mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-20 19:58:34 +00:00
Code Issues Projects Releases Wiki Activity

opensc: patch CVE-2026-103531

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-103531

(cherry picked from commit 27b41701a04a46e498f7f3f6212ac2a5e2bc8d1a)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi authored and Khem Raj committed 2026-10-19 15:08:26 -07:00
1 parent 98e04f2bb7
commit e255a6d9ae
2 files changed
+55
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-oe/recipes-support/opensc/opensc/CVE-2026-103531.patch
+54
View File
@@ -0,0 +1,54 @@
From 4b0f46d922866d9453e3631ff5e0a24900fae8dd Mon Sep 17 00:00:00 2001
From: wanglanlan <wanglanlan@users.noreply.github.com>
Date: Wed, 2 Sep 2026 08:36:47 +0000
Subject: [PATCH] setcos: Fix buffer overflow in setcos_construct_fci_44
The FCI construction copied type_attr, sec_attr and prop_attr of the
file into a fixed 64-byte stack buffer without checking the length.
Malicious or corrupted attribute lengths (e.g. prop_attr_len > 64,
reachable through fuzz_pkcs15init and attacker-controlled card
responses) caused a stack buffer overflow (write).
Return SC_ERROR_INVALID_DATA if any attribute exceeds the buffer size.
Found with the fuzz_pkcs15init fuzzer.
Co-Authored-By: Claude <noreply@anthropic.com>
(cherry picked from commit ad730304052937c32b4eb489a06835ac6123632c)
CVE: CVE-2026-103531
Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/ad730304052937c32b4eb489a06835ac6123632c]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
src/libopensc/card-setcos.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/libopensc/card-setcos.c b/src/libopensc/card-setcos.c
index 0ebe7c34f..8c7baa3e4 100644
--- a/src/libopensc/card-setcos.c
+++ b/src/libopensc/card-setcos.c
@@ -218,6 +218,8 @@ static int setcos_construct_fci_44(sc_card_t *card, const sc_file_t *file, u8 *o
/* Type */
if (file->type_attr_len) {
+ if (file->type_attr_len > sizeof(buf))
+ LOG_FUNC_RETURN(card->ctx, SC_ERROR_INVALID_DATA);
memcpy(buf, file->type_attr, file->type_attr_len);
sc_asn1_put_tag(0x82, buf, file->type_attr_len, p, *outlen - (p - out), &p);
} else {
@@ -271,11 +273,15 @@ static int setcos_construct_fci_44(sc_card_t *card, const sc_file_t *file, u8 *o
}
/* Security Attributes */
+ if (file->sec_attr_len > sizeof(buf))
+ LOG_FUNC_RETURN(card->ctx, SC_ERROR_INVALID_DATA);
memcpy(buf, file->sec_attr, file->sec_attr_len);
sc_asn1_put_tag(0x86, buf, file->sec_attr_len, p, *outlen - (p - out), &p);
/* Life cycle status */
if (file->prop_attr_len) {
+ if (file->prop_attr_len > sizeof(buf))
+ LOG_FUNC_RETURN(card->ctx, SC_ERROR_INVALID_DATA);
memcpy(buf, file->prop_attr, file->prop_attr_len);
sc_asn1_put_tag(0x8A, buf, file->prop_attr_len, p, *outlen - (p - out), &p);
}
meta-oe/recipes-support/opensc/opensc_0.27.1.bb
+1
View File
@@ -14,6 +14,7 @@ DEPENDS = "openssl"
SRCREV = "19868984dc4dc697af6a86d65ab32a1f19a43ea4"
SRC_URI = "git://github.com/OpenSC/OpenSC;branch=master;protocol=https \
file://0001-Changes-for-OpenSSL-4.0.0.patch \
file://CVE-2026-103531.patch \
"
CVE_STATUS[CVE-2024-8443] = "fixed-version: this is fixed since 0.26.0"