd->signedAttribsCount += idx;
+         esd->signedAttribsSz += (word32)EncodeAttributes(
+             &esd->signedAttribs[atrIdx], (int)idx, cannedAttribs,
+             (int)cannedAttribsCount);

meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-6094-2.patch

@@ -0,0 +1,35 @@
+From 6d7fe2926a18982278c53b4ec413fe7b2349a019 Mon Sep 17 00:00:00 2001
+From: Kareem <kareem@wolfssl.com>
+Date: Fri, 3 Apr 2026 16:06:35 -0700
+Subject: [PATCH] In wc_PKCS7_DecodeEnvelopedData, confirm
+ encryptedContentTotalSz does not exceed the total message size before using
+ it in the non-streaming case.
+
+Thanks to Zou Dikai for the report.
+
+(cherry picked from commit 1397268aa12e2cf3f80c3acfa9b6036b809c08ef)
+
+CVE: CVE-2026-6094
+Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/1397268aa12e2cf3f80c3acfa9b6036b809c08ef]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ wolfcrypt/src/pkcs7.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
+index 67803f84d..43bcf3ee4 100644
+--- a/wolfcrypt/src/pkcs7.c
++++ b/wolfcrypt/src/pkcs7.c
+@@ -13231,6 +13231,11 @@ int wc_PKCS7_DecodeEnvelopedData(wc_PKCS7* pkcs7, byte* in,
+                 }
+                 wc_PKCS7_DecryptContentFree(pkcs7, encOID, pkcs7->heap);
+             } else {
++                if ((idx + (word32)encryptedContentTotalSz) > pkiMsgSz) {
++                    ret = BUFFER_E;
++                    break;
++                }
++
+                 pkcs7->cachedEncryptedContentSz =
+                     (word32)encryptedContentTotalSz;
+                 pkcs7->totalEncryptedContentSz =

meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-6094-3.patch

@@ -0,0 +1,39 @@
+From c7f7a8ef00e6a7a33a623543507f8fa089f6037b Mon Sep 17 00:00:00 2001
+From: Kareem <kareem@wolfssl.com>
+Date: Fri, 3 Apr 2026 16:56:04 -0700
+Subject: [PATCH] Code review feedback
+
+(cherry picked from commit ebdcc03b718cd7175355097b1a3831a0eb4875b2)
+
+CVE: CVE-2026-6094
+Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/ebdcc03b718cd7175355097b1a3831a0eb4875b2]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ wolfcrypt/src/pkcs7.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
+index 43bcf3ee4..50d33bdb8 100644
+--- a/wolfcrypt/src/pkcs7.c
++++ b/wolfcrypt/src/pkcs7.c
+@@ -2256,7 +2256,7 @@ static int wc_PKCS7_BuildSignedAttributes(wc_PKCS7* pkcs7, ESD* esd,
+         esd->signedAttribsCount += idx;
+         esd->signedAttribsSz += (word32)EncodeAttributes(
+             &esd->signedAttribs[atrIdx], (int)idx, cannedAttribs,
+-            (int)cannedAttribsCount);
++            (int)idx);
+         atrIdx += idx;
+     } else {
+         esd->signedAttribsCount = 0;
+@@ -13231,7 +13231,9 @@ int wc_PKCS7_DecodeEnvelopedData(wc_PKCS7* pkcs7, byte* in,
+                 }
+                 wc_PKCS7_DecryptContentFree(pkcs7, encOID, pkcs7->heap);
+             } else {
+-                if ((idx + (word32)encryptedContentTotalSz) > pkiMsgSz) {
++                word32 tmpSum;
++                if (!WC_SAFE_SUM_WORD32(idx, (word32)encryptedContentTotalSz, tmpSum) ||
++                    tmpSum > pkiMsgSz) {
+                     ret = BUFFER_E;
+                     break;
+                 }

meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-6094-4.patch

@@ -0,0 +1,36 @@
+From a9015491db03d415f766f47c139841249adce843 Mon Sep 17 00:00:00 2001
+From: Kareem <kareem@wolfssl.com>
+Date: Mon, 6 Apr 2026 11:58:12 -0700
+Subject: [PATCH] Fix unused variable error
+
+(cherry picked from commit 3e04475875a4942652fdf6794a01fdfd65801fdc)
+
+CVE: CVE-2026-6094
+Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/3e04475875a4942652fdf6794a01fdfd65801fdc]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ wolfcrypt/src/pkcs7.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
+index 50d33bdb8..2cde73846 100644
+--- a/wolfcrypt/src/pkcs7.c
++++ b/wolfcrypt/src/pkcs7.c
+@@ -2197,7 +2197,6 @@ static int wc_PKCS7_BuildSignedAttributes(wc_PKCS7* pkcs7, ESD* esd,
+ #endif
+     word32 idx    = 0;
+     word32 atrIdx = 0;
+-    word32 cannedAttribsCount;
+ 
+     if (pkcs7 == NULL || esd == NULL || contentType == NULL ||
+         contentTypeOid == NULL || messageDigestOid == NULL ||
+@@ -2220,8 +2219,6 @@ static int wc_PKCS7_BuildSignedAttributes(wc_PKCS7* pkcs7, ESD* esd,
+             return timeSz;
+     #endif
+ 
+-        cannedAttribsCount = sizeof(cannedAttribs)/sizeof(PKCS7Attrib);
+-
+         XMEMSET(&cannedAttribs[idx], 0, sizeof(cannedAttribs[idx]));
+ 
+         if ((pkcs7->defaultSignedAttribs & WOLFSSL_CONTENT_TYPE_ATTRIBUTE) ||

meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-6094-5.patch

@@ -0,0 +1,73 @@
+From c27fbdecfd2f4a31acdc73229a5bc631184265f1 Mon Sep 17 00:00:00 2001
+From: Kareem <kareem@wolfssl.com>
+Date: Mon, 6 Apr 2026 16:41:32 -0700
+Subject: [PATCH] Add additional checks for encryptedContentSz exceeding
+ pkiMsgSz.
+
+(cherry picked from commit b3c2877a146e0c75715368ca5dfe2387bfc2cadf)
+
+CVE: CVE-2026-6094
+Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/b3c2877a146e0c75715368ca5dfe2387bfc2cadf]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ wolfcrypt/src/pkcs7.c | 38 ++++++++++++++++++++++++++------------
+ 1 file changed, 26 insertions(+), 12 deletions(-)
+
+diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
+index 2cde73846..8df3a2430 100644
+--- a/wolfcrypt/src/pkcs7.c
++++ b/wolfcrypt/src/pkcs7.c
+@@ -14380,9 +14380,17 @@ int wc_PKCS7_DecodeAuthEnvelopedData(wc_PKCS7* pkcs7, byte* in,
+             }
+ 
+             if (ret == 0) {
+-                XMEMCPY(encryptedContent, &pkiMsg[idx],
++                word32 tmpSum;
++                if (!WC_SAFE_SUM_WORD32(idx, (word32)encryptedContentSz,
++                                        tmpSum) ||
++                    tmpSum > pkiMsgSz) {
++                    ret = BUFFER_E;
++                    break;
++                } else {
++                    XMEMCPY(encryptedContent, &pkiMsg[idx],
+                                                     (word32)encryptedContentSz);
+-                idx += (word32)encryptedContentSz;
++                    idx += (word32)encryptedContentSz;
++                }
+             }
+         #ifndef NO_PKCS7_STREAM
+             pkcs7->stream->bufferPt = encryptedContent;
+@@ -15316,16 +15324,22 @@ int wc_PKCS7_DecodeEncryptedData(wc_PKCS7* pkcs7, byte* in, word32 inSz,
+             }
+ 
+             if (ret == 0) {
+-                XMEMCPY(encryptedContent, &pkiMsg[idx],
+-                    (unsigned int)encryptedContentSz);
+-                idx += (word32)encryptedContentSz;
+-
+-                /* decrypt encryptedContent */
+-                ret = wc_PKCS7_DecryptContent(pkcs7, encOID,
+-                              pkcs7->encryptionKey, pkcs7->encryptionKeySz,
+-                              tmpIv, expBlockSz, NULL, 0, NULL, 0,
+-                              encryptedContent, encryptedContentSz,
+-                              encryptedContent, pkcs7->devId, pkcs7->heap);
++                word32 tmpSum;
++                if (!WC_SAFE_SUM_WORD32(idx, (word32)encryptedContentSz, tmpSum) ||
++                    tmpSum > pkiMsgSz) {
++                    ret = BUFFER_E;
++                } else {
++                    XMEMCPY(encryptedContent, &pkiMsg[idx],
++                        (unsigned int)encryptedContentSz);
++                    idx += (word32)encryptedContentSz;
++
++                    /* decrypt encryptedContent */
++                    ret = wc_PKCS7_DecryptContent(pkcs7, encOID,
++                                pkcs7->encryptionKey, pkcs7->encryptionKeySz,
++                                tmpIv, expBlockSz, NULL, 0, NULL, 0,
++                                encryptedContent, encryptedContentSz,
++                                encryptedContent, pkcs7->devId, pkcs7->heap);
++                }
+                 if (ret != 0) {
+                     XFREE(encryptedContent, pkcs7->heap, DYNAMIC_TYPE_PKCS7);
+                 }

meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb

@@ -23,6 +23,11 @@ SRC_URI = " \
     file://CVE-2026-6091-2.patch \
     file://CVE-2026-6091-3.patch \
     file://CVE-2026-6092.patch \
+    file://CVE-2026-6094-1.patch \
+    file://CVE-2026-6094-2.patch \
+    file://CVE-2026-6094-3.patch \
+    file://CVE-2026-6094-4.patch \
+    file://CVE-2026-6094-5.patch \
 "
 
 SRCREV = "1d363f3adceba9d1478230ede476a37b0dcdef24"