mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-06-13 17:39:57 +00:00
Code Issues Projects Releases Wiki Activity

wolfssl: patch CVE-2026-2646

Browse Source 
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-2646

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-04-06 00:49:05 +12:00
committed by Anuj Mittal
parent e4fbbe5138
commit 40f7bfd054
3 changed files with 92 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-2646-1.patch
+39
View File
@@ -0,0 +1,39 @@
From 693e9d5e986ac642090331e5f76cfdfd656e3bbc Mon Sep 17 00:00:00 2001
From: Reda Chouk <reda@wolfssl.com>
Date: Fri, 6 Feb 2026 17:00:42 +0100
Subject: [PATCH] add missing checks in wolfSSL_d2i_SSL_SESSION
(cherry picked from commit f94eb68ea36aee271e0645812ec3bb038f43098b)
CVE: CVE-2026-2646
Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/f94eb68ea36aee271e0645812ec3bb038f43098b]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
src/ssl_sess.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/src/ssl_sess.c b/src/ssl_sess.c
index c5e0e682a..75680f1bf 100644
--- a/src/ssl_sess.c
+++ b/src/ssl_sess.c
@@ -2840,12 +2840,20 @@ WOLFSSL_SESSION* wolfSSL_d2i_SSL_SESSION(WOLFSSL_SESSION** sess,
goto end;
}
s->chain.count = data[idx++];
+ if (s->chain.count > MAX_CHAIN_DEPTH) {
+ ret = BUFFER_ERROR;
+ goto end;
+ }
for (j = 0; j < s->chain.count; j++) {
if (i - idx < OPAQUE16_LEN) {
ret = BUFFER_ERROR;
goto end;
}
ato16(data + idx, &length); idx += OPAQUE16_LEN;
+ if (length > MAX_X509_SIZE) {
+ ret = BUFFER_ERROR;
+ goto end;
+ }
s->chain.certs[j].length = length;
if (i - idx < length) {
ret = BUFFER_ERROR;
meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-2646-2.patch
+51
View File
@@ -0,0 +1,51 @@
From e5a887b643850138d225ec47febf1c117c38464a Mon Sep 17 00:00:00 2001
From: jordan <jordan@wolfssl.com>
Date: Wed, 11 Mar 2026 09:47:15 -0500
Subject: [PATCH] ssl_sess: check fields in wolfSSL_d2i_SSL_SESSION.
(cherry picked from commit 0a99a08b0f196cad1cd35e2261465c5d5f080739)
CVE: CVE-2026-2646
Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/0a99a08b0f196cad1cd35e2261465c5d5f080739]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
src/ssl_sess.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/src/ssl_sess.c b/src/ssl_sess.c
index 75680f1bf..08b2219ef 100644
--- a/src/ssl_sess.c
+++ b/src/ssl_sess.c
@@ -2808,6 +2808,10 @@ WOLFSSL_SESSION* wolfSSL_d2i_SSL_SESSION(WOLFSSL_SESSION** sess,
ato32(data + idx, &s->bornOn); idx += OPAQUE32_LEN;
ato32(data + idx, &s->timeout); idx += OPAQUE32_LEN;
s->sessionIDSz = data[idx++];
+ if (s->sessionIDSz > ID_LEN) {
+ ret = BUFFER_ERROR;
+ goto end;
+ }
/* sessionID | secret | haveEMS | haveAltSessionID */
if (i - idx < s->sessionIDSz + SECRET_LEN + OPAQUE8_LEN + OPAQUE8_LEN) {
@@ -2890,6 +2894,10 @@ WOLFSSL_SESSION* wolfSSL_d2i_SSL_SESSION(WOLFSSL_SESSION** sess,
goto end;
}
ato16(data + idx, &s->idLen); idx += OPAQUE16_LEN;
+ if (s->idLen > SERVER_ID_LEN) {
+ ret = BUFFER_ERROR;
+ goto end;
+ }
/* ServerID */
if (i - idx < s->idLen) {
@@ -2905,6 +2913,10 @@ WOLFSSL_SESSION* wolfSSL_d2i_SSL_SESSION(WOLFSSL_SESSION** sess,
goto end;
}
s->sessionCtxSz = data[idx++];
+ if (s->sessionCtxSz > ID_LEN) {
+ ret = BUFFER_ERROR;
+ goto end;
+ }
/* app session context ID */
if (i - idx < s->sessionCtxSz) {
meta-networking/recipes-connectivity/wolfssl/wolfssl_5.8.0.bb
+2
View File
@@ -28,6 +28,8 @@ SRC_URI = " \
file://CVE-2025-7394-5.patch \
file://CVE-2025-7394-6.patch \
file://CVE-2026-0819.patch \
file://CVE-2026-2646-1.patch \
file://CVE-2026-2646-2.patch \
"
SRCREV = "b077c81eb635392e694ccedbab8b644297ec0285"