mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-06-13 17:39:57 +00:00
Code Issues Projects Releases Wiki Activity

strongswan: Security fix for CVE-2025-62291

Browse Source 
CVE fixed:
- CVE-2025-62291 strongswan: Arbitrary Code Execution and Denial of Service via crafted EAP-MSCHAPv2 message
Upstream-Status: Backport from https://download.strongswan.org/security/CVE-2025-62291/strongswan-4.4.0-6.0.2_eap_mschapv2_failure_request_len.patch

Signed-off-by: Rohini Sangam <rsangam@mvista.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
This commit is contained in:
Rohini Sangam
2026-02-11 20:05:53 +05:30
committed by Gyorgy Sarvari
parent 518ff6ef48
commit f8c8241198
2 changed files with 50 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-networking/recipes-support/strongswan/files/CVE-2025-62291.patch
+49
View File
@@ -0,0 +1,49 @@
From dda24815d148b91209ebf2d27e3a7acefe9b6435 Mon Sep 17 00:00:00 2001
From: Tobias Brunner <tobias@strongswan.org>
Date: Thu, 9 Oct 2025 11:33:45 +0200
Subject: [PATCH] eap-mschapv2: Fix length check for Failure Request packets on
the client
For message lengths between 6 and 8, subtracting HEADER_LEN (9) causes
`message_len` to become negative, which is then used in calls to malloc()
and memcpy() that both take size_t arguments, causing an integer
underflow.
For 6 and 7, the huge size requested from malloc() will fail (it exceeds
PTRDIFF_MAX) and the returned NULL pointer will cause a segmentation
fault in memcpy().
However, for 8, the allocation is 0, which succeeds. But then the -1
passed to memcpy() causes a heap-based buffer overflow (and possibly a
segmentation fault when attempting to read/write that much data).
Fortunately, if compiled with -D_FORTIFY_SOURCE=3 (the default on e.g.
Ubuntu), the compiler will use __memcpy_chk(), which prevents that buffer
overflow and causes the daemon to get aborted immediately instead.
Fixes: f98cdf7a4765 ("adding plugin for EAP-MS-CHAPv2")
Fixes: CVE-2025-62291
Upstream-Status: Backport [https://download.strongswan.org/security/CVE-2025-62291/strongswan-4.4.0-6.0.2_eap_mschapv2_failure_request_len.patch]
CVE: CVE-2025-62291
Signed-off-by: Rohini Sangam <rsangam@mvista.com>
---
src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c b/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c
index 1bb54c8..9ad509a 100644
--- a/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c
+++ b/src/libcharon/plugins/eap_mschapv2/eap_mschapv2.c
@@ -974,7 +974,7 @@ static status_t process_peer_failure(private_eap_mschapv2_t *this,
data = in->get_data(in);
eap = (eap_mschapv2_header_t*)data.ptr;
- if (data.len < 3) /* we want at least an error code: E=e */
+ if (data.len < HEADER_LEN + 3) /* we want at least an error code: E=e */
{
DBG1(DBG_IKE, "received invalid EAP-MS-CHAPv2 message: too short");
return FAILED;
--
2.35.7
meta-networking/recipes-support/strongswan/strongswan_5.9.13.bb
+1
View File
@@ -9,6 +9,7 @@ DEPENDS = "flex-native flex bison-native"
DEPENDS:append = "${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', ' tpm2-tss', '', d)}"
SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \
file://CVE-2025-62291.patch \
"
SRC_URI[sha256sum] = "56e30effb578fd9426d8457e3b76c8c3728cd8a5589594b55649b2719308ba55"