mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-08-31 02:23:22 +00:00
Code Issues Projects Releases Wiki Activity

gnutls: fix CVE-2026-42009

Browse Source 
This patch applies the upstream fix [1] and [2], as referenced in [3],
to address a DTLS packet reordering flaw where duplicate sequence numbers
could lead to unstable ordering or undefined behavior.

[1] https://gitlab.com/gnutls/gnutls/-/commit/f01e21441e29052a6f0963840794c41d3b3ee66d
[2] https://gitlab.com/gnutls/gnutls/-/commit/f341441fad91142897d83b44a175ffc8f925b76f
[3] https://security-tracker.debian.org/tracker/CVE-2026-42009

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-42009

(From OE-Core rev: 8f3c2010a6bb4b2e7f4508a3ea4c2717294d75a3)

Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Sudhir Dumbhare
2026-07-30 13:21:16 +01:00
committed by Paul Barker
parent ffc5320e51
commit 75764cf5d7
3 changed files with 115 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch
+66
View File
@@ -0,0 +1,66 @@
From e1f366666c12f431151a04ada9cf9a30d602751b Mon Sep 17 00:00:00 2001
From: Alexander Sosedkin <asosedkin@redhat.com>
Date: Tue, 21 Apr 2026 16:52:48 +0200
Subject: [PATCH] lib/buffers: ensure packets have differing sequence
numbers
There should normally be no packets with same sequence number and
differing handshake type, unless an adversary crafts them.
Discarding them allows to get rid of packets
with duplicate sequence ID in the buffer,
relieving us from the question of how to sort them later.
CVE: CVE-2026-42009
Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/f01e21441e29052a6f0963840794c41d3b3ee66d]
Backport Changes:
- Adjusted the upstream hunk to match the GnuTLS 3.8.4 code layout.
- The upstream commit uses the local recv_buf alias introduced later
in v3.8.13 by commit;
https://gitlab.com/gnutls/gnutls/-/commit/9deffca528c23bbb218f5ec3bd4bb1bf4cbd1fc0.
- GnuTLS 3.8.4 does not have that local recv_buf alias in
merge_handshake_packet(), so the backport replaces recv_buf[i] with the
existing session->internals.handshake_recv_buffer[i] access pattern.
Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
Fixes: #1848
Fixes: CVE-2026-42009
Fixes: GNUTLS-SA-2026-04-29-2
CVSS: 7.5 High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
(cherry picked from commit f01e21441e29052a6f0963840794c41d3b3ee66d)
Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
---
lib/buffers.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/lib/buffers.c b/lib/buffers.c
index 672380b054..e7f08b5625 100644
--- a/lib/buffers.c
+++ b/lib/buffers.c
@@ -968,8 +968,20 @@ static int merge_handshake_packet(gnutls_session_t session,
int ret;
for (i = 0; i < session->internals.handshake_recv_buffer_size; i++) {
- if (session->internals.handshake_recv_buffer[i].htype ==
- hsk->htype) {
+ if (session->internals.handshake_recv_buffer[i].sequence == hsk->sequence) {
+ if (session->internals.handshake_recv_buffer[i].htype != hsk->htype) {
+ _gnutls_audit_log(
+ session,
+ "Discarded unexpected handshake packet "
+ "with duplicate sequence %d, but "
+ "mismatched type %s (previously %s)\n",
+ hsk->sequence,
+ _gnutls_handshake2str(hsk->htype),
+ _gnutls_handshake2str(
+ session->internals.handshake_recv_buffer[i].htype));
+ _gnutls_handshake_buffer_clear(hsk);
+ return 0;
+ }
exists = 1;
pos = i;
break;
--
2.35.6
meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p2.patch
+47
View File
@@ -0,0 +1,47 @@
From 23fdcec4c6b5669296295ad3a9f87f6467eeb0f3 Mon Sep 17 00:00:00 2001
From: Joshua Rogers <joshua@joshua.hu>
Date: Tue, 21 Apr 2026 18:11:39 +0200
Subject: [PATCH] buffers: fix handshake_compare when sequence numbers
match
The comparator function used for ordering DTLS packets
by sequence numbers did not follow qsort comparator contracts
in case of packets with duplicate sequence numbers,
which could lead to unstable ordering or undefined behaviour.
Returning 0 in such cases makes the sorting stable.
CVE: CVE-2026-42009
Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/f341441fad91142897d83b44a175ffc8f925b76f]
Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
Fixes: #1848
Fixes: CVE-2026-42009
Fixes: GNUTLS-SA-2026-04-29-2
CVSS: 7.5 High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Signed-off-by: Joshua Rogers <joshua@joshua.hu>
(cherry picked from commit f341441fad91142897d83b44a175ffc8f925b76f)
Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
---
lib/buffers.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/lib/buffers.c b/lib/buffers.c
index e7f08b5625..1ac27e4e96 100644
--- a/lib/buffers.c
+++ b/lib/buffers.c
@@ -844,11 +844,7 @@ static int handshake_compare(const void *_e1, const void *_e2)
{
const handshake_buffer_st *e1 = _e1;
const handshake_buffer_st *e2 = _e2;
-
- if (e1->sequence <= e2->sequence)
- return 1;
- else
- return -1;
+ return (e1->sequence < e2->sequence) - (e1->sequence > e2->sequence);
}
#define SSL2_HEADERS 1
--
2.35.6
meta/recipes-support/gnutls/gnutls_3.8.4.bb
+2
View File
@@ -43,6 +43,8 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar
file://CVE-2025-14831-7.patch \
file://CVE-2025-14831-8.patch \
file://CVE-2025-14831-9.patch \
file://CVE-2026-42009_p1.patch \
file://CVE-2026-42009_p2.patch \
"
SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b"