mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-08-30 00:33:19 +00:00
Code Issues Projects Releases Wiki Activity

openvpn: fix CVE-2026-13117

Browse Source 
An Incomplete guard in OpenVPN allows remote authenticated
peers to trigger a use-after-free during TLS session promotion,
potentially leading to a denial of service or memory leakage

Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2026-13117]
[https://security-tracker.debian.org/tracker/CVE-2026-13117]

Upstream patch:
[https://github.com/OpenVPN/openvpn/commit/3ce0242e68527fd1e8d378aecb57c466e8058b44]

Signed-off-by: Omkar Patil <OmkarAbaji.Patil@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Omkar Patil
2026-08-14 14:31:01 +05:30
committed by Anuj Mittal
parent df411c8098
commit b3470f0633
2 changed files with 47 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-networking/recipes-support/openvpn/openvpn/CVE-2026-13117.patch
+46
View File
@@ -0,0 +1,46 @@
From 3ce0242e68527fd1e8d378aecb57c466e8058b44 Mon Sep 17 00:00:00 2001
From: Max Fillinger <maximilian.fillinger@sentyron.com>
Date: Fri, 22 May 2026 14:34:57 +0200
Subject: [PATCH] Fix tls_wrap_reneg use after free
When dynamic tls-crypt is active, it is possible for tls_multi_process
to set to_link to session->tls_wrap_reneg.work and later free that
session, leaving to_link.data pointing to freed memory.
This is not caught by the function check_session_buf_not_used because it
checks only tls_wrap, not tls_wrap_reneg. This commit adds that check.
CVE: 2026-13117
Github: OpenVPN/openvpn-private-issues#119
Github: OpenVPN/openvpn-private-issues#125
Reported-By: Trace37 Labs (https://github.com/trace37labs)
Github: OpenVPN/openvpn-private-issues#131
Reported-By: Haiyang Huang <huanghaiyang83@gmail.com>
Signed-off-by: Max Fillinger <maximilian.fillinger@sentyron.com>
Acked-By: Arne Schwabe <arne@rfc2549.org>
(cherry picked from commit 2745768d6181c1d54ebfc5ef81f924a127f4f015)
CVE: CVE-2026-13117
Upstream-Status: Backport [https://github.com/OpenVPN/openvpn/commit/3ce0242e68527fd1e8d378aecb57c466e8058b44]
Signed-off-by: Omkar Patil <OmkarAbaji.Patil@windriver.com>
---
src/openvpn/ssl.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index c0ab6d3dfbe..d7e93bd41ab 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -3154,6 +3154,12 @@ check_session_buf_not_used(struct buffer *to_link, struct tls_session *session)
"still in use (tls_wrap.work.data)");
goto used;
}
+ if (session->tls_wrap_reneg.work.data == dataptr)
+ {
+ msg(M_INFO, "Warning buffer of freed TLS session is "
+ "still in use (tls_wrap_reneg.work.data)");
+ goto used;
+ }
for (int i = 0; i < KS_SIZE; i++)
{
meta-networking/recipes-support/openvpn/openvpn_2.7.0.bb
+1
View File
@@ -13,6 +13,7 @@ SRC_URI = "http://swupdate.openvpn.org/community/releases/${BP}.tar.gz \
file://openvpn \
file://run-ptest \
file://CVE-2026-40215.patch \
file://CVE-2026-13117.patch \
"
UPSTREAM_CHECK_URI = "https://openvpn.net/community-downloads"