diff --git a/meta-networking/recipes-extended/corosync/corosync/CVE-2026-35091.patch b/meta-networking/recipes-extended/corosync/corosync/CVE-2026-35091.patch deleted file mode 100644 index 8afa5d6841..0000000000 --- a/meta-networking/recipes-extended/corosync/corosync/CVE-2026-35091.patch +++ /dev/null @@ -1,47 +0,0 @@ -From b9cb461121c8721c94a94309eb345a3c2f9ee9b4 Mon Sep 17 00:00:00 2001 -From: Jan Friesse -Date: Thu, 2 Apr 2026 09:00:39 +0200 -Subject: [PATCH] totemsrp: Return error if sanity check fails -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Previously, the check_memb_commit_token_sanity function correctly -checked the minimum message length. However, if the message was too -short, it incorrectly returned a success code (0) instead of the -expected failure code (-1). - -This commit ensures the appropriate error code is returned when the -message length sanity check fails. - -Fixes: CVE-2026-35091 - -Reported-by: Sebastián Alba Vives (@Sebasteuo / 0xS4bb1) -Signed-off-by: Jan Friesse -Also-proposed-by: nicholasyang -Reviewed-by: Christine Caulfield - -CVE: CVE-2026-35091 -Upstream-Status: Backport [https://github.com/corosync/corosync/commit/a16614accfdb3481264d7281843fadf439d9ab1b] -Signed-off-by: Gyorgy Sarvari ---- - exec/totemsrp.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/exec/totemsrp.c b/exec/totemsrp.c -index 35bf971..94d6c21 100644 ---- a/exec/totemsrp.c -+++ b/exec/totemsrp.c -@@ -3811,10 +3811,10 @@ static int check_memb_commit_token_sanity( - log_printf (instance->totemsrp_log_level_security, - "Received memb_commit_token message is too short... ignoring."); - -- return (0); -+ return (-1); - } - -- addr_entries= mct_msg->addr_entries; -+ addr_entries = mct_msg->addr_entries; - if (endian_conversion_needed) { - addr_entries = swab32(addr_entries); - } diff --git a/meta-networking/recipes-extended/corosync/corosync/CVE-2026-35092.patch b/meta-networking/recipes-extended/corosync/corosync/CVE-2026-35092.patch deleted file mode 100644 index 8182647840..0000000000 --- a/meta-networking/recipes-extended/corosync/corosync/CVE-2026-35092.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 8f8a4747a0223b8897deda9a40a8a099c61fa80f Mon Sep 17 00:00:00 2001 -From: Jan Friesse -Date: Thu, 2 Apr 2026 09:44:06 +0200 -Subject: [PATCH] totemsrp: Fix integer overflow in memb_join_sanity -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This commit addresses an integer overflow (wraparound) vulnerability -in the check_memb_join_sanity function. - -Previously, the 32-bit unsigned network values proc_list_entries and -failed_list_entries were added together before being promoted to -size_t. This allowed the addition to wrap around in 32-bit arithmetic -(e.g., 0x80000000 + 0x80000000 = 0), resulting in a required_len -calculation that was incorrectly small. - -The solution is to cast the list entries to size_t and verify that -neither exceeds the maximum allowed value before the addition occurs. - -Fixes: CVE-2026-35092 - -Reported-by: Sebastián Alba Vives (@Sebasteuo / 0xS4bb1) -Signed-off-by: Jan Friesse -Also-proposed-by: nicholasyang -Reviewed-by: Christine Caulfield - -CVE: CVE-2026-35092 -Upstream-Status: Backport [https://github.com/corosync/corosync/commit/4082294f5094a7591e4e00658c5a605f05d644f1] -Signed-off-by: Gyorgy Sarvari ---- - exec/totemsrp.c | 12 +++++++++++- - 1 file changed, 11 insertions(+), 1 deletion(-) - -diff --git a/exec/totemsrp.c b/exec/totemsrp.c -index 94d6c21..6845cec 100644 ---- a/exec/totemsrp.c -+++ b/exec/totemsrp.c -@@ -3786,7 +3786,17 @@ static int check_memb_join_sanity( - failed_list_entries = swab32(failed_list_entries); - } - -- required_len = sizeof(struct memb_join) + ((proc_list_entries + failed_list_entries) * sizeof(struct srp_addr)); -+ if (proc_list_entries > PROCESSOR_COUNT_MAX || -+ failed_list_entries > PROCESSOR_COUNT_MAX) { -+ log_printf (instance->totemsrp_log_level_security, -+ "Received memb_join message list_entries exceeds the maximum " -+ "allowed value... ignoring."); -+ -+ return (-1); -+ } -+ -+ required_len = sizeof(struct memb_join) + -+ (((size_t)proc_list_entries + (size_t)failed_list_entries) * sizeof(struct srp_addr)); - if (msg_len < required_len) { - log_printf (instance->totemsrp_log_level_security, - "Received memb_join message is too short... ignoring."); diff --git a/meta-networking/recipes-extended/corosync/corosync_3.1.10.bb b/meta-networking/recipes-extended/corosync/corosync_3.2.0.bb similarity index 93% rename from meta-networking/recipes-extended/corosync/corosync_3.1.10.bb rename to meta-networking/recipes-extended/corosync/corosync_3.2.0.bb index 77dea16e98..d8e697ca4b 100644 --- a/meta-networking/recipes-extended/corosync/corosync_3.1.10.bb +++ b/meta-networking/recipes-extended/corosync/corosync_3.2.0.bb @@ -9,10 +9,8 @@ inherit autotools pkgconfig systemd github-releases SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/${BP}.tar.gz \ file://corosync.conf \ - file://CVE-2026-35091.patch \ - file://CVE-2026-35092.patch \ " -SRC_URI[sha256sum] = "be361c827f99b215b3bd3fa2fb071c03dac6831c2a351963d938caef62604bc8" +SRC_URI[sha256sum] = "be92a882ec738b17528777d344f54c6784245fb7b9dec20fcd9022adaac12bfe" UPSTREAM_CHECK_GITTAGREGEX = "v(?P\d+(\.\d+)+)" LICENSE = "BSD-3-Clause"