* [PATCH 1/2] libwebsockets: update to version 4.3.10
2026-09-23 12:52 [PATCH 0/2] libwebsockets: update to 4.3.10 and fix CVE-2026-19773 Benjamin Robin (Schneider Electric)
@ 2026-09-23 12:52 ` Benjamin Robin (Schneider Electric)
2026-09-23 12:52 ` [PATCH 2/2] libwebsockets: fix CVE-2026-19773 Benjamin Robin (Schneider Electric)
2026-09-23 13:27 ` [PATCH 0/2] libwebsockets: update to 4.3.10 and " Benjamin Robin
2 siblings, 0 replies; 4+ messages in thread
From: Benjamin Robin (Schneider Electric) @ 2026-09-23 12:52 UTC (permalink / raw)
To: openembedded-devel
Cc: olivier.benjamin, mathieu.dubois-briand, pascal.eberhard,
wahid.essid, Benjamin Robin (Schneider Electric)
This version already include the fixes for CVE-2025-11677 and for
CVE-2025-11678. The LICENSE was slightly changed to clarify the license
summary.
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
---
.../libwebsockets/CVE-2025-11677.patch | 161 ---------------------
.../libwebsockets/CVE-2025-11678.patch | 128 ----------------
...websockets_4.3.3.bb => libwebsockets_4.3.10.bb} | 6 +-
3 files changed, 2 insertions(+), 293 deletions(-)
diff --git a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2025-11677.patch b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2025-11677.patch
deleted file mode 100644
index bf11a893f875..000000000000
--- a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2025-11677.patch
+++ /dev/null
@@ -1,161 +0,0 @@
-From c01cb06d99c08579ab33bef066fca8a5338b7c7b Mon Sep 17 00:00:00 2001
-From: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
-Date: Tue, 18 Nov 2025 16:59:22 +0100
-Subject: [PATCH] NN-2025-0102: UAF depending on upgrade allowed
-
-This document contains sensitive information collected during our
-security research activities related with the Libwebsockets library
-maintained by Andy Green (warmcat).
-
-+-------------------------------------------------------------------------------------------------------+
-| Report information |
-+:===================================:+:===============================================================:+
-| Vendor | warmcat |
-+-------------------------------------+-----------------------------------------------------------------+
-| Vendor URL | https://libwebsockets.org/git/libwebsockets |
-+-------------------------------------+-----------------------------------------------------------------+
-| Affected component | libwebsockets |
-+-------------------------------------+-----------------------------------------------------------------+
-| Affected version | 4.4 |
-+-------------------------------------+-----------------------------------------------------------------+
-| Vulnerability | CWE-416: Use After Free |
-+-------------------------------------+-----------------------------------------------------------------+
-| Proposed CVSS v3.1 Base Score | 6.0 |
-+-------------------------------------+-----------------------------------------------------------------+
-| Proposed CVSS v3.1 Vector | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
-+-------------------------------------+-----------------------------------------------------------------+
-
-+-----------------------------------------------------------------------------+
-| Security Researcher(s) |
-+:===================================:+:=====================================:+
-| Name | **Email address** |
-+-------------------------------------+---------------------------------------+
-| Raffaele Bova | labs-advisory@nozominetworks.com |
-+-------------------------------------+---------------------------------------+
-
-Libwebsockes is a C library that provides client and server
-implementation for various protocols (e.g., HTTP, websockets, MQTT) and
-more.
-
-Nozomi Networks Lab discovered a "CWE-416: Use After Free" in the latest
-software version of libwebsockets, specifically in the WebSocket server
-implementation.
-
-Depending on the use of the API, the vulnerability may allow an attacker
-to read or write data, that could cause a loss of integrity or
-availability.
-
-The issue is caused by the `lws_handshake_protocol` function, specifically
-when the upgrade header is not valid, the function calls
-`lws_http_transaction_completed`, which frees some of the data in the wsi
-structure, then it calls `user_callback_handle_rxflow` passing the up
-pointer and uses it on following strcasecmp calls.
-
-From our understanding, for this vulnerability to have a meaningful
-impact, a user that implements the Websocket server, must provide a user
-callback function which is going to handle
-`LWS_CALLBACK_HTTP_CONFIRM_UPGRADE`, while ignoring the length and doing
-operations on the up pointer.
-
-It is possible to compile the minimal websocket server using address
-sanitizer, to quickly verify the use after free.
-
-From our understanding of the code, if the upgrade header does not match
-the intended contents, then the code after the if statement when
-`lws_http_transaction_completed` is called, should not be executed, thus
-simply enclosing all that code in the else branch solves the issue.
-
-CVE: CVE-2025-11677
-Upstream-Status: Backport [https://github.com/warmcat/libwebsockets/commit/2f082ec31261f556969160143ba94875d783971a]
-
-Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
----
- lib/roles/http/server/server.c | 58 +++++++++++++++++-----------------
- 1 file changed, 29 insertions(+), 29 deletions(-)
-
-diff --git a/lib/roles/http/server/server.c b/lib/roles/http/server/server.c
-index 6b132a42..e6d714e3 100644
---- a/lib/roles/http/server/server.c
-+++ b/lib/roles/http/server/server.c
-@@ -2375,49 +2375,49 @@ raw_transition:
- HTTP_STATUS_FORBIDDEN, NULL) ||
- lws_http_transaction_completed(wsi))
- goto bail_nuke_ah;
-- }
--
-- n = user_callback_handle_rxflow(wsi->a.protocol->callback,
-- wsi, LWS_CALLBACK_HTTP_CONFIRM_UPGRADE,
-- wsi->user_space, (char *)up, 0);
-+ } else {
-+ n = user_callback_handle_rxflow(wsi->a.protocol->callback,
-+ wsi, LWS_CALLBACK_HTTP_CONFIRM_UPGRADE,
-+ wsi->user_space, (char *)up, 0);
-
-- /* just hang up? */
-+ /* just hang up? */
-
-- if (n < 0)
-- goto bail_nuke_ah;
-+ if (n < 0)
-+ goto bail_nuke_ah;
-
-- /* callback returned headers already, do t_c? */
-+ /* callback returned headers already, do t_c? */
-
-- if (n > 0) {
-- if (lws_http_transaction_completed(wsi))
-+ if (n > 0) {
-+ if (lws_http_transaction_completed(wsi))
- goto bail_nuke_ah;
-
-- /* continue on */
-+ /* continue on */
-
-- return 0;
-- }
-+ return 0;
-+ }
-
-- /* callback said 0, it was allowed */
-+ /* callback said 0, it was allowed */
-
-- if (wsi->a.vhost->options &
-- LWS_SERVER_OPTION_VHOST_UPG_STRICT_HOST_CHECK &&
-- lws_confirm_host_header(wsi))
-- goto bail_nuke_ah;
-+ if (wsi->a.vhost->options &
-+ LWS_SERVER_OPTION_VHOST_UPG_STRICT_HOST_CHECK &&
-+ lws_confirm_host_header(wsi))
-+ goto bail_nuke_ah;
-
-- if (!strcasecmp(up, "websocket")) {
-+ if (!strcasecmp(up, "websocket")) {
- #if defined(LWS_ROLE_WS)
-- lws_metrics_tag_wsi_add(wsi, "upg", "ws");
-- lwsl_info("Upgrade to ws\n");
-- goto upgrade_ws;
-+ lws_metrics_tag_wsi_add(wsi, "upg", "ws");
-+ lwsl_info("Upgrade to ws\n");
-+ goto upgrade_ws;
- #endif
-- }
-+ }
- #if defined(LWS_WITH_HTTP2)
-- if (!strcasecmp(up, "h2c")) {
-- lws_metrics_tag_wsi_add(wsi, "upg", "h2c");
-- lwsl_info("Upgrade to h2c\n");
-- goto upgrade_h2c;
-- }
-+ if (!strcasecmp(up, "h2c")) {
-+ lws_metrics_tag_wsi_add(wsi, "upg", "h2c");
-+ lwsl_info("Upgrade to h2c\n");
-+ goto upgrade_h2c;
-+ }
- #endif
-+ }
- }
-
- /* no upgrade ack... he remained as HTTP */
---
-2.43.0
-
diff --git a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2025-11678.patch b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2025-11678.patch
deleted file mode 100644
index 3489a7e6a13d..000000000000
--- a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2025-11678.patch
+++ /dev/null
@@ -1,128 +0,0 @@
-From e1d4c32bf773b8cf01eb5e368a4a21679e0b670a Mon Sep 17 00:00:00 2001
-From: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
-Date: Tue, 18 Nov 2025 17:03:33 +0100
-Subject: [PATCH] NN-2025-0103: ADNS crafted response overflow
-
-This document contains sensitive information collected during our
-security research activities related with the Libwebsockets library made
-by Andy Green (warmcat).
-
-+-------------------------------------------------------------------------------------------------------+
-| Report information |
-+:===================================:+:===============================================================:+
-| Vendor | warmcat |
-+-------------------------------------+-----------------------------------------------------------------+
-| Vendor URL | https://libwebsockets.org/git/libwebsockets |
-+-------------------------------------+-----------------------------------------------------------------+
-| Affected component | Ecostruxure Automation Expert |
-+-------------------------------------+-----------------------------------------------------------------+
-| Affected version | 4.4 |
-+-------------------------------------+-----------------------------------------------------------------+
-| Vulnerability | CWE-121: Stack-based Buffer Overflow |
-+-------------------------------------+-----------------------------------------------------------------+
-| Proposed CVSS v3.1 Base Score | 7.5 |
-+-------------------------------------+-----------------------------------------------------------------+
-| Proposed CVSS v3.1 Vector | CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
-+-------------------------------------+-----------------------------------------------------------------+
-
-+-----------------------------------------------------------------------------+
-| Security Researcher(s) |
-+:===================================:+:=====================================:+
-| Name | **Email address** |
-+-------------------------------------+---------------------------------------+
-| Raffaele Bova | labs-advisory@nozominetworks.com |
-+-------------------------------------+---------------------------------------+
-
-**\**
-
-Libwebsockes is a C library that provides client and server
-implementation for various protocols (e.g., HTTP, websockets, MQTT) and
-more.
-
-Nozomi Networks Lab discovered a "CWE-121: Stack-based Buffer Overflow"
-in the latest software version of libwebsockets, specifically in the
-async-dns component.
-
-The vulnerability allows an attacker that can inspect DNS requests made
-by the victim (e.g. being in the same wireless network) to forge a DNS
-response packet that overflows the stack and may lead to arbitrary code
-execution (depending on the platform and compiler options).
-
-The issue resides in `lws_adns_parse_label` function in
-`lib/system/async-dns/async-dns-parse.c`; this function iteratively parses
-a label however it does not correctly check the number of bytes written
-in the destination buffer.
-
-Specifically, the size of the dest output buffer is specified in the `dl`
-argument, however during the read of each substring of the label only
-the length of the current substring of the label is accounted for not
-overflowing the destination buffer, but previous reads are not accounted
-for.
-
-This means that a label of arbitrary size and content can be supplied
-and is copied onto the stack, however it must be split into substrings
-of size less than `dl`.
-
-To trigger the vulnerability an attacker must be able to sniff the DNS
-request packet to send a response with a matching identifier, otherwise
-the implantation correctly ignores the response.
-
-We have provided a harness for testing, for ease of use copy the harness
-in a subdirectory, for example in minimal-examples-lowlevel/api-tests/,
-and build it
-
-```
-cmake -B build -DLWS_WITH_SYS_ASYNC_DNS=1 -DLWS_WITH_SSL=0
--DCMAKE_C_FLAGS="-fsanitize=address" . && make -C build lws-test-async-dns
-```
-
-Then it can be run `./build/bin/lws-test-async-dns < poc_stackbof`
-
-
-
-We suggest keeping track of the number of bytes currently written on the
-dest buffer, this could be done by saving the original dest pointer,
-decrementing dl on each substring memcpy, or using an auxiliary
-variable.
-
-CVE: CVE-2025-11678
-Upstream-Status: Backport [https://github.com/warmcat/libwebsockets/commit/2bb9598562b37c942ba5b04bcde3f7fdf66a9d3a]
-
-Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
----
- lib/system/async-dns/async-dns-parse.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/lib/system/async-dns/async-dns-parse.c b/lib/system/async-dns/async-dns-parse.c
-index bdfe2050..81743b3f 100644
---- a/lib/system/async-dns/async-dns-parse.c
-+++ b/lib/system/async-dns/async-dns-parse.c
-@@ -35,7 +35,7 @@ lws_adns_parse_label(const uint8_t *pkt, int len, const uint8_t *ls, int budget,
- const uint8_t *e = pkt + len, *ols = ls;
- char pointer = 0, first = 1;
- uint8_t ll;
-- int n;
-+ int n, readsize = 0;
-
- if (budget < 1)
- return 0;
-@@ -88,7 +88,7 @@ again1:
- return -1;
- }
-
-- if ((unsigned int)ll + 2 > dl) {
-+ if ((unsigned int)(ll + 2 + readsize) > dl) {
- lwsl_notice("%s: qname too large\n", __func__);
-
- return -1;
-@@ -101,6 +101,7 @@ again1:
- (*dest)[ll + 1] = '\0';
- *dest += ll + 1;
- ls += ll;
-+ readsize += ll + 1;
-
- if (pointer) {
- if (*ls)
---
-2.43.0
-
diff --git a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.3.3.bb b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.3.10.bb
similarity index 94%
rename from meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.3.3.bb
rename to meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.3.10.bb
index ed2ac9df4aa5..559253c9613b 100644
--- a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.3.3.bb
+++ b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.3.10.bb
@@ -1,16 +1,14 @@
SUMMARY = "Canonical libwebsockets.org websocket library"
HOMEPAGE = "https://libwebsockets.org/"
LICENSE = "MIT & Zlib & BSD-3-Clause & Apache-2.0"
-LIC_FILES_CHKSUM = "file://LICENSE;md5=382bfdf329e774859fd401eaf850d29b"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=f35efc0af624eea4864849b05ae9c7db"
DEPENDS = "zlib"
DEPENDS:append:class-native = " libcap-native"
S = "${WORKDIR}/git"
-SRCREV = "4415e84c095857629863804e941b9e1c2e9347ef"
+SRCREV = "2288cf200bc1c28680765bd4f07e437356106c2d"
SRC_URI = "git://github.com/warmcat/libwebsockets.git;protocol=https;branch=v4.3-stable \
- file://CVE-2025-11677.patch \
- file://CVE-2025-11678.patch \
file://CVE-2026-10650.patch \
"
--
2.55.0
^ permalink raw reply related [flat|nested] 4+ messages in thread