Re: [wrynose][PATCH 1/5] gnutls: fix CVE-2026-42012

["Yoann Congal" <yoann.congal@smile.fr>]

Hello,

On Wed Sep 9, 2026 at 3:35 PM CEST, Jakub Szczudlo (Nokia) wrote:
> Backport patch to fix CVE-2026-42012.
>
> References:
>   https://nvd.nist.gov/vuln/detail/CVE-2026-42012
>
> Upstream fix:
>   https://gitlab.com/gnutls/gnutls/-/commit/8dcc6a1f48945997666ac9f10896819edd01a03b
    

>
> Tested with ptest
> Pre patches taken from upstream so CVE fix will land cleanly
>
> Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
> ---
>  .../gnutls/gnutls/CVE-2026-42012-pre1.patch   |  70 ++++++++
>  .../gnutls/gnutls/CVE-2026-42012-pre2.patch   | 153 ++++++++++++++++++
>  .../gnutls/gnutls/CVE-2026-42012.patch        |  48 ++++++
>  meta/recipes-support/gnutls/gnutls_3.8.12.bb  |   3 +
>  4 files changed, 274 insertions(+)
>  create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre1.patch
>  create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre2.patch
>  create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42012.patch
>
> diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre1.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre1.patch
> new file mode 100644
> index 0000000000..1149dafef2
> --- /dev/null
> +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre1.patch

Hello,

While this patch does apply, it has some surprizing format
(CVE-2026-42012.patch looks fine, though):

> @@ -0,0 +1,70 @@
> +Backport of:
> +
   ^ Why this "Backport of"?
> +From 6133fb459b74a9dcfa2d0ff010a4e03c56822d39 Mon Sep 17 00:00:00 2001
> +From: Alexander Sosedkin <asosedkin@redhat.com>
> +Date: Fri, 13 Mar 2026 17:00:03 +0100
> +Subject: [PATCH] x509/hostname-verify: refactor and simplify CN fallback logic
> +
> +Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
> +CVE: CVE-2026-42012
> +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/6133fb459b74a9dcfa2d0ff010a4e03c56822d39]
> +
> +Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
> +---
> + lib/x509/hostname-verify.c | 15 ++++++---------
> + 1 file changed, 6 insertions(+), 9 deletions(-)
> +

Very minor thing but here we usualy have a "diff ..." line

> +--- a/lib/x509/hostname-verify.c
> ++++ b/lib/x509/hostname-verify.c
> +@@ -108,7 +108,7 @@ unsigned gnutls_x509_crt_check_ip(gnutls
> +  * that we do not fallback to CN-ID if we encounter a supported name
> +  * type.
> +  */
> +-#define IS_SAN_SUPPORTED(san) \
> ++#define PRECLUDES_CN_FALLBACK(san) \
> + 	(san == GNUTLS_SAN_DNSNAME || san == GNUTLS_SAN_IPADDRESS)
> + 
> + /**
> +@@ -151,13 +151,12 @@ unsigned gnutls_x509_crt_check_hostname2
> + {
> + 	char dnsname[MAX_CN];
> + 	size_t dnsnamesize;
> +-	int found_dnsname = 0;
> + 	int ret = 0;
> + 	int i = 0;
> + 	struct in_addr ipv4;
> + 	char *p = NULL;
> + 	char *a_hostname;
> +-	unsigned have_other_addresses = 0;
> ++	bool cn_fallback_allowed = true;
> + 	gnutls_datum_t out;
> + 
> + 	/* check whether @hostname is an ip address */
> +@@ -213,9 +212,10 @@ hostname_fallback:
> + 		ret = gnutls_x509_crt_get_subject_alt_name(cert, i, dnsname,
> + 							   &dnsnamesize, NULL);
> + 
> +-		if (ret == GNUTLS_SAN_DNSNAME) {
> +-			found_dnsname = 1;
> ++		if (PRECLUDES_CN_FALLBACK(ret))
> ++			cn_fallback_allowed = false;
> + 
> ++		if (ret == GNUTLS_SAN_DNSNAME) {
> + 			if (memchr(dnsname, '\0', dnsnamesize)) {
> + 				_gnutls_debug_log(
> + 					"certificate has %s with embedded null in name\n",
> +@@ -236,13 +236,10 @@ hostname_fallback:
> + 				ret = 1;
> + 				goto cleanup;
> + 			}
> +-		} else {
> +-			if (IS_SAN_SUPPORTED(ret))
> +-				have_other_addresses = 1;
> + 		}
> + 	}
> + 
> +-	if (!have_other_addresses && !found_dnsname &&
> ++	if (cn_fallback_allowed &&
> + 	    _gnutls_check_key_purpose(cert, GNUTLS_KP_TLS_WWW_SERVER, 0) != 0) {
> + 		/* did not get the necessary extension, use CN instead, if the
> + 		 * certificate would have been acceptable for a TLS WWW server purpose.
> diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre2.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre2.patch
> new file mode 100644
> index 0000000000..c192a144c0
> --- /dev/null
> +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre2.patch
> @@ -0,0 +1,153 @@
> +Backport of:
> +
> +From 5cc003b9688378f6c7934b1df0aa147e80006be4 Mon Sep 17 00:00:00 2001
> +From: Alexander Sosedkin <asosedkin@redhat.com>
> +Date: Fri, 13 Mar 2026 17:41:33 +0100
> +Subject: [PATCH] x509: add bare-bones awareness of SRV virtual SAN
> +
> +There's no support for constraints, no certtool support, no nothing.
> +Just added what's easy to add because I needed a virtual SAN for them.
> +
> +Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
> +CVE: CVE-2026-42012
> +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/5cc003b9688378f6c7934b1df0aa147e80006be4]
> +
> +Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
> +---
> + lib/includes/gnutls/gnutls.h.in |  4 +++-
> + lib/x509/common.h               |  1 +
> + lib/x509/name_constraints.c     |  3 ++-
> + lib/x509/output.c               |  6 ++++++
> + lib/x509/virt-san.c             | 23 +++++++++++++++++++++++
> + lib/x509/x509.c                 |  3 ++-
> + 6 files changed, 37 insertions(+), 3 deletions(-)
> +
> +--- a/lib/includes/gnutls/gnutls.h.in
> ++++ b/lib/includes/gnutls/gnutls.h.in
> +@@ -2698,6 +2698,7 @@ void gnutls_psk_set_server_params_functi
> +  * @GNUTLS_SAN_OTHERNAME_XMPP: Virtual SAN, used by certain functions for convenience.
> +  * @GNUTLS_SAN_OTHERNAME_KRB5PRINCIPAL: Virtual SAN, used by certain functions for convenience.
> +  * @GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL: Virtual SAN, used by certain functions for convenience.
> ++ * @GNUTLS_SAN_OTHERNAME_SRV: Virtual SAN, used by certain functions for convenience.
> +  *
> +  * Enumeration of different subject alternative names types.
> +  */
> +@@ -2715,7 +2716,8 @@ typedef enum gnutls_x509_subject_alt_nam
> + 	   Used by gnutls_x509_crt_get_subject_alt_othername_oid.  */
> + 	GNUTLS_SAN_OTHERNAME_XMPP = 1000,
> + 	GNUTLS_SAN_OTHERNAME_KRB5PRINCIPAL,
> +-	GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL
> ++	GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL,
> ++	GNUTLS_SAN_OTHERNAME_SRV
> + } gnutls_x509_subject_alt_name_t;
> + 
> + struct gnutls_openpgp_crt_int;
> +--- a/lib/x509/common.h
> ++++ b/lib/x509/common.h
> +@@ -107,6 +107,7 @@
> + #define XMPP_OID "1.3.6.1.5.5.7.8.5"
> + #define KRB5_PRINCIPAL_OID "1.3.6.1.5.2.2"
> + #define MSUSER_PRINCIPAL_NAME_OID "1.3.6.1.4.1.311.20.2.3"
> ++#define SRV_OID "1.3.6.1.5.5.7.8.7"
> + #define PKIX1_RSA_PSS_MGF1_OID "1.2.840.113549.1.1.8"
> + #define PKIX1_RSA_OAEP_P_SPECIFIED_OID "1.9"
> + 
> +--- a/lib/x509/name_constraints.c
> ++++ b/lib/x509/name_constraints.c
> +@@ -516,7 +516,8 @@ static int validate_name_constraints_nod
> + 	if (type != GNUTLS_SAN_DNSNAME && type != GNUTLS_SAN_RFC822NAME &&
> + 	    type != GNUTLS_SAN_DN && type != GNUTLS_SAN_URI &&
> + 	    type != GNUTLS_SAN_IPADDRESS &&
> +-	    type != GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL) {
> ++	    type != GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL &&
> ++	    type != GNUTLS_SAN_OTHERNAME_SRV) {
> + 		return gnutls_assert_val(GNUTLS_E_X509_UNKNOWN_SAN);
> + 	}
> + 
> +--- a/lib/x509/output.c
> ++++ b/lib/x509/output.c
> +@@ -121,6 +121,7 @@ static void print_name(gnutls_buffer_st
> + 	if ((type == GNUTLS_SAN_DNSNAME || type == GNUTLS_SAN_OTHERNAME_XMPP ||
> + 	     type == GNUTLS_SAN_OTHERNAME_KRB5PRINCIPAL ||
> + 	     type == GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL ||
> ++	     type == GNUTLS_SAN_OTHERNAME_SRV ||
> + 	     type == GNUTLS_SAN_RFC822NAME || type == GNUTLS_SAN_URI) &&
> + 	    sname != NULL && strlen(sname) != name->size) {
> + 		adds(str, _("warning: SAN contains an embedded NUL, "
> +@@ -180,6 +181,11 @@ static void print_name(gnutls_buffer_st
> + 		     name->size, NON_NULL(name->data));
> + 		break;
> + 
> ++	case GNUTLS_SAN_OTHERNAME_SRV:
> ++		addf(str, _("%sSRVName: %.*s\n"), prefix, name->size,
> ++		     NON_NULL(name->data));
> ++		break;
> ++
> + 	default:
> + 		addf(str, _("%sUnknown name: "), prefix);
> + 		_gnutls_buffer_hexprint(str, name->data, name->size);
> +--- a/lib/x509/virt-san.c
> ++++ b/lib/x509/virt-san.c
> +@@ -45,6 +45,9 @@ static int san_othername_to_virtual(cons
> + 			 memcmp(oid, MSUSER_PRINCIPAL_NAME_OID,
> + 				sizeof(MSUSER_PRINCIPAL_NAME_OID) - 1) == 0)
> + 			return GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL;
> ++		else if ((unsigned)size == (sizeof(SRV_OID) - 1) &&
> ++			 memcmp(oid, SRV_OID, sizeof(SRV_OID) - 1) == 0)
> ++			return GNUTLS_SAN_OTHERNAME_SRV;
> + 	}
> + 
> + 	return GNUTLS_SAN_OTHERNAME;
> +@@ -59,6 +62,8 @@ static const char *virtual_to_othername_
> + 		return KRB5_PRINCIPAL_OID;
> + 	case GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL:
> + 		return MSUSER_PRINCIPAL_NAME_OID;
> ++	case GNUTLS_SAN_OTHERNAME_SRV:
> ++		return SRV_OID;
> + 	default:
> + 		return NULL;
> + 	}
> +@@ -126,6 +131,15 @@ int _gnutls_alt_name_assign_virt_type(st
> + 			name->type = GNUTLS_SAN_OTHERNAME;
> + 			break;
> + 
> ++		case GNUTLS_SAN_OTHERNAME_SRV:
> ++			ret = _gnutls_x509_encode_string(ASN1_ETYPE_IA5_STRING,
> ++							 san->data, san->size,
> ++							 &encoded);
> ++			if (ret < 0)
> ++				return gnutls_assert_val(ret);
> ++			name->san = _gnutls_steal_datum(&encoded);
                                    ^ This function call is not the same as upstream's patch.
Please document any non-trivial change in the patch file (just after
your signed-off-by).

Can you please send a v2 with the above fixed.

The format "issues" are minor and mainly an issue for me : I compare
upstream patches with the sent one and any format change creates noise.

Thanks!
-- 
Yoann Congal
Smile ECS