mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-07-25 06:47:01 +00:00
Code Issues Projects Releases Wiki Activity

dhcpcd: patch CVE-2026-56113

Browse Source 
Backport patch [1] mentionned in [2]

[1] https://github.com/NetworkConfiguration/dhcpcd/commit/5733d3c59a5651f64357ac11c98b4f39895c8d25

[2] https://security-tracker.debian.org/tracker/CVE-2026-56113

(From OE-Core rev: fbfee67ed5d0c799bc1011f8463741c3b0910885)

Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Theo Gaige (Schneider Electric)
2026-07-01 17:04:31 +02:00
committed by Paul Barker
parent 37b718ecb9
commit c223541984
2 changed files with 93 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb
+1
View File
@@ -15,6 +15,7 @@ SRC_URI = "git://github.com/NetworkConfiguration/dhcpcd;protocol=https;branch=ma
file://dhcpcd.service \
file://dhcpcd@.service \
file://0001-dhcpcd.8-Fix-conflict-error-when-enable-multilib.patch \
file://CVE-2026-56113.patch \
"
SRCREV = "1c8ae59836fa87b4c63c598087f0460ec20ed862"
meta/recipes-connectivity/dhcpcd/files/CVE-2026-56113.patch
+92
View File
@@ -0,0 +1,92 @@
From 9f953ada0df6e7a568f006f3ae0ff10a77a95924 Mon Sep 17 00:00:00 2001
From: Roy Marples <roy@marples.name>
Date: Tue, 23 Jun 2026 02:17:10 +0100
Subject: [PATCH] DHCPv6: When deprecating addresses, restart on prefix
deletions
As that might invalidate the next address to iterate on.
Reported-by: CuB3y0nd <root@cubeyond.net>
(cherry picked from commit 5733d3c59a5651f64357ac11c98b4f39895c8d25)
CVE: CVE-2026-56113
Upstream-Status: Backport [https://github.com/NetworkConfiguration/dhcpcd/commit/5733d3c59a5651f64357ac11c98b4f39895c8d25]
Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com>
---
src/dhcp6.c | 21 ++++++++++++++++++---
1 file changed, 18 insertions(+), 3 deletions(-)
diff --git a/src/dhcp6.c b/src/dhcp6.c
index bdc3664e..5154bf41 100644
--- a/src/dhcp6.c
+++ b/src/dhcp6.c
@@ -2480,12 +2480,13 @@ dhcp6_findia(struct interface *ifp, struct dhcp6_message *m, size_t l,
}
#ifndef SMALL
-static void
+static bool
dhcp6_deprecatedele(struct ipv6_addr *ia)
{
struct ipv6_addr *da, *dan, *dda;
struct timespec now;
struct dhcp6_state *state;
+ bool freed = false;
timespecclear(&now);
TAILQ_FOREACH_SAFE(da, &ia->pd_pfxs, pd_next, dan) {
@@ -2511,11 +2512,14 @@ dhcp6_deprecatedele(struct ipv6_addr *ia)
if (IN6_ARE_ADDR_EQUAL(&dda->addr, &da->addr))
break;
}
- if (dda != NULL) {
+ if (dda != ia && dda != NULL) {
TAILQ_REMOVE(&state->addrs, dda, next);
ipv6_freeaddr(dda);
+ freed = true;
}
}
+
+ return freed;
}
#endif
@@ -2523,7 +2527,11 @@ static void
dhcp6_deprecateaddrs(struct ipv6_addrhead *addrs)
{
struct ipv6_addr *ia, *ian;
+#ifndef SMALL
+ bool again;
+#endif
+again:
TAILQ_FOREACH_SAFE(ia, addrs, next, ian) {
if (ia->flags & IPV6_AF_EXTENDED)
;
@@ -2545,7 +2553,9 @@ dhcp6_deprecateaddrs(struct ipv6_addrhead *addrs)
/* If we delegated from this prefix, deprecate or remove
* the delegations. */
if (ia->flags & IPV6_AF_DELEGATEDPFX)
- dhcp6_deprecatedele(ia);
+ again = dhcp6_deprecatedele(ia);
+ else
+ again = false;
#endif
if (ia->flags & IPV6_AF_REQUEST) {
@@ -2558,6 +2568,11 @@ dhcp6_deprecateaddrs(struct ipv6_addrhead *addrs)
if (ia->flags & IPV6_AF_EXTENDED)
ipv6_deleteaddr(ia);
ipv6_freeaddr(ia);
+#ifndef SMALL
+ /* Deletion may invalidate the next pointer so restart */
+ if (again)
+ goto again;
+#endif
}
}
--
2.43.0