mirrors/poky
1
0 Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-10-22 19:18:18 +00:00
Code Issues Projects Releases Wiki Activity

libpcap: Fix CVE-2026-0799

Browse Source 
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-0799
Upstream-commit: https://github.com/the-tcpdump-group/libpcap/commit/48e8960a7108e9e828f9d7bdc7e97bdab841aec7

(From OE-Core rev: 2f99d027a326fcef62013c3d8bd2464e67809af7)

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Jaipaul Cheernam authored and Paul Barker committed 2026-10-19 09:03:19 +01:00
1 parent 34a351a67e
commit 8833cfcc6e
2 files changed
+68
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta/recipes-connectivity/libpcap/libpcap/01-CVE-2026-0799.patch
+67
View File
@@ -0,0 +1,67 @@
From 48e8960a7108e9e828f9d7bdc7e97bdab841aec7 Mon Sep 17 00:00:00 2001
From: Denis Ovsienko <denis@ovsienko.info>
Date: Thu, 30 Jul 2026 13:33:41 +0100
Subject: [PATCH] CVE-2026-0799: Access M[] safely in the BPF interpreter.
Include Security identified and reported this problem as a potential
vulnerability in 2018 (case reference "I7"). Their work was sponsored
by Mozilla under the Secure Open Source program. The vulnerability has
been independently confirmed only recently.
The current revision of pcapint_filter_with_aux_data() can, but does not
check whether a scratch memory register index is valid in the "ld M[k]",
"ldx M[k]", "st M[k]" and "stx M[k]" BPF instructions, and assumes this
is always the case. This holds for programs that have been generated or
validated by libpcap.
However, this does not necessarily hold for programs that come via
pcap_offline_filter() or [deprecated] bpf_filter() from an external
source and have not been explicitly validated. If the interpreter
executes such a program with an invalid index, it will read/write the
process memory at arbitrary locations starting at the current stack
frame. Depending on the address, the memory layout and the OS, this can
result in stack buffer overflow, SIGSEGV, SIGBUS or other effects. To
fix this, in the interpreter reject the packet if the index is invalid.
(backported from commit 569f8fd3524192acbabf93c9cd704471bb38f84a)
(cherry picked from commit 48e8960a7108e9e828f9d7bdc7e97bdab841aec7)
Notes on backporting to 1.10.4:
- The upstream CHANGES/changelog hunk is not backported.
Upstream-Status: Backport [https://github.com/the-tcpdump-group/libpcap/commit/48e8960a7108e9e828f9d7bdc7e97bdab841aec7]
CVE: CVE-2026-0799
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
diff --git a/bpf_filter.c b/bpf_filter.c
index 8691d0d1..fa82d1d0 100644
--- a/bpf_filter.c
+++ b/bpf_filter.c
@@ -219,18 +219,26 @@ DIAG_ON_DEFAULT_ONLY_SWITCH
continue;
case BPF_LD|BPF_MEM:
+ if (pc->k >= BPF_MEMWORDS)
+ return 0;
A = mem[pc->k];
continue;
case BPF_LDX|BPF_MEM:
+ if (pc->k >= BPF_MEMWORDS)
+ return 0;
X = mem[pc->k];
continue;
case BPF_ST:
+ if (pc->k >= BPF_MEMWORDS)
+ return 0;
mem[pc->k] = A;
continue;
case BPF_STX:
+ if (pc->k >= BPF_MEMWORDS)
+ return 0;
mem[pc->k] = X;
continue;
meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb
+1
View File
@@ -17,6 +17,7 @@ SRC_URI = "https://www.tcpdump.org/release/${BP}.tar.gz \
file://CVE-2025-11961-01.patch \
file://CVE-2025-11961-02.patch \
file://CVE-2025-11964.patch \
file://01-CVE-2026-0799.patch \
"
SRC_URI[sha256sum] = "ed19a0383fad72e3ad435fd239d7cd80d64916b87269550159d20e47160ebe5f"