mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-06-13 17:39:57 +00:00
Code Issues Projects Releases Wiki Activity

opensc: patch CVE-2025-66038

Browse Source 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-66038

Backport the patch that is referenced by the upstream wiki
page[1] that is related to this vulnerability.

[1]: https://github.com/OpenSC/OpenSC/wiki/CVE-2025-66038

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Gyorgy Sarvari
2026-04-07 11:52:45 +02:00
committed by Anuj Mittal
parent 73034a4fe1
commit 873ae07e82
2 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/opensc/opensc/CVE-2025-66038.patch
+40
View File
@@ -0,0 +1,40 @@
From 3d746f77cc886042776a78158c503f0f61421008 Mon Sep 17 00:00:00 2001
From: Jakub Jelen <jjelen@redhat.com>
Date: Tue, 18 Nov 2025 14:13:59 +0100
Subject: [PATCH] compacttlv: Fix possible buffer overrun
Fixes: GHSA-72x5-fwjx-2459
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
CVE: CVE-2025-66038
Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/a20b91adc2fc66785c0df98abc8ef456c0eaab9d]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
src/libopensc/sc.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/src/libopensc/sc.c b/src/libopensc/sc.c
index c6c51fe1b..253bc173d 100644
--- a/src/libopensc/sc.c
+++ b/src/libopensc/sc.c
@@ -1064,13 +1064,15 @@ const u8 *sc_compacttlv_find_tag(const u8 *buf, size_t len, u8 tag, size_t *outl
size_t expected_len = tag & 0x0F;
for (idx = 0; idx < len; idx++) {
- if ((buf[idx] & 0xF0) == plain_tag && idx + expected_len < len &&
- (expected_len == 0 || expected_len == (buf[idx] & 0x0F))) {
+ u8 ctag = buf[idx] & 0xF0;
+ size_t ctag_len = buf[idx] & 0x0F;
+ if (ctag == plain_tag && idx + ctag_len < len &&
+ (expected_len == 0 || expected_len == ctag_len)) {
if (outlen != NULL)
- *outlen = buf[idx] & 0x0F;
+ *outlen = ctag_len;
return buf + (idx + 1);
}
- idx += (buf[idx] & 0x0F);
+ idx += ctag_len;
}
}
return NULL;
meta-oe/recipes-support/opensc/opensc_0.26.1.bb
+1
View File
@@ -15,6 +15,7 @@ SRCREV = "043343d2df7b09d1938bc3dc313d86a96be457cc"
SRC_URI = "git://github.com/OpenSC/OpenSC;branch=0.26.1;protocol=https \
file://CVE-2025-49010.patch \
file://CVE-2025-66037.patch \
file://CVE-2025-66038.patch \
"
CVE_STATUS[CVE-2024-8443] = "fixed-version: this is fixed since 0.26.0"