helium-3rd-party/meta-openembedded
1
0
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2026-04-02 02:49:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

libsodium: patch CVE-2025-69277

Browse Source 
Pick patch per [1].

[1] https://nvd.nist.gov/vuln/detail/CVE-2025-69277

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Peter Marko 2026-01-10 20:59:25 +01:00 committed by Anuj Mittal
parent e434c0b06a
commit 0bca0e04c8
No known key found for this signature in database
GPG Key ID: 4340AEFE69F5085C
2 changed files with 64 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
meta-oe/recipes-crypto/libsodium/libsodium/CVE-2025-69277.patch Normal file
View File

@ -0,0 +1,61 @@
From ad3004ec8731730e93fcfbbc824e67eadc1c1bae Mon Sep 17 00:00:00 2001
From: Frank Denis <github@pureftpd.org>
Date: Mon, 29 Dec 2025 23:22:15 +0100
Subject: [PATCH] core_ed25519_is_valid_point: check Y==Z in addition to X==0
CVE: CVE-2025-69277
Upstream-Status: Backport [https://github.com/jedisct1/libsodium/commit/ad3004ec8731730e93fcfbbc824e67eadc1c1bae]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c | 5 ++++-
test/default/core_ed25519.c | 7 ++++++-
2 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c b/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c
index d3020132..4b824f6d 100644
--- a/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c
+++ b/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c
@@ -1029,10 +1029,13 @@ int
ge25519_is_on_main_subgroup(const ge25519_p3 *p)
{
ge25519_p3 pl;
+ fe25519 t;
ge25519_mul_l(&pl, p);
- return fe25519_iszero(pl.X);
+ fe25519_sub(t, pl.Y, pl.Z);
+
+ return fe25519_iszero(pl.X) & fe25519_iszero(t);
}
int
diff --git a/test/default/core_ed25519.c b/test/default/core_ed25519.c
index bc457493..02f72bd6 100644
--- a/test/default/core_ed25519.c
+++ b/test/default/core_ed25519.c
@@ -13,6 +13,10 @@ static const unsigned char max_canonical_p[32] = {
0xe4, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f
};
+static const unsigned char not_main_subgroup_p[32] = {
+ 0x95, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99,
+ 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99
+};
static const unsigned char L_p1[32] = {
0xee, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10
@@ -142,11 +146,12 @@ main(void)
assert(crypto_core_ed25519_is_valid_point(p) == 0);
p[0] = 9;
- assert(crypto_core_ed25519_is_valid_point(p) == 1);
+ assert(crypto_core_ed25519_is_valid_point(p) == 0);
assert(crypto_core_ed25519_is_valid_point(max_canonical_p) == 1);
assert(crypto_core_ed25519_is_valid_point(non_canonical_invalid_p) == 0);
assert(crypto_core_ed25519_is_valid_point(non_canonical_p) == 0);
+ assert(crypto_core_ed25519_is_valid_point(not_main_subgroup_p) == 0);
memcpy(p2, p, crypto_core_ed25519_BYTES);
add_P(p2);

4
meta-oe/recipes-crypto/libsodium/libsodium_1.0.19.bb
View File

@ -5,7 +5,9 @@ LICENSE = "ISC"
LIC_FILES_CHKSUM = "file://LICENSE;md5=49ce3b426e6a002e23a1387248e6dbe9"
SRC_URI = "https://download.libsodium.org/libsodium/releases/${BPN}-${PV}.tar.gz \
file://0001-fix-aarch64-Move-target-pragma-after-arm_neon.h-incl.patch"
file://0001-fix-aarch64-Move-target-pragma-after-arm_neon.h-incl.patch \
file://CVE-2025-69277.patch \
"
SRC_URI[sha256sum] = "018d79fe0a045cca07331d37bd0cb57b2e838c51bc48fd837a1472e50068bbea"
inherit autotools