From 40f7bfd054e8c154235d110d8095fa6411d530e0 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Mon, 6 Apr 2026 00:49:05 +1200 Subject: [PATCH] wolfssl: patch CVE-2026-2646 Details: https://nvd.nist.gov/vuln/detail/CVE-2026-2646 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../wolfssl/files/CVE-2026-2646-1.patch | 39 ++++++++++++++ .../wolfssl/files/CVE-2026-2646-2.patch | 51 +++++++++++++++++++ .../wolfssl/wolfssl_5.8.0.bb | 2 + 3 files changed, 92 insertions(+) create mode 100644 meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-2646-1.patch create mode 100644 meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-2646-2.patch diff --git a/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-2646-1.patch b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-2646-1.patch new file mode 100644 index 0000000000..65daca16eb --- /dev/null +++ b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-2646-1.patch @@ -0,0 +1,39 @@ +From 693e9d5e986ac642090331e5f76cfdfd656e3bbc Mon Sep 17 00:00:00 2001 +From: Reda Chouk +Date: Fri, 6 Feb 2026 17:00:42 +0100 +Subject: [PATCH] add missing checks in wolfSSL_d2i_SSL_SESSION + +(cherry picked from commit f94eb68ea36aee271e0645812ec3bb038f43098b) + +CVE: CVE-2026-2646 +Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/f94eb68ea36aee271e0645812ec3bb038f43098b] +Signed-off-by: Ankur Tyagi +--- + src/ssl_sess.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/src/ssl_sess.c b/src/ssl_sess.c +index c5e0e682a..75680f1bf 100644 +--- a/src/ssl_sess.c ++++ b/src/ssl_sess.c +@@ -2840,12 +2840,20 @@ WOLFSSL_SESSION* wolfSSL_d2i_SSL_SESSION(WOLFSSL_SESSION** sess, + goto end; + } + s->chain.count = data[idx++]; ++ if (s->chain.count > MAX_CHAIN_DEPTH) { ++ ret = BUFFER_ERROR; ++ goto end; ++ } + for (j = 0; j < s->chain.count; j++) { + if (i - idx < OPAQUE16_LEN) { + ret = BUFFER_ERROR; + goto end; + } + ato16(data + idx, &length); idx += OPAQUE16_LEN; ++ if (length > MAX_X509_SIZE) { ++ ret = BUFFER_ERROR; ++ goto end; ++ } + s->chain.certs[j].length = length; + if (i - idx < length) { + ret = BUFFER_ERROR; diff --git a/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-2646-2.patch b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-2646-2.patch new file mode 100644 index 0000000000..a1dfa8975d --- /dev/null +++ b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-2646-2.patch @@ -0,0 +1,51 @@ +From e5a887b643850138d225ec47febf1c117c38464a Mon Sep 17 00:00:00 2001 +From: jordan +Date: Wed, 11 Mar 2026 09:47:15 -0500 +Subject: [PATCH] ssl_sess: check fields in wolfSSL_d2i_SSL_SESSION. + +(cherry picked from commit 0a99a08b0f196cad1cd35e2261465c5d5f080739) + +CVE: CVE-2026-2646 +Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/0a99a08b0f196cad1cd35e2261465c5d5f080739] +Signed-off-by: Ankur Tyagi +--- + src/ssl_sess.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/src/ssl_sess.c b/src/ssl_sess.c +index 75680f1bf..08b2219ef 100644 +--- a/src/ssl_sess.c ++++ b/src/ssl_sess.c +@@ -2808,6 +2808,10 @@ WOLFSSL_SESSION* wolfSSL_d2i_SSL_SESSION(WOLFSSL_SESSION** sess, + ato32(data + idx, &s->bornOn); idx += OPAQUE32_LEN; + ato32(data + idx, &s->timeout); idx += OPAQUE32_LEN; + s->sessionIDSz = data[idx++]; ++ if (s->sessionIDSz > ID_LEN) { ++ ret = BUFFER_ERROR; ++ goto end; ++ } + + /* sessionID | secret | haveEMS | haveAltSessionID */ + if (i - idx < s->sessionIDSz + SECRET_LEN + OPAQUE8_LEN + OPAQUE8_LEN) { +@@ -2890,6 +2894,10 @@ WOLFSSL_SESSION* wolfSSL_d2i_SSL_SESSION(WOLFSSL_SESSION** sess, + goto end; + } + ato16(data + idx, &s->idLen); idx += OPAQUE16_LEN; ++ if (s->idLen > SERVER_ID_LEN) { ++ ret = BUFFER_ERROR; ++ goto end; ++ } + + /* ServerID */ + if (i - idx < s->idLen) { +@@ -2905,6 +2913,10 @@ WOLFSSL_SESSION* wolfSSL_d2i_SSL_SESSION(WOLFSSL_SESSION** sess, + goto end; + } + s->sessionCtxSz = data[idx++]; ++ if (s->sessionCtxSz > ID_LEN) { ++ ret = BUFFER_ERROR; ++ goto end; ++ } + + /* app session context ID */ + if (i - idx < s->sessionCtxSz) { diff --git a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.8.0.bb b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.8.0.bb index e9be766e67..5db019c9cb 100644 --- a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.8.0.bb +++ b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.8.0.bb @@ -28,6 +28,8 @@ SRC_URI = " \ file://CVE-2025-7394-5.patch \ file://CVE-2025-7394-6.patch \ file://CVE-2026-0819.patch \ + file://CVE-2026-2646-1.patch \ + file://CVE-2026-2646-2.patch \ " SRCREV = "b077c81eb635392e694ccedbab8b644297ec0285"