mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-16 06:37:38 +00:00
Code Issues Projects Releases Wiki Activity

freeipmi: patch CVE-2026-85504

Browse Source 
Backport commit from v1.6.19 matching NVD description.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-85504

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi authored and Anuj Mittal committed 2026-10-05 14:41:07 +05:30
1 parent 99bc8bd93a
commit 21592ce450
2 files changed
+94
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85504.patch
+93
View File
@@ -0,0 +1,93 @@
From 23bdae46ad532196ccd8a85d8a5c771e2aea1339 Mon Sep 17 00:00:00 2001
From: Albert L Chu <chu11@llnl.gov>
Date: Tue, 25 Aug 2026 11:40:41 -0700
Subject: [PATCH] libfreeipmi: bound Fujitsu SEL long-text responses
Reject short and oversized Fujitsu iRMC responses and cap each text chunk before copying it into the fixed-size output buffer.
Assisted-by: Codex, GPT-5.6-SOL
(cherry picked from commit 29fa34264e1eff685dcb9e0176e1eea0a6788e59)
CVE: CVE-2026-85504
Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/freeipmi.git/commit/?h=freeipmi-1-6-19&id=29fa34264e1eff685dcb9e0176e1eea0a6788e59]
Dropped changes to the ChangeLog file.
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../sel/ipmi-sel-string-fujitsu-irmc-common.c | 41 +++++++++++--------
1 file changed, 24 insertions(+), 17 deletions(-)
diff --git a/libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c b/libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c
index f514a56c5..24aa94fb7 100644
--- a/libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c
+++ b/libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c
@@ -80,10 +80,10 @@ _ipmi_sel_oem_fujitsu_get_sel_entry_long_text (ipmi_sel_ctx_t ctx,
uint8_t severity = 0;
char data_buf[IPMI_OEM_FUJITSU_SEL_ENTRY_LONG_TEXT_MAX_DATA_LENGTH + 1];
char string_buf[IPMI_OEM_FUJITSU_SEL_ENTRY_LONG_TEXT_MAX_STRING_LENGTH + 1];
- uint8_t data_length;
+ unsigned int data_length;
uint8_t max_read_length;
- uint8_t offset = 0;
- uint8_t component_length = 0;
+ unsigned int offset = 0;
+ size_t component_length = 0;
const char *css_str = NULL;
const char *severity_str = NULL;
int rv = -1;
@@ -208,8 +208,10 @@ _ipmi_sel_oem_fujitsu_get_sel_entry_long_text (ipmi_sel_ctx_t ctx,
"[Fujitsu OEM decoding requires administrator privilege]");
goto out;
}
- goto cleanup;
}
+
+ SEL_SET_ERRNUM (ctx, IPMI_SEL_ERR_IPMI_ERROR);
+ goto cleanup;
}
/* Get severity and CSS flag only once */
@@ -224,24 +226,29 @@ _ipmi_sel_oem_fujitsu_get_sel_entry_long_text (ipmi_sel_ctx_t ctx,
data_length = bytes_rs[15];
+ if (data_length > IPMI_OEM_FUJITSU_SEL_ENTRY_LONG_TEXT_MAX_DATA_LENGTH
+ || offset > data_length)
+ {
+ SEL_SET_ERRNUM (ctx, IPMI_SEL_ERR_IPMI_ERROR);
+ goto cleanup;
+ }
+
bytes_rs[rs_len-1] = '\0'; /* just to be sure it's terminated */
component_length = strlen ((char *)bytes_rs + 16);
- /* achu: truncate if there is overflow */
- if (offset + component_length > data_length)
- {
- memcpy (data_buf + offset,
- &bytes_rs[16],
- IPMI_OEM_FUJITSU_SEL_ENTRY_LONG_TEXT_MAX_DATA_LENGTH - offset);
- offset = data_length;
- }
- else
+ if (component_length > (data_length - offset))
+ component_length = data_length - offset;
+
+ if (!component_length && offset < data_length)
{
- memcpy (data_buf + offset,
- &bytes_rs[16],
- component_length);
- offset += component_length;
+ SEL_SET_ERRNUM (ctx, IPMI_SEL_ERR_IPMI_ERROR);
+ goto cleanup;
}
+
+ memcpy (data_buf + offset,
+ &bytes_rs[16],
+ component_length);
+ offset += component_length;
}
if (css == IPMI_OEM_FUJITSU_CSS_COMPONENT)
meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb
+1
View File
@@ -21,6 +21,7 @@ SRC_URI = "${GNU_MIRROR}/freeipmi/freeipmi-${PV}.tar.gz \
file://CVE-2026-85507.patch \
file://CVE-2026-85506.patch \
file://CVE-2026-85505.patch \
file://CVE-2026-85504.patch \
"
SRC_URI[sha256sum] = "16783d10faa28847a795cce0bf86deeaa72b8fbe71d1f0dc1101d13a6b501ec1"