helium-3rd-party/poky
1
0
Fork 0
mirror of git://git.yoctoproject.org/poky synced 2026-04-02 02:49:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

gnutls: patch CVE-2025-32989

Browse Source 
Pick relevant commit from 3.8.10 release MR [1].

Binary test file was added as separate file as binary diffs are not
supported.

[1] https://gitlab.com/gnutls/gnutls/-/merge_requests/1979

(From OE-Core rev: 9d9ce14e2edceb211c3193cef88715d9c67fd3e0)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Peter Marko 2025-07-27 19:49:14 +02:00 committed by Steve Sakoman
parent 511d3e23f5
commit e9a35f720c
3 changed files with 56 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
meta/recipes-support/gnutls/gnutls/04939b75417cc95b7372c6f208c4bda4579bdc34 Normal file
View File

Binary file not shown.

50
meta/recipes-support/gnutls/gnutls/CVE-2025-32989.patch Normal file
View File

@ -0,0 +1,50 @@
From 8e5ca951257202089246fa37e93a99d210ee5ca2 Mon Sep 17 00:00:00 2001
From: Andrew Hamilton <adhamilt@gmail.com>
Date: Mon, 7 Jul 2025 10:23:59 +0900
Subject: [PATCH] x509: fix read buffer overrun in SCT timestamps
Prevent reading beyond heap buffer in call to _gnutls_parse_ct_sct
when processing x509 Signed Certificate Timestamps with certain
malformed data. Spotted by oss-fuzz at:
https://issues.oss-fuzz.com/issues/42530513
Signed-off-by: Andrew Hamilton <adhamilt@gmail.com>
Signed-off-by: Daiki Ueno <ueno@gnu.org>
CVE: CVE-2025-32989
Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/8e5ca951257202089246fa37e93a99d210ee5ca2]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
NEWS | 5 +++++
lib/x509/x509_ext.c | 2 +-
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/NEWS b/NEWS
index 85efb5680..025e05148 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,11 @@ Copyright (C) 2000-2016 Free Software Foundation, Inc.
Copyright (C) 2013-2019 Nikos Mavrogiannopoulos
See the end for copying conditions.
+** libgnutls: Fix heap read buffer overrun in parsing X.509 SCTS timestamps
+ Spotted by oss-fuzz and reported by OpenAI Security Research Team,
+ and fix developed by Andrew Hamilton. [GNUTLS-SA-2025-07-07-1,
+ CVSS: medium] [CVE-2025-32989]
+
* Version 3.8.4 (released 2024-03-18)
** libgnutls: RSA-OAEP encryption scheme is now supported
diff --git a/lib/x509/x509_ext.c b/lib/x509/x509_ext.c
index 064ca8357..05336a0c2 100644
--- a/lib/x509/x509_ext.c
+++ b/lib/x509/x509_ext.c
@@ -3757,7 +3757,7 @@ int gnutls_x509_ext_ct_import_scts(const gnutls_datum_t *ext,
}
length = _gnutls_read_uint16(scts_content.data);
- if (length < 4) {
+ if (length < 4 || length > scts_content.size) {
gnutls_free(scts_content.data);
return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
}

6
meta/recipes-support/gnutls/gnutls_3.8.4.bb
View File

@ -24,6 +24,8 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar
file://run-ptest \
file://Add-ptest-support.patch \
file://CVE-2024-12243.patch \
file://CVE-2025-32989.patch \
file://04939b75417cc95b7372c6f208c4bda4579bdc34 \
"
SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b"
@ -62,6 +64,10 @@ do_configure:prepend() {
for dir in . lib; do
rm -f ${dir}/aclocal.m4 ${dir}/m4/libtool.m4 ${dir}/m4/lt*.m4
done
# binary files cannot be delivered as diff
mkdir -p ${S}/fuzz/gnutls_x509_parser_fuzzer.repro/
cp ${WORKDIR}/04939b75417cc95b7372c6f208c4bda4579bdc34 ${S}/fuzz/gnutls_x509_parser_fuzzer.repro/
}
do_compile_ptest() {