From 27ba3fb054fc934d486fd96ba322cbb7bfa1ea37 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Thu, 9 Apr 2026 19:09:06 +1200 Subject: [PATCH] freerdp3: fix CVE-2026-24679 Details: https://nvd.nist.gov/vuln/detail/CVE-2026-24679 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../freerdp/freerdp3/CVE-2026-24679.patch | 44 +++++++++++++++++++ .../recipes-support/freerdp/freerdp3_3.4.0.bb | 1 + 2 files changed, 45 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-24679.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-24679.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-24679.patch new file mode 100644 index 0000000000..7829a63f03 --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-24679.patch @@ -0,0 +1,44 @@ +From d128bdb4131634a7f877500da9fee4fee99bf019 Mon Sep 17 00:00:00 2001 +From: akallabeth +Date: Mon, 26 Jan 2026 10:59:39 +0100 +Subject: [PATCH] [channels,urbdrc] ensure InterfaceNumber is within range + +(cherry picked from commit 2d563a50be17c1b407ca448b1321378c0726dd31) + +CVE: CVE-2026-24679 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/2d563a50be17c1b407ca448b1321378c0726dd31] +Signed-off-by: Ankur Tyagi +--- + channels/urbdrc/client/libusb/libusb_udevice.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/channels/urbdrc/client/libusb/libusb_udevice.c b/channels/urbdrc/client/libusb/libusb_udevice.c +index c226eb806..ea12e55e0 100644 +--- a/channels/urbdrc/client/libusb/libusb_udevice.c ++++ b/channels/urbdrc/client/libusb/libusb_udevice.c +@@ -532,19 +532,19 @@ static int libusb_udev_select_interface(IUDEVICE* idev, BYTE InterfaceNumber, BY + int error = 0; + int diff = 0; + UDEVICE* pdev = (UDEVICE*)idev; +- URBDRC_PLUGIN* urbdrc = NULL; +- MSUSB_CONFIG_DESCRIPTOR* MsConfig = NULL; +- MSUSB_INTERFACE_DESCRIPTOR** MsInterfaces = NULL; + + if (!pdev || !pdev->urbdrc) + return -1; + +- urbdrc = pdev->urbdrc; +- MsConfig = pdev->MsConfig; ++ URBDRC_PLUGIN* urbdrc = pdev->urbdrc; ++ MSUSB_CONFIG_DESCRIPTOR* MsConfig = pdev->MsConfig; + + if (MsConfig) + { +- MsInterfaces = MsConfig->MsInterfaces; ++ if (InterfaceNumber >= MsConfig->NumInterfaces) ++ return -2; ++ ++ MSUSB_INTERFACE_DESCRIPTOR** MsInterfaces = MsConfig->MsInterfaces; + if (MsInterfaces) + { + WLog_Print(urbdrc->log, WLOG_INFO, diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb index 82b926f430..031cb4a665 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.4.0.bb @@ -26,6 +26,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;branch=master;protocol=https \ file://CVE-2026-24491.patch \ file://CVE-2026-24675.patch \ file://CVE-2026-24676.patch \ + file://CVE-2026-24679.patch \ " S = "${WORKDIR}/git"