mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-15 06:17:16 +00:00
Code Issues Projects Releases Wiki Activity

miniupnpd: patch CVE-2026-107159

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-107159

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi authored and Khem Raj committed 2026-10-12 11:26:14 -07:00
1 parent 0f8cf2b6f7
commit 2c888ebe75
2 files changed
+79
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch
+78
View File
@@ -0,0 +1,78 @@
From 8a3e282b22b16fc90740d62fe213c51696e8dc01 Mon Sep 17 00:00:00 2001
From: Thomas Bernard <miniupnp@free.fr>
Date: Sat, 3 Oct 2026 23:42:55 +0200
Subject: [PATCH] minissdp.c: MX: 0 is invalid as well. 1 is the minimum
accepted
(cherry picked from commit 8f13b7a5843f5270db684099c0a083f98869636a)
CVE: CVE-2026-107159
Upstream-Status: Backport [https://github.com/miniupnp/miniupnp/commit/8f13b7a5843f5270db684099c0a083f98869636a]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
minissdp.c | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)
diff --git a/minissdp.c b/minissdp.c
index afb11ec..d825bf6 100644
--- a/minissdp.c
+++ b/minissdp.c
@@ -2,7 +2,7 @@
/* vim: tabstop=4 shiftwidth=4 noexpandtab
* MiniUPnP project
* http://miniupnp.free.fr/ or https://miniupnp.tuxfamily.org/
- * (c) 2006-2025 Thomas Bernard
+ * (c) 2006-2026 Thomas Bernard
* This software is subject to the conditions detailed
* in the LICENCE file provided within the distribution */
@@ -1015,7 +1015,7 @@ ProcessSSDPData(int s, const char *bufr, int n,
#endif
#endif
#if defined(UPNP_STRICT) || defined(DELAY_MSEARCH_RESPONSE)
- int mx_value = -1;
+ int mx_value = -1; /* -1 => not set, -2 => invalid value (0 or negative) */
#endif
unsigned int delay = 50; /* Non-zero default delay to prevent flooding */
/* UPnP Device Architecture v1.1. 1.3.3 Search response :
@@ -1113,7 +1113,16 @@ ProcessSSDPData(int s, const char *bufr, int n,
memset(atoi_buffer, 0, sizeof(atoi_buffer));
memcpy(atoi_buffer, mx, MIN((int)(sizeof(atoi_buffer) - 1), mx_len));
mx_value = atoi(atoi_buffer);
- syslog(LOG_DEBUG, "MX: %.*s (value=%d)", mx_len, mx, mx_value);
+ /* UPnP Device Architechture v2.0 :
+ * MX
+ * Required. Field value contains maximum wait time in seconds.
+ * shall be greater than or equal to 1 and should be less than
+ * 5 inclusive. */
+ if (mx_value <= 0) {
+ syslog(LOG_WARNING, "MX: %.*s (value=%d) INVALID (must be between 1 and 5 incl.)", mx_len, mx, mx_value);
+ } else {
+ syslog(LOG_DEBUG, "MX: %.*s (value=%d)", mx_len, mx, mx_value);
+ }
}
#endif /* defined(UPNP_STRICT) || defined(DELAY_MSEARCH_RESPONSE) */
#if defined(UPNP_STRICT)
@@ -1140,9 +1149,12 @@ ProcessSSDPData(int s, const char *bufr, int n,
/* For multicast M-SEARCH requests, if the search request does
* not contain an MX header field, the device MUST silently
* discard and ignore the search request. */
- if(mx_value < 0) {
+ if(mx_value == -1) {
syslog(LOG_INFO, "ignoring SSDP packet missing MX: header");
return;
+ } else if(mx_value <= 0) {
+ syslog(LOG_WARNING, "ignoring SSDP packet with invalid value for MX: header");
+ return;
} else if(mx_value > 5) {
/* If the MX header field specifies a field value greater
* than 5, the device SHOULD assume that it contained the
@@ -1150,7 +1162,7 @@ ProcessSSDPData(int s, const char *bufr, int n,
mx_value = 5;
}
#elif defined(DELAY_MSEARCH_RESPONSE)
- if(mx_value < 0) {
+ if(mx_value <= 0) {
mx_value = 1;
} else if(mx_value > 5) {
/* If the MX header field specifies a field value greater
meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb
+1
View File
@@ -13,6 +13,7 @@ DEPENDS += "iptables net-tools util-linux libmnl libnetfilter-conntrack openssl"
SRC_URI = "http://miniupnp.tuxfamily.org/files/download.php?file=${BP}.tar.gz;downloadfilename=${BP}.tar.gz \
file://miniupnpd.service \
file://CVE-2026-107159.patch \
"
SRC_URI[sha256sum] = "91994b127da735b2c97f19992e34420648c0e8c4ace8a4bcb0596e7685c48678"