mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-24 23:50:17 +00:00
Code Issues Projects Releases Wiki Activity

opensc: fix for CVE-2026-40528

Browse Source 
Pick patch from [1] also mentioned at NVD report in [2]

[1] https://github.com/OpenSC/OpenSC/commit/0358817ec74aeca654f83e7709c7720b14c5db59
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-40528

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Hitendra Prajapati
2026-09-01 10:17:58 +05:30
committed by Anuj Mittal
parent b8bd073f05
commit 8a6e67f063
2 changed files with 45 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/opensc/files/CVE-2026-40528.patch
+44
View File
@@ -0,0 +1,44 @@
From 0358817ec74aeca654f83e7709c7720b14c5db59 Mon Sep 17 00:00:00 2001
From: Jakub Jelen <jjelen@redhat.com>
Date: Tue, 3 Mar 2026 15:04:33 +0100
Subject: [PATCH] profile: Avoid possible buffer overrun
Profile file of the following format will cause buffer overrun
when parsed during the pkcs15-init invocation:
```
cardinfo {
key CHV1 {
value = "=XXXX..."; // 200+ X characters
}
}
```
This will cause both stack and heap buffer overrun.
Thanks Nicholas Carlini from Anthropic for the report.
CVE: CVE-2026-40528
Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/0358817ec74aeca654f83e7709c7720b14c5db59]
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
---
src/pkcs15init/profile.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/pkcs15init/profile.c b/src/pkcs15init/profile.c
index a6b2103f8..58416b7e1 100644
--- a/src/pkcs15init/profile.c
+++ b/src/pkcs15init/profile.c
@@ -987,6 +987,10 @@ do_key_value(struct state *cur, int argc, char **argv)
if (key[0] == '=') {
++key;
key_len = strlen(key);
+ if (key_len > sizeof(keybuf)) {
+ parse_error(cur, "Key value too long (%zu > %zu)\n", key_len, sizeof(keybuf));
+ return 1;
+ }
memcpy(keybuf, key, key_len);
} else {
key_len = sizeof(keybuf);
--
2.50.1
meta-oe/recipes-support/opensc/opensc_0.25.1.bb
+1
View File
@@ -24,6 +24,7 @@ SRC_URI = "git://github.com/OpenSC/OpenSC;branch=stable-0.25;protocol=https \
file://CVE-2025-66215-2.patch \
file://CVE-2025-66215-3.patch \
file://CVE-2025-66215-4.patch \
file://CVE-2026-40528.patch \
"
DEPENDS = "virtual/libiconv openssl"