From 728a6aeb17fb6c90cb8a3bd2d59ef26ea047da52 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Wed, 4 Nov 2026 07:36:40 +1300 Subject: [PATCH] ndpi: patch CVE-2026-116744 Details: https://nvd.nist.gov/vuln/detail/cve-2026-116744 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj --- .../ntopng/files/CVE-2026-116744.patch | 33 +++++++++++++++++++ .../recipes-support/ntopng/ndpi_5.0.bb | 1 + 2 files changed, 34 insertions(+) create mode 100644 meta-networking/recipes-support/ntopng/files/CVE-2026-116744.patch diff --git a/meta-networking/recipes-support/ntopng/files/CVE-2026-116744.patch b/meta-networking/recipes-support/ntopng/files/CVE-2026-116744.patch new file mode 100644 index 0000000000..5794963ada --- /dev/null +++ b/meta-networking/recipes-support/ntopng/files/CVE-2026-116744.patch @@ -0,0 +1,33 @@ +From 00706d4da0b7a1f9eff61e5835a0a1cc22c9c7e1 Mon Sep 17 00:00:00 2001 +From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> +Date: Mon, 26 Oct 2026 17:35:39 +0100 +Subject: [PATCH] softEther: fix out-of-bounds read (#3298) + +Close: #3291 + +Reported by HaiND (Nguyen Dinh Hai), Post and Telecommunication +Institute of Technology, github.com/Haind03 + +(cherry picked from commit ca9d819151606377ac53305583fe819748c69be2) + +CVE: CVE-2026-116744 +Upstream-Status: Backport [https://github.com/ntop/nDPI/commit/ca9d819151606377ac53305583fe819748c69be2] +Signed-off-by: Ankur Tyagi +--- + src/lib/protocols/softether.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/lib/protocols/softether.c b/src/lib/protocols/softether.c +index 379e743f7..c6f5d131e 100644 +--- a/src/lib/protocols/softether.c ++++ b/src/lib/protocols/softether.c +@@ -200,7 +200,8 @@ static int dissect_softether_host_fqdn(struct ndpi_flow_struct *flow, + payload += value_siz; + payload_len -= value_siz; + +- if(strncmp(val1.value.ptr.value_str, "host_name", value_siz) == 0) ++ if(val1.value_size > 0 && ++ strncmp(val1.value.ptr.value_str, "host_name", value_siz) == 0) + got_hostname = 1; + + for (; tuple_count > 0; --tuple_count) { diff --git a/meta-networking/recipes-support/ntopng/ndpi_5.0.bb b/meta-networking/recipes-support/ntopng/ndpi_5.0.bb index 6eadf8ba62..80890b1f27 100644 --- a/meta-networking/recipes-support/ntopng/ndpi_5.0.bb +++ b/meta-networking/recipes-support/ntopng/ndpi_5.0.bb @@ -11,6 +11,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b52f2d57d10c4f7ee67a7eb9615d5d24" SRCREV = "375f99ef9fb4999d778b57bbeece171b3fa9fba6" SRC_URI = "git://github.com/ntop/nDPI.git;branch=5.0-stable;protocol=https;tag=${PV} \ file://0001-configure-Stop-embedding-pwd-at-configure-time.patch \ + file://CVE-2026-116744.patch \ " inherit autotools pkgconfig