mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-24 11:40:17 +00:00
Code Issues Projects Releases Wiki Activity

wolfssl: patch CVE-2026-7531

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-7531

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-09-15 10:13:42 +05:30
committed by Anuj Mittal
parent e99f95d5b5
commit 7ce36bf1cc
2 changed files with 181 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-7531.patch
+180
View File
@@ -0,0 +1,180 @@
From 5ab994ddce690cc904554ff03af263ef0624d29d Mon Sep 17 00:00:00 2001
From: David Garske <david@wolfssl.com>
Date: Tue, 5 May 2026 11:41:43 -0700
Subject: [PATCH] Merge pull request #10327 from embhorn/zd21704
Hardening in TLSX_KeyShare_ProcessPqcHybridClient
CVE: CVE-2026-7531
Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/3b7ac9fd256b26c33b66f9315c319465ba3bcfeb]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
src/tls.c | 19 +++++---
tests/api/test_tls13.c | 98 ++++++++++++++++++++++++++++++++++++++++++
tests/api/test_tls13.h | 2 +
3 files changed, 114 insertions(+), 5 deletions(-)
diff --git a/src/tls.c b/src/tls.c
index 18aad71d3..e5b989482 100644
--- a/src/tls.c
+++ b/src/tls.c
@@ -10187,15 +10187,24 @@ static int TLSX_KeyShare_ProcessPqcHybridClient(WOLFSSL* ssl,
ecc_kse->key = NULL;
pqc_kse->privKey = NULL;
}
+ else
#endif
+ {
+ /* Re-sync keyShareEntry->key with ecc_kse->key. ecc_kse->key was
+ * aliased to keyShareEntry->key above. The inner Process*_ex
+ * either ran its end-of-function cleanup and set ecc_kse->key
+ * to NULL (so the outer pointer must also become NULL to avoid
+ * UAF/double-free in TLSX_KeyShare_FreeAll), or returned early
+ * before cleanup with ecc_kse->key still pointing at the live
+ * key (so the outer pointer must keep that pointer for later
+ * freeing). Mirroring whatever the inner left in ecc_kse->key
+ * handles both cases correctly. */
+ keyShareEntry->key = ecc_kse->key;
+ }
}
if (ret == 0) {
- keyShareEntry->key = ecc_kse->key;
- ecc_kse->key = NULL;
-
- if ((ret == 0) &&
- ((ssl->arrays->preMasterSz + ssSzPqc) > ENCRYPT_LEN)) {
+ if ((ssl->arrays->preMasterSz + ssSzPqc) > ENCRYPT_LEN) {
WOLFSSL_MSG("shared secret is too long.");
ret = LENGTH_ERROR;
}
diff --git a/tests/api/test_tls13.c b/tests/api/test_tls13.c
index 63ddffb7a..af050a234 100644
--- a/tests/api/test_tls13.c
+++ b/tests/api/test_tls13.c
@@ -3581,6 +3581,104 @@ int test_tls13_pqc_hybrid_truncated_keyshare(void)
return EXPECT_RESULT();
}
+/* Test that a malformed ECDH portion in a correctly-sized PQC hybrid
+ * KeyShare does not leave a dangling pointer in keyShareEntry->key.
+ *
+ * The earlier truncated-keyshare test is rejected by the keLen <= ctSz
+ * check before TLSX_KeyShare_ProcessPqcHybridClient sets up the
+ * ecc_kse->key = keyShareEntry->key alias, so it does not exercise the
+ * dangling-pointer path. This test sends a SECP256R1MLKEM768 key_share
+ * whose total length is correct (65-byte ECDH point + 1088-byte ML-KEM
+ * ciphertext = 1153 bytes) but whose ECDH leading byte (0x05) is not a
+ * valid X9.63 marker. ProcessEcc_ex then fails at wc_ecc_import_x963
+ * AFTER its unconditional cleanup at the end of the function frees the
+ * aliased key. Without the fix, the outer keyShareEntry->key still
+ * holds the freed pointer; wolfSSL_free -> TLSX_KeyShare_FreeAll calls
+ * wc_ecc_free + XFREE on it, producing a use-after-free and a double
+ * free that ASAN flags. */
+int test_tls13_pqc_hybrid_malformed_ecdh(void)
+{
+ EXPECT_DECLS;
+#if defined(WOLFSSL_TLS13) && !defined(NO_WOLFSSL_CLIENT) && \
+ defined(WOLFSSL_HAVE_MLKEM) && defined(WOLFSSL_PQC_HYBRIDS) && \
+ !defined(WOLFSSL_NO_ML_KEM_768) && defined(HAVE_ECC) && \
+ !defined(WOLFSSL_MLKEM_NO_DECAPSULATE) && \
+ !defined(WOLFSSL_MLKEM_NO_MAKE_KEY) && \
+ (!defined(NO_ECC256) || defined(HAVE_ALL_CURVES)) && \
+ !defined(NO_ECC_SECP)
+ WOLFSSL_CTX *ctx = NULL;
+ WOLFSSL *ssl = NULL;
+ /* 5 (record) + 4 (HS) + 1207 (ServerHello body) = 1216 bytes. */
+ static byte serverHello[1216];
+ word32 i = 0;
+ WOLFSSL_BUFFER_INFO msg;
+
+ XMEMSET(serverHello, 0, sizeof(serverHello));
+
+ /* Record: handshake, TLS 1.2 compat, length 1211 (0x04bb). */
+ serverHello[i++] = 0x16; serverHello[i++] = 0x03; serverHello[i++] = 0x03;
+ serverHello[i++] = 0x04; serverHello[i++] = 0xbb;
+ /* Handshake: ServerHello (0x02), length 1207 (0x0004b7). */
+ serverHello[i++] = 0x02;
+ serverHello[i++] = 0x00; serverHello[i++] = 0x04; serverHello[i++] = 0xb7;
+ /* legacy_version */
+ serverHello[i++] = 0x03; serverHello[i++] = 0x03;
+ /* random (32 bytes) */
+ XMEMSET(&serverHello[i], 0x42, 32); i += 32;
+ /* legacy_session_id_echo length: 0 */
+ serverHello[i++] = 0x00;
+ /* cipher_suite: TLS_AES_128_GCM_SHA256 */
+ serverHello[i++] = 0x13; serverHello[i++] = 0x01;
+ /* legacy_compression_method: null */
+ serverHello[i++] = 0x00;
+ /* extensions length: 1167 (0x048f) */
+ serverHello[i++] = 0x04; serverHello[i++] = 0x8f;
+ /* extension: supported_versions -> TLS 1.3 */
+ serverHello[i++] = 0x00; serverHello[i++] = 0x2b;
+ serverHello[i++] = 0x00; serverHello[i++] = 0x02;
+ serverHello[i++] = 0x03; serverHello[i++] = 0x04;
+ /* extension: key_share, extension_data length 1157 (0x0485) */
+ serverHello[i++] = 0x00; serverHello[i++] = 0x33;
+ serverHello[i++] = 0x04; serverHello[i++] = 0x85;
+ /* server_share.group: SECP256R1MLKEM768 (0x11eb) */
+ serverHello[i++] = 0x11; serverHello[i++] = 0xeb;
+ /* key_exchange length: 1153 (0x0481) */
+ serverHello[i++] = 0x04; serverHello[i++] = 0x81;
+ /* ECDH portion (65 bytes): leading 0x05 is not a valid X9.63 marker
+ * (valid markers: 0x04, 0x06, 0x07). The remaining 64 bytes stay zero
+ * from the initial XMEMSET. */
+ serverHello[i++] = 0x05;
+ i += 64;
+ /* PQC portion (1088 bytes): all zero from the initial XMEMSET. */
+ i += 1088;
+ AssertIntEQ((int)i, (int)sizeof(serverHello));
+
+ ExpectNotNull(ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
+ wolfSSL_SetIORecv(ctx, PqcHybridUafRecv);
+ wolfSSL_SetIOSend(ctx, PqcHybridUafSend);
+
+ ExpectNotNull(ssl = wolfSSL_new(ctx));
+
+ /* Match the server's offered group so this key_share is processed. */
+ ExpectIntEQ(wolfSSL_UseKeyShare(ssl, WOLFSSL_SECP256R1MLKEM768),
+ WOLFSSL_SUCCESS);
+
+ msg.buffer = serverHello;
+ msg.length = (unsigned int)sizeof(serverHello);
+ wolfSSL_SetIOReadCtx(ssl, &msg);
+
+ /* Connect should fail gracefully on the malformed ECDH point. */
+ ExpectIntEQ(wolfSSL_connect_TLSv13(ssl),
+ WC_NO_ERR_TRACE(WOLFSSL_FATAL_ERROR));
+
+ /* Without the fix, this triggers UAF + double-free in
+ * TLSX_KeyShare_FreeAll. */
+ wolfSSL_free(ssl);
+ wolfSSL_CTX_free(ctx);
+#endif
+ return EXPECT_RESULT();
+}
+
/* Test that a TLS 1.3 NewSessionTicket with a ticket shorter than ID_LEN
* (32 bytes) does not cause an unsigned integer underflow / OOB read in
* SetTicket. Uses a full memio handshake, then injects a crafted
diff --git a/tests/api/test_tls13.h b/tests/api/test_tls13.h
index c8eaa3b7f..94232f18e 100644
--- a/tests/api/test_tls13.h
+++ b/tests/api/test_tls13.h
@@ -43,6 +43,7 @@ int test_tls13_warning_alert_is_fatal(void);
int test_tls13_cert_req_sigalgs(void);
int test_tls13_derive_keys_no_key(void);
int test_tls13_pqc_hybrid_truncated_keyshare(void);
+int test_tls13_pqc_hybrid_malformed_ecdh(void);
int test_tls13_short_session_ticket(void);
#define TEST_TLS13_DECLS \
@@ -65,6 +66,7 @@ int test_tls13_short_session_ticket(void);
TEST_DECL_GROUP("tls13", test_tls13_cert_req_sigalgs), \
TEST_DECL_GROUP("tls13", test_tls13_derive_keys_no_key), \
TEST_DECL_GROUP("tls13", test_tls13_pqc_hybrid_truncated_keyshare), \
+ TEST_DECL_GROUP("tls13", test_tls13_pqc_hybrid_malformed_ecdh), \
TEST_DECL_GROUP("tls13", test_tls13_short_session_ticket)
#endif /* WOLFCRYPT_TEST_TLS13_H */
meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb
+1
View File
@@ -36,6 +36,7 @@ SRC_URI = " \
file://CVE-2026-6450-2.patch \
file://CVE-2026-6731-1.patch \
file://CVE-2026-6731-2.patch \
file://CVE-2026-7531.patch \
"
SRCREV = "1d363f3adceba9d1478230ede476a37b0dcdef24"