mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-07 16:59:22 +00:00
Code Issues Projects Releases Wiki Activity

gnupg: fix CVE-2026-24882

Browse Source 
Backport patch to fix CVE-2026-24882 per reference [1] [2].

[1] https://security-tracker.debian.org/tracker/CVE-2026-24882
[2] https://dev.gnupg.org/T8045

(From OE-Core rev: 0adf2e2d511f0d6bf9d70c88cbdda6a6ba7be45e)

Signed-off-by: Guocai He <guocai.he.cn@windriver.com>
Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Guocai He
2026-04-09 14:16:34 +08:00
committed by Paul Barker
parent c18ab4d895
commit 168a602377
3 changed files with 119 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-support/gnupg/gnupg/CVE-2026-24882-0001.patch
+70
View File
@@ -0,0 +1,70 @@
From d07e2f19134129d59014fe181642cd122dc2e29f Mon Sep 17 00:00:00 2001
From: Werner Koch <wk@gnupg.org>
Date: Mon, 26 Jan 2026 11:13:44 +0100
Subject: [PATCH 1/2] tpm: Fix possible buffer overflow in PKDECRYPT
* tpm2d/tpm2.c (tpm2_ecc_decrypt): Bail out on too long CIPHERTEXT.
(tpm2_rsa_decrypt): Ditto.
--
Cherry pick master commit of:
93fa34d9a346020355cd51d54102d30d4f177323
GnuPG-bug-id: 8045
Co-authored-by: NIIBE Yutaka <gniibe@fsij.org>
Reported-by: OpenAI Security Research
CVE: CVE-2026-24882
Upstream-Status: Backport [https://github.com/gpg/gnupg/commit/01c130031]
Signed-off-by: Guocai He <guocai.he.cn@windriver.com>
---
tpm2d/tpm2.c | 22 +++++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
diff --git a/tpm2d/tpm2.c b/tpm2d/tpm2.c
index 3e908dd..cd0347c 100644
--- a/tpm2d/tpm2.c
+++ b/tpm2d/tpm2.c
@@ -917,10 +917,20 @@ tpm2_ecc_decrypt (ctrl_t ctrl, TSS_CONTEXT *tssc, TPM_HANDLE key,
size_t len;
int ret;
+#if defined(TPM2_MAX_ECC_KEY_BYTES) /* Intel stack */
+ if (ciphertext_len > 2*TPM2_MAX_ECC_KEY_BYTES + 1)
+ return GPG_ERR_TOO_LARGE;
+#elif defined(MAX_ECC_KEY_BYTES) /* IBM stack */
+ if (ciphertext_len > 2*MAX_ECC_KEY_BYTES + 1)
+ return GPG_ERR_TOO_LARGE;
+#else
+# error TMP2 header are not correctly installed
+#endif
+
/* This isn't really a decryption per se. The ciphertext actually
* contains an EC Point which we must multiply by the private key number.
*
- * The reason is to generate a diffe helman agreement on a shared
+ * The reason is to generate a diffie-hellman agreement on a shared
* point. This shared point is then used to generate the per
* session encryption key.
*/
@@ -976,6 +986,16 @@ tpm2_rsa_decrypt (ctrl_t ctrl, TSS_CONTEXT *tssc, TPM_HANDLE key,
TPM_HANDLE ah;
char *auth;
+#if defined(TPM2_MAX_RSA_KEY_BYTES) /* Intel stack */
+ if (ciphertext_len > TPM2_MAX_RSA_KEY_BYTES)
+ return GPG_ERR_TOO_LARGE;
+#elif defined(MAX_RSA_KEY_BYTES) /* IBM stack */
+ if (ciphertext_len > MAX_RSA_KEY_BYTES)
+ return GPG_ERR_TOO_LARGE;
+#else
+# error TMP2 header are not correctly installed
+#endif
+
inScheme.scheme = TPM_ALG_RSAES;
/*
* apparent gcrypt error: occasionally rsa ciphertext will
--
2.34.1
meta/recipes-support/gnupg/gnupg/CVE-2026-24882-0002.patch
+47
View File
@@ -0,0 +1,47 @@
From e8eaa9bf018d3276d613f371207c91c1ffa3e16c Mon Sep 17 00:00:00 2001
From: NIIBE Yutaka <gniibe@fsij.org>
Date: Thu, 12 Feb 2026 11:51:17 +0900
Subject: [PATCH 2/2] agent: Fix the regression in pkdecrypt with TPM RSA.
* agent/divert-tpm2.c (divert_tpm2_pkdecrypt): Care about additional
0x00.
--
Cherry pick master commit of:
6eed3959303c81c9699fe9273030e480732f72be
GnuPG-bug-id: 8045
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
CVE: CVE-2026-24882
Upstream-Status: Backport [https://github.com/gpg/gnupg/commit/555a9f5b3]
Signed-off-by: Guocai He <guocai.he.cn@windriver.com>
---
agent/divert-tpm2.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/agent/divert-tpm2.c b/agent/divert-tpm2.c
index 2496d09..5b5bd14 100644
--- a/agent/divert-tpm2.c
+++ b/agent/divert-tpm2.c
@@ -135,6 +135,15 @@ divert_tpm2_pkdecrypt (ctrl_t ctrl,
if (!smatch (&s, n, "a"))
return gpg_error (GPG_ERR_UNKNOWN_SEXP);
n = snext (&s);
+ /* NOTE: gpg-agent protocol uses signed integer for RSA (%m in
+ * MPI), where 0x00 is added when the MSB is 1. TPM2 uses
+ * unsigned integer. We need to remove this 0x00, or else
+ * it may result GPG_ERR_TOO_LARGE in tpm2daemon. */
+ if (!*s && (n&1))
+ {
+ s++;
+ n--;
+ }
}
else if (smatch (&s, n, "ecdh"))
{
--
2.34.1
meta/recipes-support/gnupg/gnupg_2.4.8.bb
+2
View File
@@ -19,6 +19,8 @@ SRC_URI = "${GNUPG_MIRROR}/${BPN}/${BPN}-${PV}.tar.bz2 \
file://0004-autogen.sh-fix-find-version-for-beta-checking.patch \
file://0001-Woverride-init-is-not-needed-with-gcc-9.patch \
file://CVE-2025-68973.patch \
file://CVE-2026-24882-0001.patch \
file://CVE-2026-24882-0002.patch \
"
SRC_URI:append:class-native = " file://0001-configure.ac-use-a-custom-value-for-the-location-of-.patch \
file://relocate.patch"