From 91858e7ff91f43d2e27ecdadebaadf228ddec8c7 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Mon, 27 Apr 2026 01:03:50 +1200 Subject: [PATCH] opensc: patch CVE-2025-66038 Details: https://nvd.nist.gov/vuln/detail/CVE-2025-66038 Backport the patch referenced by the wiki[1] mentioned in the nvd. [1] https://github.com/OpenSC/OpenSC/wiki/CVE-2025-66038 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../opensc/files/CVE-2025-66038.patch | 41 +++++++++++++++++++ .../recipes-support/opensc/opensc_0.25.1.bb | 1 + 2 files changed, 42 insertions(+) create mode 100644 meta-oe/recipes-support/opensc/files/CVE-2025-66038.patch diff --git a/meta-oe/recipes-support/opensc/files/CVE-2025-66038.patch b/meta-oe/recipes-support/opensc/files/CVE-2025-66038.patch new file mode 100644 index 0000000000..e5a27deae5 --- /dev/null +++ b/meta-oe/recipes-support/opensc/files/CVE-2025-66038.patch @@ -0,0 +1,41 @@ +From 2f5582340ac3fd2062d0f6561a13aa9b269062dd Mon Sep 17 00:00:00 2001 +From: Jakub Jelen +Date: Tue, 18 Nov 2025 14:13:59 +0100 +Subject: [PATCH] compacttlv: Fix possible buffer overrun + +Fixes: GHSA-72x5-fwjx-2459 + +Signed-off-by: Jakub Jelen +(cherry picked from commit a20b91adc2fc66785c0df98abc8ef456c0eaab9d) + +CVE: CVE-2025-66038 +Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/a20b91adc2fc66785c0df98abc8ef456c0eaab9d] +Signed-off-by: Ankur Tyagi +--- + src/libopensc/sc.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/src/libopensc/sc.c b/src/libopensc/sc.c +index 7c9e0d25e..eb88b9abe 100644 +--- a/src/libopensc/sc.c ++++ b/src/libopensc/sc.c +@@ -1082,13 +1082,15 @@ const u8 *sc_compacttlv_find_tag(const u8 *buf, size_t len, u8 tag, size_t *outl + size_t expected_len = tag & 0x0F; + + for (idx = 0; idx < len; idx++) { +- if ((buf[idx] & 0xF0) == plain_tag && idx + expected_len < len && +- (expected_len == 0 || expected_len == (buf[idx] & 0x0F))) { ++ u8 ctag = buf[idx] & 0xF0; ++ size_t ctag_len = buf[idx] & 0x0F; ++ if (ctag == plain_tag && idx + ctag_len < len && ++ (expected_len == 0 || expected_len == ctag_len)) { + if (outlen != NULL) +- *outlen = buf[idx] & 0x0F; ++ *outlen = ctag_len; + return buf + (idx + 1); + } +- idx += (buf[idx] & 0x0F); ++ idx += ctag_len; + } + } + return NULL; diff --git a/meta-oe/recipes-support/opensc/opensc_0.25.1.bb b/meta-oe/recipes-support/opensc/opensc_0.25.1.bb index 999ae34b12..6772fe02f7 100644 --- a/meta-oe/recipes-support/opensc/opensc_0.25.1.bb +++ b/meta-oe/recipes-support/opensc/opensc_0.25.1.bb @@ -19,6 +19,7 @@ SRC_URI = "git://github.com/OpenSC/OpenSC;branch=stable-0.25;protocol=https \ file://CVE-2024-8443-0002.patch \ file://CVE-2025-49010.patch \ file://CVE-2025-66037.patch \ + file://CVE-2025-66038.patch \ " DEPENDS = "virtual/libiconv openssl"