[oe][meta-networking][wrynose][PATCH 33/33] wolfssl: patch CVE-2026-7531

[ankur.tyagi85@gmail.com]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-7531

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../wolfssl/files/CVE-2026-7531.patch         | 180 ++++++++++++++++++
 .../wolfssl/wolfssl_5.9.1.bb                  |   1 +
 2 files changed, 181 insertions(+)
 create mode 100644 meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-7531.patch

diff --git a/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-7531.patch b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-7531.patch
new file mode 100644
index 0000000000..1d4e7605b3
--- /dev/null
+++ b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-7531.patch
@@ -0,0 +1,180 @@
+From 5ab994ddce690cc904554ff03af263ef0624d29d Mon Sep 17 00:00:00 2001
+From: David Garske <david@wolfssl.com>
+Date: Tue, 5 May 2026 11:41:43 -0700
+Subject: [PATCH] Merge pull request #10327 from embhorn/zd21704
+
+Hardening in TLSX_KeyShare_ProcessPqcHybridClient
+
+CVE: CVE-2026-7531
+Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/3b7ac9fd256b26c33b66f9315c319465ba3bcfeb]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/tls.c              | 19 +++++---
+ tests/api/test_tls13.c | 98 ++++++++++++++++++++++++++++++++++++++++++
+ tests/api/test_tls13.h |  2 +
+ 3 files changed, 114 insertions(+), 5 deletions(-)
+
+diff --git a/src/tls.c b/src/tls.c
+index 18aad71d3..e5b989482 100644
+--- a/src/tls.c
++++ b/src/tls.c
+@@ -10187,15 +10187,24 @@ static int TLSX_KeyShare_ProcessPqcHybridClient(WOLFSSL* ssl,
+             ecc_kse->key = NULL;
+             pqc_kse->privKey = NULL;
+         }
++        else
+     #endif
++        {
++            /* Re-sync keyShareEntry->key with ecc_kse->key. ecc_kse->key was
++             * aliased to keyShareEntry->key above. The inner Process*_ex
++             * either ran its end-of-function cleanup and set ecc_kse->key
++             * to NULL (so the outer pointer must also become NULL to avoid
++             * UAF/double-free in TLSX_KeyShare_FreeAll), or returned early
++             * before cleanup with ecc_kse->key still pointing at the live
++             * key (so the outer pointer must keep that pointer for later
++             * freeing). Mirroring whatever the inner left in ecc_kse->key
++             * handles both cases correctly. */
++            keyShareEntry->key = ecc_kse->key;
++        }
+     }
+ 
+     if (ret == 0) {
+-        keyShareEntry->key = ecc_kse->key;
+-        ecc_kse->key = NULL;
+-
+-        if ((ret == 0) &&
+-            ((ssl->arrays->preMasterSz + ssSzPqc) > ENCRYPT_LEN)) {
++        if ((ssl->arrays->preMasterSz + ssSzPqc) > ENCRYPT_LEN) {
+             WOLFSSL_MSG("shared secret is too long.");
+             ret = LENGTH_ERROR;
+         }
+diff --git a/tests/api/test_tls13.c b/tests/api/test_tls13.c
+index 63ddffb7a..af050a234 100644
+--- a/tests/api/test_tls13.c
++++ b/tests/api/test_tls13.c
+@@ -3581,6 +3581,104 @@ int test_tls13_pqc_hybrid_truncated_keyshare(void)
+     return EXPECT_RESULT();
+ }
+ 
++/* Test that a malformed ECDH portion in a correctly-sized PQC hybrid
++ * KeyShare does not leave a dangling pointer in keyShareEntry->key.
++ *
++ * The earlier truncated-keyshare test is rejected by the keLen <= ctSz
++ * check before TLSX_KeyShare_ProcessPqcHybridClient sets up the
++ * ecc_kse->key = keyShareEntry->key alias, so it does not exercise the
++ * dangling-pointer path. This test sends a SECP256R1MLKEM768 key_share
++ * whose total length is correct (65-byte ECDH point + 1088-byte ML-KEM
++ * ciphertext = 1153 bytes) but whose ECDH leading byte (0x05) is not a
++ * valid X9.63 marker. ProcessEcc_ex then fails at wc_ecc_import_x963
++ * AFTER its unconditional cleanup at the end of the function frees the
++ * aliased key. Without the fix, the outer keyShareEntry->key still
++ * holds the freed pointer; wolfSSL_free -> TLSX_KeyShare_FreeAll calls
++ * wc_ecc_free + XFREE on it, producing a use-after-free and a double
++ * free that ASAN flags. */
++int test_tls13_pqc_hybrid_malformed_ecdh(void)
++{
++    EXPECT_DECLS;
++#if defined(WOLFSSL_TLS13) && !defined(NO_WOLFSSL_CLIENT) && \
++    defined(WOLFSSL_HAVE_MLKEM) && defined(WOLFSSL_PQC_HYBRIDS) && \
++    !defined(WOLFSSL_NO_ML_KEM_768) && defined(HAVE_ECC) && \
++    !defined(WOLFSSL_MLKEM_NO_DECAPSULATE) && \
++    !defined(WOLFSSL_MLKEM_NO_MAKE_KEY) && \
++    (!defined(NO_ECC256) || defined(HAVE_ALL_CURVES)) && \
++    !defined(NO_ECC_SECP)
++    WOLFSSL_CTX *ctx = NULL;
++    WOLFSSL *ssl = NULL;
++    /* 5 (record) + 4 (HS) + 1207 (ServerHello body) = 1216 bytes. */
++    static byte serverHello[1216];
++    word32 i = 0;
++    WOLFSSL_BUFFER_INFO msg;
++
++    XMEMSET(serverHello, 0, sizeof(serverHello));
++
++    /* Record: handshake, TLS 1.2 compat, length 1211 (0x04bb). */
++    serverHello[i++] = 0x16; serverHello[i++] = 0x03; serverHello[i++] = 0x03;
++    serverHello[i++] = 0x04; serverHello[i++] = 0xbb;
++    /* Handshake: ServerHello (0x02), length 1207 (0x0004b7). */
++    serverHello[i++] = 0x02;
++    serverHello[i++] = 0x00; serverHello[i++] = 0x04; serverHello[i++] = 0xb7;
++    /* legacy_version */
++    serverHello[i++] = 0x03; serverHello[i++] = 0x03;
++    /* random (32 bytes) */
++    XMEMSET(&serverHello[i], 0x42, 32); i += 32;
++    /* legacy_session_id_echo length: 0 */
++    serverHello[i++] = 0x00;
++    /* cipher_suite: TLS_AES_128_GCM_SHA256 */
++    serverHello[i++] = 0x13; serverHello[i++] = 0x01;
++    /* legacy_compression_method: null */
++    serverHello[i++] = 0x00;
++    /* extensions length: 1167 (0x048f) */
++    serverHello[i++] = 0x04; serverHello[i++] = 0x8f;
++    /* extension: supported_versions -> TLS 1.3 */
++    serverHello[i++] = 0x00; serverHello[i++] = 0x2b;
++    serverHello[i++] = 0x00; serverHello[i++] = 0x02;
++    serverHello[i++] = 0x03; serverHello[i++] = 0x04;
++    /* extension: key_share, extension_data length 1157 (0x0485) */
++    serverHello[i++] = 0x00; serverHello[i++] = 0x33;
++    serverHello[i++] = 0x04; serverHello[i++] = 0x85;
++    /* server_share.group: SECP256R1MLKEM768 (0x11eb) */
++    serverHello[i++] = 0x11; serverHello[i++] = 0xeb;
++    /* key_exchange length: 1153 (0x0481) */
++    serverHello[i++] = 0x04; serverHello[i++] = 0x81;
++    /* ECDH portion (65 bytes): leading 0x05 is not a valid X9.63 marker
++     * (valid markers: 0x04, 0x06, 0x07). The remaining 64 bytes stay zero
++     * from the initial XMEMSET. */
++    serverHello[i++] = 0x05;
++    i += 64;
++    /* PQC portion (1088 bytes): all zero from the initial XMEMSET. */
++    i += 1088;
++    AssertIntEQ((int)i, (int)sizeof(serverHello));
++
++    ExpectNotNull(ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
++    wolfSSL_SetIORecv(ctx, PqcHybridUafRecv);
++    wolfSSL_SetIOSend(ctx, PqcHybridUafSend);
++
++    ExpectNotNull(ssl = wolfSSL_new(ctx));
++
++    /* Match the server's offered group so this key_share is processed. */
++    ExpectIntEQ(wolfSSL_UseKeyShare(ssl, WOLFSSL_SECP256R1MLKEM768),
++        WOLFSSL_SUCCESS);
++
++    msg.buffer = serverHello;
++    msg.length = (unsigned int)sizeof(serverHello);
++    wolfSSL_SetIOReadCtx(ssl, &msg);
++
++    /* Connect should fail gracefully on the malformed ECDH point. */
++    ExpectIntEQ(wolfSSL_connect_TLSv13(ssl),
++        WC_NO_ERR_TRACE(WOLFSSL_FATAL_ERROR));
++
++    /* Without the fix, this triggers UAF + double-free in
++     * TLSX_KeyShare_FreeAll. */
++    wolfSSL_free(ssl);
++    wolfSSL_CTX_free(ctx);
++#endif
++    return EXPECT_RESULT();
++}
++
+ /* Test that a TLS 1.3 NewSessionTicket with a ticket shorter than ID_LEN
+  * (32 bytes) does not cause an unsigned integer underflow / OOB read in
+  * SetTicket. Uses a full memio handshake, then injects a crafted
+diff --git a/tests/api/test_tls13.h b/tests/api/test_tls13.h
+index c8eaa3b7f..94232f18e 100644
+--- a/tests/api/test_tls13.h
++++ b/tests/api/test_tls13.h
+@@ -43,6 +43,7 @@ int test_tls13_warning_alert_is_fatal(void);
+ int test_tls13_cert_req_sigalgs(void);
+ int test_tls13_derive_keys_no_key(void);
+ int test_tls13_pqc_hybrid_truncated_keyshare(void);
++int test_tls13_pqc_hybrid_malformed_ecdh(void);
+ int test_tls13_short_session_ticket(void);
+ 
+ #define TEST_TLS13_DECLS                                        \
+@@ -65,6 +66,7 @@ int test_tls13_short_session_ticket(void);
+     TEST_DECL_GROUP("tls13", test_tls13_cert_req_sigalgs),       \
+     TEST_DECL_GROUP("tls13", test_tls13_derive_keys_no_key),    \
+     TEST_DECL_GROUP("tls13", test_tls13_pqc_hybrid_truncated_keyshare), \
++    TEST_DECL_GROUP("tls13", test_tls13_pqc_hybrid_malformed_ecdh), \
+     TEST_DECL_GROUP("tls13", test_tls13_short_session_ticket)
+ 
+ #endif /* WOLFCRYPT_TEST_TLS13_H */
diff --git a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb
index ef03d0c9ff..644c5379f5 100644
--- a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb
+++ b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb
@@ -36,6 +36,7 @@ SRC_URI = " \
     file://CVE-2026-6450-2.patch \
     file://CVE-2026-6731-1.patch \
     file://CVE-2026-6731-2.patch \
+    file://CVE-2026-7531.patch \
 "
 
 SRCREV = "1d363f3adceba9d1478230ede476a37b0dcdef24"