mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-06-14 05:49:57 +00:00
Code Issues Projects Releases Wiki Activity

libwebsockets: fix CVE-2025-11678

Browse Source 
Backport a fix from Debian:
https://sources.debian.org/patches/libwebsockets/4.3.5-1+deb13u1/CVE-2025-11678.patch
Upstream commit:
https://github.com/warmcat/libwebsockets/commit/2bb9598562b37c942ba5b04bcde3f7fdf66a9d3a

Signed-off-by: Bruno VERNAY <bruno.vernay@se.com>
Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Hugo SIMELIERE
2025-11-19 15:42:26 +01:00
committed by Anuj Mittal
parent da04d7003e
commit 5fab8bd31b
2 changed files with 129 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2025-11678.patch
+128
View File
@@ -0,0 +1,128 @@
From e1d4c32bf773b8cf01eb5e368a4a21679e0b670a Mon Sep 17 00:00:00 2001
From: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
Date: Tue, 18 Nov 2025 17:03:33 +0100
Subject: [PATCH] NN-2025-0103: ADNS crafted response overflow
This document contains sensitive information collected during our
security research activities related with the Libwebsockets library made
by Andy Green (warmcat).
+-------------------------------------------------------------------------------------------------------+
| Report information |
+:===================================:+:===============================================================:+
| Vendor | warmcat |
+-------------------------------------+-----------------------------------------------------------------+
| Vendor URL | https://libwebsockets.org/git/libwebsockets |
+-------------------------------------+-----------------------------------------------------------------+
| Affected component | Ecostruxure Automation Expert |
+-------------------------------------+-----------------------------------------------------------------+
| Affected version | 4.4 |
+-------------------------------------+-----------------------------------------------------------------+
| Vulnerability | CWE-121: Stack-based Buffer Overflow |
+-------------------------------------+-----------------------------------------------------------------+
| Proposed CVSS v3.1 Base Score | 7.5 |
+-------------------------------------+-----------------------------------------------------------------+
| Proposed CVSS v3.1 Vector | CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
+-------------------------------------+-----------------------------------------------------------------+
+-----------------------------------------------------------------------------+
| Security Researcher(s) |
+:===================================:+:=====================================:+
| Name | **Email address** |
+-------------------------------------+---------------------------------------+
| Raffaele Bova | labs-advisory@nozominetworks.com |
+-------------------------------------+---------------------------------------+
**\**
Libwebsockes is a C library that provides client and server
implementation for various protocols (e.g., HTTP, websockets, MQTT) and
more.
Nozomi Networks Lab discovered a "CWE-121: Stack-based Buffer Overflow"
in the latest software version of libwebsockets, specifically in the
async-dns component.
The vulnerability allows an attacker that can inspect DNS requests made
by the victim (e.g. being in the same wireless network) to forge a DNS
response packet that overflows the stack and may lead to arbitrary code
execution (depending on the platform and compiler options).
The issue resides in `lws_adns_parse_label` function in
`lib/system/async-dns/async-dns-parse.c`; this function iteratively parses
a label however it does not correctly check the number of bytes written
in the destination buffer.
Specifically, the size of the dest output buffer is specified in the `dl`
argument, however during the read of each substring of the label only
the length of the current substring of the label is accounted for not
overflowing the destination buffer, but previous reads are not accounted
for.
This means that a label of arbitrary size and content can be supplied
and is copied onto the stack, however it must be split into substrings
of size less than `dl`.
To trigger the vulnerability an attacker must be able to sniff the DNS
request packet to send a response with a matching identifier, otherwise
the implantation correctly ignores the response.
We have provided a harness for testing, for ease of use copy the harness
in a subdirectory, for example in minimal-examples-lowlevel/api-tests/,
and build it
```
cmake -B build -DLWS_WITH_SYS_ASYNC_DNS=1 -DLWS_WITH_SSL=0
-DCMAKE_C_FLAGS="-fsanitize=address" . && make -C build lws-test-async-dns
```
Then it can be run `./build/bin/lws-test-async-dns < poc_stackbof`
![Address sanitizer report of stack buffer overflow](./NN-2025-0103_image.png)
We suggest keeping track of the number of bytes currently written on the
dest buffer, this could be done by saving the original dest pointer,
decrementing dl on each substring memcpy, or using an auxiliary
variable.
CVE: CVE-2025-11678
Upstream-Status: Backport [https://github.com/warmcat/libwebsockets/commit/2bb9598562b37c942ba5b04bcde3f7fdf66a9d3a]
Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
---
lib/system/async-dns/async-dns-parse.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/lib/system/async-dns/async-dns-parse.c b/lib/system/async-dns/async-dns-parse.c
index bdfe2050..81743b3f 100644
--- a/lib/system/async-dns/async-dns-parse.c
+++ b/lib/system/async-dns/async-dns-parse.c
@@ -35,7 +35,7 @@ lws_adns_parse_label(const uint8_t *pkt, int len, const uint8_t *ls, int budget,
const uint8_t *e = pkt + len, *ols = ls;
char pointer = 0, first = 1;
uint8_t ll;
- int n;
+ int n, readsize = 0;
if (budget < 1)
return 0;
@@ -88,7 +88,7 @@ again1:
return -1;
}
- if ((unsigned int)ll + 2 > dl) {
+ if ((unsigned int)(ll + 2 + readsize) > dl) {
lwsl_notice("%s: qname too large\n", __func__);
return -1;
@@ -101,6 +101,7 @@ again1:
(*dest)[ll + 1] = '\0';
*dest += ll + 1;
ls += ll;
+ readsize += ll + 1;
if (pointer) {
if (*ls)
--
2.43.0
meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.3.3.bb
+1
View File
@@ -10,6 +10,7 @@ S = "${WORKDIR}/git"
SRCREV = "4415e84c095857629863804e941b9e1c2e9347ef"
SRC_URI = "git://github.com/warmcat/libwebsockets.git;protocol=https;branch=v4.3-stable \
file://CVE-2025-11677.patch \
file://CVE-2025-11678.patch \
"
UPSTREAM_CHECK_URI = "https://github.com/warmcat/${BPN}/releases"