From 933d86804a2d7bb7e6d7333634ea3d18ef20f889 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Wed, 9 Sep 2026 20:31:38 +1200 Subject: [PATCH] freerdp3: patch CVE-2026-67288 Backport commit matching GitHub advisory[1] also identified by Debian[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-67288 [1]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3 [2]https://security-tracker.debian.org/tracker/CVE-2026-67288 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../freerdp/freerdp3/CVE-2026-67288.patch | 69 +++++++++++++++++++ .../freerdp/freerdp3_3.24.2.bb | 1 + 2 files changed, 70 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-67288.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-67288.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-67288.patch new file mode 100644 index 0000000000..9be89cf276 --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-67288.patch @@ -0,0 +1,69 @@ +From 833cb82a82ff59d916c86ae1ac90b84bf8e86c47 Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Thu, 9 Jul 2026 08:34:21 +0200 +Subject: [PATCH] [scard] handle nullptr for LookupName + +(cherry picked from commit efe40e15d508f9754b7a3af851de4d2a0b1128d8) + +CVE: CVE-2026-67288 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/efe40e15d508f9754b7a3af851de4d2a0b1128d8] + +Signed-off-by: Ankur Tyagi +--- + libfreerdp/emu/scard/smartcard_emulate.c | 7 ++++--- + winpr/libwinpr/smartcard/smartcard_pcsc.c | 9 +++++---- + 2 files changed, 9 insertions(+), 7 deletions(-) + +diff --git a/libfreerdp/emu/scard/smartcard_emulate.c b/libfreerdp/emu/scard/smartcard_emulate.c +index 0be4c4c5d..25e0ee179 100644 +--- a/libfreerdp/emu/scard/smartcard_emulate.c ++++ b/libfreerdp/emu/scard/smartcard_emulate.c +@@ -46,8 +46,8 @@ static size_t g_ReaderNameWLen = 0; + + static char* card_id_and_name_a(const UUID* CardIdentifier, LPCSTR LookupName) + { +- WINPR_ASSERT(CardIdentifier); +- WINPR_ASSERT(LookupName); ++ if (!CardIdentifier || !LookupName) ++ return nullptr; + + size_t len = strlen(LookupName) + 34; + char* id = malloc(len); +@@ -2264,7 +2264,8 @@ LONG WINAPI Emulate_SCardReadCacheA(SmartcardEmulationContext* smartcard, SCARDC + WINPR_ASSERT(value); /* Must be valid after Emulate_SCardIsValidContext */ + + char* id = card_id_and_name_a(CardIdentifier, LookupName); +- data = HashTable_GetItemValue(value->cache, id); ++ if (id) ++ data = HashTable_GetItemValue(value->cache, id); + free(id); + + if (!data) +diff --git a/winpr/libwinpr/smartcard/smartcard_pcsc.c b/winpr/libwinpr/smartcard/smartcard_pcsc.c +index b5cf85e23..58bea94f1 100644 +--- a/winpr/libwinpr/smartcard/smartcard_pcsc.c ++++ b/winpr/libwinpr/smartcard/smartcard_pcsc.c +@@ -2951,8 +2951,8 @@ WINPR_ATTR_NODISCARD static LONG WINAPI PCSC_SCardDlgExtendedError(void) + WINPR_ATTR_NODISCARD + static char* card_id_and_name_a(const UUID* CardIdentifier, LPCSTR LookupName) + { +- WINPR_ASSERT(CardIdentifier); +- WINPR_ASSERT(LookupName); ++ if (!CardIdentifier || !LookupName) ++ return nullptr; + + size_t len = strlen(LookupName) + 34; + char* id = malloc(len); +@@ -2991,9 +2991,10 @@ WINPR_ATTR_NODISCARD static LONG WINAPI PCSC_SCardReadCacheA(SCARDCONTEXT hConte + return SCARD_E_INVALID_HANDLE; + + char* id = card_id_and_name_a(CardIdentifier, LookupName); +- +- data = HashTable_GetItemValue(ctx->cache, id); ++ if (id) ++ data = HashTable_GetItemValue(ctx->cache, id); + free(id); ++ + if (!data) + { + *DataLen = 0; diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb index 7051cbeacc..edd2fddf94 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb @@ -24,6 +24,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${ file://CVE-2026-64620.patch \ file://CVE-2026-64621.patch \ file://CVE-2026-66401.patch \ + file://CVE-2026-67288.patch \ "