From 99bc8bd93aa66f6dffd0720dcd18a28d110d8393 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Wed, 23 Sep 2026 22:40:26 +1200 Subject: [PATCH] freeipmi: patch CVE-2026-85505 Backport commit from v1.6.19 matching NVD description. Details: https://nvd.nist.gov/vuln/detail/cve-2026-85505 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../freeipmi/freeipmi/CVE-2026-85505.patch | 49 +++++++++++++++++++ .../freeipmi/freeipmi_1.6.17.bb | 1 + 2 files changed, 50 insertions(+) create mode 100644 meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85505.patch diff --git a/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85505.patch b/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85505.patch new file mode 100644 index 0000000000..e27b8a976d --- /dev/null +++ b/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-85505.patch @@ -0,0 +1,49 @@ +From e479401fcd9588f1ffb7444e09b97afc29f21f82 Mon Sep 17 00:00:00 2001 +From: Albert L Chu +Date: Mon, 17 Aug 2026 16:55:00 -0700 +Subject: [PATCH] ipmi-oem: clamp Fujitsu SEL long-text truncate copy to actual + data + +ipmi_oem_fujitsu_get_sel_entry_long_text, in the "truncate if there is +overflow" branch, copied a fixed +IPMI_OEM_FUJITSU_SEL_ENTRY_LONG_TEXT_MAX_DATA_LENGTH - offset bytes from +&bytes_rs[16] into data_buf regardless of how many bytes the BMC +actually returned. bytes_rs is filled only to rs_len and is not +memset, so a short response left the memcpy reading uninitialized stack +past the real data. The read stayed within the 256-byte bytes_rs and +the data_buf destination, so it was an uninitialized read, not an +out-of-bounds access. + +The truncate branch is entered only when offset + component_length +exceeds data_length, so data_length - offset is both the number of bytes +needed to fill data_buf to data_length and strictly less than +component_length (= strlen of the NUL-terminated response data), hence +always within the received bytes. Copy that amount instead of the fixed +maximum. + +Assisted-by: Claude (Opus 4.8) +(cherry picked from commit 8e0e908c5f11f3ccbf128e09af58568767e6367c) + +CVE: CVE-2026-85505 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/freeipmi.git/commit/?h=freeipmi-1-6-19&id=8e0e908c5f11f3ccbf128e09af58568767e6367c] + +Dropped changes to the ChangeLog file. + +Signed-off-by: Ankur Tyagi +--- + ipmi-oem/ipmi-oem-fujitsu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/ipmi-oem/ipmi-oem-fujitsu.c b/ipmi-oem/ipmi-oem-fujitsu.c +index 10220c9fc..57d04a0bf 100644 +--- a/ipmi-oem/ipmi-oem-fujitsu.c ++++ b/ipmi-oem/ipmi-oem-fujitsu.c +@@ -1400,7 +1400,7 @@ ipmi_oem_fujitsu_get_sel_entry_long_text (ipmi_oem_state_data_t *state_data) + { + memcpy (data_buf + offset, + &bytes_rs[16], +- IPMI_OEM_FUJITSU_SEL_ENTRY_LONG_TEXT_MAX_DATA_LENGTH - offset); ++ data_length - offset); + offset = data_length; + } + else diff --git a/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb b/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb index 8438a517ec..a3a5fb5af0 100644 --- a/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb +++ b/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb @@ -20,6 +20,7 @@ SRC_URI = "${GNU_MIRROR}/freeipmi/freeipmi-${PV}.tar.gz \ file://CVE-2026-85508.patch \ file://CVE-2026-85507.patch \ file://CVE-2026-85506.patch \ + file://CVE-2026-85505.patch \ " SRC_URI[sha256sum] = "16783d10faa28847a795cce0bf86deeaa72b8fbe71d1f0dc1101d13a6b501ec1"