* [OE-core][kirkstone 0/4] Patch review
@ 2023-12-29 16:07 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2023-12-29 16:07 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Wednesday, January 3
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6384
The following changes since commit 2afd9a6002cba2a23dd62a1805b4be04083c041b:
testimage: Exclude wtmp from target-dumper commands (2023-12-20 11:40:13 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Archana Polampalli (2):
openssh: fix CVE-2023-51384
openssh: fix CVE-2023-51385
Khem Raj (1):
elfutils: Disable stringop-overflow warning for build host
Steve Sakoman (1):
testimage: drop target_dumper, host_dumper, and monitor_dumper
meta/classes/testimage.bbclass | 24 ---
.../openssh/openssh/CVE-2023-51384.patch | 171 ++++++++++++++++++
.../openssh/openssh/CVE-2023-51385.patch | 97 ++++++++++
.../openssh/openssh_8.9p1.bb | 2 +
.../elfutils/elfutils_0.186.bb | 2 +
5 files changed, 272 insertions(+), 24 deletions(-)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2023-51384.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2023-51385.patch
--
2.34.1
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 0/4] Patch review
@ 2024-02-01 19:37 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2024-02-01 19:37 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Monday, February 5
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6513
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6513
The following changes since commit a744a897f0ea7d34c31c024c13031221f9a85f24:
build-appliance-image: Update to kirkstone head revision (2024-01-25 04:06:50 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Alexander Kanavin (1):
python3-jinja2: upgrade 3.1.1 -> 3.1.2
Lee Chee Yang (1):
xwayland: Fix CVE-2023-6377 CVE-2023-6478
Ludovic Jozeau (1):
image-live.bbclass: LIVE_ROOTFS_TYPE support compression
Wang Mingyu (1):
python3-jinja2: upgrade 3.1.2 -> 3.1.3
meta/classes/image-live.bbclass | 2 +-
...inja2_3.1.1.bb => python3-jinja2_3.1.3.bb} | 2 +-
.../xwayland/xwayland/CVE-2023-6377.patch | 82 +++++++++++++++++++
.../xwayland/xwayland/CVE-2023-6478.patch | 66 +++++++++++++++
.../xwayland/xwayland_22.1.8.bb | 2 +
5 files changed, 152 insertions(+), 2 deletions(-)
rename meta/recipes-devtools/python/{python3-jinja2_3.1.1.bb => python3-jinja2_3.1.3.bb} (92%)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2023-6377.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2023-6478.patch
--
2.34.1
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 0/4] Patch review
@ 2024-03-07 18:38 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2024-03-07 18:38 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Monday, March 11
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6658
The following changes since commit d63af11e92094487d6e358f27283e5385937e7a8:
kernel.bbclass: Set pkg-config variables for building modules (2024-03-03 11:56:20 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Chen Qi (1):
useradd-example: do not use unsupported clear text password
Fabio Estevam (1):
u-boot: Move UBOOT_INITIAL_ENV back to u-boot.inc
Hitendra Prajapati (1):
golang: Fix CVE-2023-45289 & CVE-2023-45290
Steve Sakoman (1):
selftest: skip virgl gtk/sdl test on ubuntu 18.04
.../useradd/useradd-example.bb | 4 +-
meta/classes/uboot-config.bbclass | 4 -
meta/lib/oeqa/selftest/cases/runtime_test.py | 2 +
meta/recipes-bsp/u-boot/u-boot.inc | 4 +
meta/recipes-devtools/go/go-1.17.13.inc | 2 +
.../go/go-1.21/CVE-2023-45289.patch | 121 ++++++++
.../go/go-1.21/CVE-2023-45290.patch | 270 ++++++++++++++++++
7 files changed, 401 insertions(+), 6 deletions(-)
create mode 100644 meta/recipes-devtools/go/go-1.21/CVE-2023-45289.patch
create mode 100644 meta/recipes-devtools/go/go-1.21/CVE-2023-45290.patch
--
2.34.1
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 0/4] Patch review
@ 2025-01-31 14:15 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-01-31 14:15 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Tuesday, February 3
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/911
The following changes since commit 077aab43f2c928eb8da71934405c62327010f552:
classes/qemu: use tune to select QEMU_EXTRAOPTIONS, not package architecture (2025-01-20 06:06:07 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Deepesh Varatharajan (1):
glibc: stable 2.35 branch updates
Peter Marko (1):
openssl: patch CVE-2024-13176
Yash Shinde (2):
binutils: internal gdb: Fix CVE-2024-53589
gdb: Fix CVE-2024-53589
.../openssl/openssl/CVE-2024-13176.patch | 125 ++++++++++++++++++
.../openssl/openssl_3.0.15.bb | 1 +
meta/recipes-core/glibc/glibc-version.inc | 2 +-
.../binutils/binutils-2.38.inc | 1 +
.../binutils/0037-CVE-2024-53589.patch | 92 +++++++++++++
meta/recipes-devtools/gdb/gdb.inc | 1 +
.../gdb/gdb/0014-CVE-2024-53589.patch | 92 +++++++++++++
7 files changed, 313 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2024-13176.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0037-CVE-2024-53589.patch
create mode 100644 meta/recipes-devtools/gdb/gdb/0014-CVE-2024-53589.patch
--
2.43.0
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 0/4] Patch review
@ 2025-03-27 14:43 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-03-27 14:43 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirktone and have comments back by
end of day Monday, March 31
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1277
The following changes since commit 1172a71f2104454a13e64886adbdb381aa8d6e0e:
libxcrypt-compat: Remove libcrypt.so to fix conflict with libcrypt (2025-03-21 06:48:11 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Bruce Ashfield (2):
linux-yocto/5.15: update to v5.15.179
linux-yocto/5.10: update to v5.10.234
Peter Marko (1):
python3: patch CVE-2025-0938
Vijay Anusuri (1):
vim: Upgrade 9.1.1115 -> 9.1.1198
.../python/python3/CVE-2025-0938.patch | 131 ++++++++++++++++++
.../python/python3_3.10.16.bb | 1 +
.../linux/linux-yocto-rt_5.10.bb | 6 +-
.../linux/linux-yocto-rt_5.15.bb | 6 +-
.../linux/linux-yocto-tiny_5.10.bb | 8 +-
.../linux/linux-yocto-tiny_5.15.bb | 6 +-
meta/recipes-kernel/linux/linux-yocto_5.10.bb | 24 ++--
meta/recipes-kernel/linux/linux-yocto_5.15.bb | 26 ++--
meta/recipes-support/vim/vim.inc | 4 +-
9 files changed, 172 insertions(+), 40 deletions(-)
create mode 100644 meta/recipes-devtools/python/python3/CVE-2025-0938.patch
--
2.43.0
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 0/4] Patch review
@ 2025-04-15 20:52 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-04-15 20:52 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Thursday, April 17
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1401
The following changes since commit 7399cf17590204f8289f356cce4575592d6e3536:
ghostscript: Fix CVE-2025-27836 (2025-04-08 08:36:03 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Divya Chellam (1):
ruby: fix CVE-2024-43398
Hitendra Prajapati (1):
go: fix CVE-2025-22871
Peter Marko (2):
cve-update-nvd2-native: add workaround for json5 style list
systemd: ignore CVEs which reappeared after upgrade to 250.14
.../meta/cve-update-nvd2-native.bb | 5 +
meta/recipes-core/systemd/systemd.inc | 3 +
meta/recipes-devtools/go/go-1.17.13.inc | 1 +
.../go/go-1.21/CVE-2025-22871.patch | 172 ++++++++++++++++++
.../ruby/ruby/CVE-2024-43398.patch | 81 +++++++++
meta/recipes-devtools/ruby/ruby_3.1.3.bb | 1 +
6 files changed, 263 insertions(+)
create mode 100644 meta/recipes-devtools/go/go-1.21/CVE-2025-22871.patch
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2024-43398.patch
--
2.43.0
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 0/4] Patch review
@ 2025-08-05 16:43 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-08-05 16:43 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Thursday, August 7
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2150
The following changes since commit b4a2f74ba0b40abcdf56c4b58cae5f7ce145d511:
sqlite3: Fix CVE-2025-6965 (2025-07-29 06:39:06 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Peter Marko (3):
sqlite3: patch CVE-2025-7458
sqlite3: ignore CVE-2025-3277
glibc: stable 2.35 branch updates
Zhang Peng (1):
avahi: fix CVE-2024-52615
meta/recipes-connectivity/avahi/avahi_0.8.bb | 1 +
.../avahi/files/CVE-2024-52615.patch | 228 ++++++++++++++++
meta/recipes-core/glibc/glibc-version.inc | 2 +-
.../glibc/glibc/0025-CVE-2025-4802.patch | 250 ------------------
meta/recipes-core/glibc/glibc_2.35.bb | 2 +-
...mpts-to-improve-the-detection-of-cov.patch | 91 +++++++
.../sqlite/files/CVE-2025-7458.patch | 32 +++
meta/recipes-support/sqlite/sqlite3_3.38.5.bb | 4 +
8 files changed, 358 insertions(+), 252 deletions(-)
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2024-52615.patch
delete mode 100644 meta/recipes-core/glibc/glibc/0025-CVE-2025-4802.patch
create mode 100644 meta/recipes-support/sqlite/files/0001-This-branch-attempts-to-improve-the-detection-of-cov.patch
create mode 100644 meta/recipes-support/sqlite/files/CVE-2025-7458.patch
--
2.43.0
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 0/4] Patch review
@ 2025-10-29 2:54 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-10-29 2:54 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Thursday, October 30
Passed a-full on the autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2650
The following changes since commit 9b3dbd691f6ebdbdfe88cef3d3a676ddd1399c63:
python3: upgrade 3.10.18 -> 3.10.19 (2025-10-17 07:39:27 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Hitendra Prajapati (1):
git: fix CVE-2025-48386
Peter Marko (1):
lz4: patch CVE-2025-62813
Yash Shinde (2):
binutils: fix CVE-2025-11081
binutils: fix CVE-2025-8225
.../binutils/binutils-2.38.inc | 2 +
.../binutils/0046-CVE-2025-11081.patch | 84 ++++++++++++++++
.../binutils/0047-CVE-2025-8225.patch | 47 +++++++++
.../git/git/CVE-2025-48386.patch | 97 +++++++++++++++++++
meta/recipes-devtools/git/git_2.35.7.bb | 1 +
.../lz4/files/CVE-2025-62813.patch | 69 +++++++++++++
meta/recipes-support/lz4/lz4_1.9.4.bb | 4 +-
7 files changed, 303 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-devtools/binutils/binutils/0046-CVE-2025-11081.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0047-CVE-2025-8225.patch
create mode 100644 meta/recipes-devtools/git/git/CVE-2025-48386.patch
create mode 100644 meta/recipes-support/lz4/files/CVE-2025-62813.patch
--
2.43.0
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 0/4] Patch review
@ 2025-12-09 21:53 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-12-09 21:53 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Thursday, December 11
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2836
The following changes since commit 80c7fd87fd95a79c6eb5f41b95cf70ccc70d9615:
systemd-bootchart: update SRC_URI branch (2025-12-01 07:13:56 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Hitendra Prajapati (2):
libxml2: Security fix for CVE-2025-7425
openssh: fix CVE-2025-61984
Peter Marko (2):
libpng: patch CVE-2025-66293
libmicrohttpd: disable experimental code by default
.../openssh/openssh/CVE-2025-61984.patch | 98 +++
.../openssh/openssh_8.9p1.bb | 1 +
.../libxml/libxml2/CVE-2025-7425.patch | 802 ++++++++++++++++++
meta/recipes-core/libxml/libxml2_2.9.14.bb | 1 +
.../libpng/files/CVE-2025-66293-01.patch | 60 ++
.../libpng/files/CVE-2025-66293-02.patch | 125 +++
.../libpng/libpng_1.6.39.bb | 2 +
.../libmicrohttpd/libmicrohttpd_0.9.76.bb | 3 +
8 files changed, 1092 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2025-61984.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2025-7425.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-66293-01.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-66293-02.patch
--
2.43.0
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 0/4] Patch review
@ 2025-12-29 23:03 Steve Sakoman
2025-12-29 23:03 ` [OE-core][kirkstone 1/4] grub: fix CVE-2025-61661 CVE-2025-61662 CVE-2025-61663 CVE-2025-61664 Steve Sakoman
` (3 more replies)
0 siblings, 4 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-12-29 23:03 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Wednesday, December 31
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2953
The following changes since commit c15faee8854e85e02693a041d88326f30b24ee92:
cross.bbclass: Propagate dependencies to outhash (2025-12-29 08:40:22 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Jiaying Song (1):
grub: fix CVE-2025-61661 CVE-2025-61662 CVE-2025-61663 CVE-2025-61664
Vijay Anusuri (3):
go: Update CVE-2025-58187
go: Fix CVE-2025-61727
go: Fix CVE-2025-61729
.../grub/files/CVE-2025-61661.patch | 40 ++
.../grub/files/CVE-2025-61662.patch | 72 +++
.../grub/files/CVE-2025-61663_61664.patch | 64 +++
meta/recipes-bsp/grub/grub2.inc | 3 +
meta/recipes-devtools/go/go-1.17.13.inc | 5 +-
...025-58187.patch => CVE-2025-58187-1.patch} | 0
.../go/go-1.18/CVE-2025-58187-2.patch | 516 ++++++++++++++++++
.../go/go-1.18/CVE-2025-61727.patch | 229 ++++++++
.../go/go-1.18/CVE-2025-61729.patch | 172 ++++++
9 files changed, 1100 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2025-61661.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2025-61662.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2025-61663_61664.patch
rename meta/recipes-devtools/go/go-1.18/{CVE-2025-58187.patch => CVE-2025-58187-1.patch} (100%)
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2025-58187-2.patch
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2025-61727.patch
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2025-61729.patch
--
2.43.0
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 1/4] grub: fix CVE-2025-61661 CVE-2025-61662 CVE-2025-61663 CVE-2025-61664
2025-12-29 23:03 [OE-core][kirkstone 0/4] Patch review Steve Sakoman
@ 2025-12-29 23:03 ` Steve Sakoman
2025-12-29 23:03 ` [OE-core][kirkstone 2/4] go: Update CVE-2025-58187 Steve Sakoman
` (2 subsequent siblings)
3 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-12-29 23:03 UTC (permalink / raw)
To: openembedded-core
From: Jiaying Song <jiaying.song.cn@windriver.com>
References:
https://nvd.nist.gov/vuln/detail/CVE-2025-61661
https://nvd.nist.gov/vuln/detail/CVE-2025-61662
https://nvd.nist.gov/vuln/detail/CVE-2025-61663
https://nvd.nist.gov/vuln/detail/CVE-2025-61664
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../grub/files/CVE-2025-61661.patch | 40 +++++++++++
.../grub/files/CVE-2025-61662.patch | 72 +++++++++++++++++++
.../grub/files/CVE-2025-61663_61664.patch | 64 +++++++++++++++++
meta/recipes-bsp/grub/grub2.inc | 3 +
4 files changed, 179 insertions(+)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2025-61661.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2025-61662.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2025-61663_61664.patch
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-61661.patch b/meta/recipes-bsp/grub/files/CVE-2025-61661.patch
new file mode 100644
index 0000000000..9ae4f3b307
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-61661.patch
@@ -0,0 +1,40 @@
+From 9c2ae73b549a653f5f1bd5d4edebc50a764bad06 Mon Sep 17 00:00:00 2001
+From: Jamie <volticks@gmail.com>
+Date: Mon, 14 Jul 2025 09:52:59 +0100
+Subject: [PATCH 1/3] commands/usbtest: Use correct string length field
+
+An incorrect length field is used for buffer allocation. This leads to
+grub_utf16_to_utf8() receiving an incorrect/different length and possibly
+causing OOB write. This makes sure to use the correct length.
+
+Fixes: CVE-2025-61661
+
+CVE: CVE-2025-61661
+
+Upstream-Status: Backport
+[https://gitweb.git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=549a9cc372fd0b96a4ccdfad0e12140476cc62a3]
+
+Reported-by: Jamie <volticks@gmail.com>
+Signed-off-by: Jamie <volticks@gmail.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
+---
+ grub-core/commands/usbtest.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/grub-core/commands/usbtest.c b/grub-core/commands/usbtest.c
+index 2c6d93fe6..8ef187a9a 100644
+--- a/grub-core/commands/usbtest.c
++++ b/grub-core/commands/usbtest.c
+@@ -99,7 +99,7 @@ grub_usb_get_string (grub_usb_device_t dev, grub_uint8_t index, int langid,
+ return GRUB_USB_ERR_NONE;
+ }
+
+- *string = grub_malloc (descstr.length * 2 + 1);
++ *string = grub_malloc (descstrp->length * 2 + 1);
+ if (! *string)
+ {
+ grub_free (descstrp);
+--
+2.34.1
+
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-61662.patch b/meta/recipes-bsp/grub/files/CVE-2025-61662.patch
new file mode 100644
index 0000000000..1614b00d53
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-61662.patch
@@ -0,0 +1,72 @@
+From c47760a907c91283bac9a8400d6975574b1d3986 Mon Sep 17 00:00:00 2001
+From: Alec Brown <alec.r.brown@oracle.com>
+Date: Thu, 21 Aug 2025 21:14:06 +0000
+Subject: [PATCH 2/3] gettext/gettext: Unregister gettext command on module
+ unload
+
+When the gettext module is loaded, the gettext command is registered but
+isn't unregistered when the module is unloaded. We need to add a call to
+grub_unregister_command() when unloading the module.
+
+Fixes: CVE-2025-61662
+
+CVE: CVE-2025-61662
+
+Upstream-Status: Backport
+[https://gitweb.git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=8ed78fd9f0852ab218cc1f991c38e5a229e43807]
+
+Reported-by: Alec Brown <alec.r.brown@oracle.com>
+Signed-off-by: Alec Brown <alec.r.brown@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
+---
+ grub-core/gettext/gettext.c | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
+index 7a25c9d67..ef1258ee0 100644
+--- a/grub-core/gettext/gettext.c
++++ b/grub-core/gettext/gettext.c
+@@ -502,6 +502,8 @@ grub_cmd_translate (grub_command_t cmd __attribute__ ((unused)),
+ return 0;
+ }
+
++static grub_command_t cmd;
++
+ GRUB_MOD_INIT (gettext)
+ {
+ const char *lang;
+@@ -521,13 +523,14 @@ GRUB_MOD_INIT (gettext)
+ grub_register_variable_hook ("locale_dir", NULL, read_main);
+ grub_register_variable_hook ("secondary_locale_dir", NULL, read_secondary);
+
+- grub_register_command_p1 ("gettext", grub_cmd_translate,
+- N_("STRING"),
+- /* TRANSLATORS: It refers to passing the string through gettext.
+- So it's "translate" in the same meaning as in what you're
+- doing now.
+- */
+- N_("Translates the string with the current settings."));
++ cmd = grub_register_command_p1 ("gettext", grub_cmd_translate,
++ N_("STRING"),
++ /*
++ * TRANSLATORS: It refers to passing the string through gettext.
++ * So it's "translate" in the same meaning as in what you're
++ * doing now.
++ */
++ N_("Translates the string with the current settings."));
+
+ /* Reload .mo file information if lang changes. */
+ grub_register_variable_hook ("lang", NULL, grub_gettext_env_write_lang);
+@@ -544,6 +547,8 @@ GRUB_MOD_FINI (gettext)
+ grub_register_variable_hook ("secondary_locale_dir", NULL, NULL);
+ grub_register_variable_hook ("lang", NULL, NULL);
+
++ grub_unregister_command (cmd);
++
+ grub_gettext_delete_list (&main_context);
+ grub_gettext_delete_list (&secondary_context);
+
+--
+2.34.1
+
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-61663_61664.patch b/meta/recipes-bsp/grub/files/CVE-2025-61663_61664.patch
new file mode 100644
index 0000000000..cdf1e4ca36
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-61663_61664.patch
@@ -0,0 +1,64 @@
+From a182bd873e4aa93205ecbb7845ef7f0eda99dcf5 Mon Sep 17 00:00:00 2001
+From: Alec Brown <alec.r.brown@oracle.com>
+Date: Thu, 21 Aug 2025 21:14:07 +0000
+Subject: [PATCH 3/3] normal/main: Unregister commands on module unload
+
+When the normal module is loaded, the normal and normal_exit commands
+are registered but aren't unregistered when the module is unloaded. We
+need to add calls to grub_unregister_command() when unloading the module
+for these commands.
+
+Fixes: CVE-2025-61663
+Fixes: CVE-2025-61664
+
+CVE: CVE-2025-61663 CVE-2025-61664
+
+Upstream-Status: Backport
+[https://gitweb.git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=05d3698b8b03eccc49e53491bbd75dba15f40917]
+
+Reported-by: Alec Brown <alec.r.brown@oracle.com>
+Signed-off-by: Alec Brown <alec.r.brown@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
+---
+ grub-core/normal/main.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
+index a95c25e5f..9d576de7a 100644
+--- a/grub-core/normal/main.c
++++ b/grub-core/normal/main.c
+@@ -499,7 +499,7 @@ grub_mini_cmd_clear (struct grub_command *cmd __attribute__ ((unused)),
+ return 0;
+ }
+
+-static grub_command_t cmd_clear;
++static grub_command_t cmd_clear, cmd_normal, cmd_normal_exit;
+
+ static void (*grub_xputs_saved) (const char *str);
+ static const char *features[] = {
+@@ -541,10 +541,10 @@ GRUB_MOD_INIT(normal)
+ grub_env_export ("pager");
+
+ /* Register a command "normal" for the rescue mode. */
+- grub_register_command ("normal", grub_cmd_normal,
+- 0, N_("Enter normal mode."));
+- grub_register_command ("normal_exit", grub_cmd_normal_exit,
+- 0, N_("Exit from normal mode."));
++ cmd_normal = grub_register_command ("normal", grub_cmd_normal,
++ 0, N_("Enter normal mode."));
++ cmd_normal_exit = grub_register_command ("normal_exit", grub_cmd_normal_exit,
++ 0, N_("Exit from normal mode."));
+
+ /* Reload terminal colors when these variables are written to. */
+ grub_register_variable_hook ("color_normal", NULL, grub_env_write_color_normal);
+@@ -586,4 +586,6 @@ GRUB_MOD_FINI(normal)
+ grub_register_variable_hook ("color_highlight", NULL, NULL);
+ grub_fs_autoload_hook = 0;
+ grub_unregister_command (cmd_clear);
++ grub_unregister_command (cmd_normal);
++ grub_unregister_command (cmd_normal_exit);
+ }
+--
+2.34.1
+
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index 94eeadfb99..4744e26693 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -60,6 +60,9 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
file://CVE-2025-0690.patch \
file://CVE-2025-1118.patch \
file://CVE-2024-56738.patch \
+ file://CVE-2025-61661.patch \
+ file://CVE-2025-61662.patch \
+ file://CVE-2025-61663_61664.patch \
"
SRC_URI[sha256sum] = "23b64b4c741569f9426ed2e3d0e6780796fca081bee4c99f62aa3f53ae803f5f"
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 2/4] go: Update CVE-2025-58187
2025-12-29 23:03 [OE-core][kirkstone 0/4] Patch review Steve Sakoman
2025-12-29 23:03 ` [OE-core][kirkstone 1/4] grub: fix CVE-2025-61661 CVE-2025-61662 CVE-2025-61663 CVE-2025-61664 Steve Sakoman
@ 2025-12-29 23:03 ` Steve Sakoman
2025-12-29 23:03 ` [OE-core][kirkstone 3/4] go: Fix CVE-2025-61727 Steve Sakoman
2025-12-29 23:03 ` [OE-core][kirkstone 4/4] go: Fix CVE-2025-61729 Steve Sakoman
3 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-12-29 23:03 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport from https://github.com/golang/go/commit/ca6a5545ba18844a97c88a90a385eb6335bb7526
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/go/go-1.17.13.inc | 3 +-
...025-58187.patch => CVE-2025-58187-1.patch} | 0
.../go/go-1.18/CVE-2025-58187-2.patch | 516 ++++++++++++++++++
3 files changed, 518 insertions(+), 1 deletion(-)
rename meta/recipes-devtools/go/go-1.18/{CVE-2025-58187.patch => CVE-2025-58187-1.patch} (100%)
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2025-58187-2.patch
diff --git a/meta/recipes-devtools/go/go-1.17.13.inc b/meta/recipes-devtools/go/go-1.17.13.inc
index 47ef84c35a..1433d54f06 100644
--- a/meta/recipes-devtools/go/go-1.17.13.inc
+++ b/meta/recipes-devtools/go/go-1.17.13.inc
@@ -69,7 +69,8 @@ SRC_URI = "https://golang.org/dl/go${PV}.src.tar.gz;name=main \
file://CVE-2025-47907.patch \
file://CVE-2025-47906.patch \
file://CVE-2024-24783.patch \
- file://CVE-2025-58187.patch \
+ file://CVE-2025-58187-1.patch \
+ file://CVE-2025-58187-2.patch \
file://CVE-2025-58189.patch \
file://CVE-2025-61723.patch \
file://CVE-2025-61724.patch \
diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2025-58187.patch b/meta/recipes-devtools/go/go-1.18/CVE-2025-58187-1.patch
similarity index 100%
rename from meta/recipes-devtools/go/go-1.18/CVE-2025-58187.patch
rename to meta/recipes-devtools/go/go-1.18/CVE-2025-58187-1.patch
diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2025-58187-2.patch b/meta/recipes-devtools/go/go-1.18/CVE-2025-58187-2.patch
new file mode 100644
index 0000000000..65f176f027
--- /dev/null
+++ b/meta/recipes-devtools/go/go-1.18/CVE-2025-58187-2.patch
@@ -0,0 +1,516 @@
+From ca6a5545ba18844a97c88a90a385eb6335bb7526 Mon Sep 17 00:00:00 2001
+From: Roland Shoemaker <roland@golang.org>
+Date: Thu, 9 Oct 2025 13:35:24 -0700
+Subject: [PATCH] [release-branch.go1.24] crypto/x509: rework fix for
+ CVE-2025-58187
+
+In CL 709854 we enabled strict validation for a number of properties of
+domain names (and their constraints). This caused significant breakage,
+since we didn't previously disallow the creation of certificates which
+contained these malformed domains.
+
+Rollback a number of the properties we enforced, making domainNameValid
+only enforce the same properties that domainToReverseLabels does. Since
+this also undoes some of the DoS protections our initial fix enabled,
+this change also adds caching of constraints in isValid (which perhaps
+is the fix we should've initially chosen).
+
+Updates #75835
+Updates #75828
+Fixes #75860
+
+Change-Id: Ie6ca6b4f30e9b8a143692b64757f7bbf4671ed0e
+Reviewed-on: https://go-review.googlesource.com/c/go/+/710735
+LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
+Reviewed-by: Damien Neil <dneil@google.com>
+(cherry picked from commit 1cd71689f2ed8f07031a0cc58fc3586ca501839f)
+Reviewed-on: https://go-review.googlesource.com/c/go/+/710879
+Reviewed-by: Michael Pratt <mpratt@google.com>
+Auto-Submit: Michael Pratt <mpratt@google.com>
+
+Upstream-Status: Backport [https://github.com/golang/go/commit/ca6a5545ba18844a97c88a90a385eb6335bb7526]
+CVE: CVE-2025-58187
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ src/crypto/x509/name_constraints_test.go | 66 +++++++++++++++++--
+ src/crypto/x509/parser.go | 57 +++++++++++-----
+ src/crypto/x509/parser_test.go | 84 +++++++++++++++++++++---
+ src/crypto/x509/verify.go | 53 ++++++++++-----
+ src/crypto/x509/verify_test.go | 2 +-
+ 5 files changed, 213 insertions(+), 49 deletions(-)
+
+diff --git a/src/crypto/x509/name_constraints_test.go b/src/crypto/x509/name_constraints_test.go
+index d4f7d41..c59a7dc 100644
+--- a/src/crypto/x509/name_constraints_test.go
++++ b/src/crypto/x509/name_constraints_test.go
+@@ -1452,7 +1452,63 @@ var nameConstraintsTests = []nameConstraintsTest{
+ requestedEKUs: []ExtKeyUsage{ExtKeyUsageServerAuth},
+ },
+
+- // #77: if several EKUs are requested, satisfying any of them is sufficient.
++ // An invalid DNS SAN should be detected only at validation time so
++ // that we can process CA certificates in the wild that have invalid SANs.
++ // See https://github.com/golang/go/issues/23995
++
++ // #77: an invalid DNS or mail SAN will not be detected if name constraint
++ // checking is not triggered.
++ {
++ roots: make([]constraintsSpec, 1),
++ intermediates: [][]constraintsSpec{
++ {
++ {},
++ },
++ },
++ leaf: leafSpec{
++ sans: []string{"dns:this is invalid", "email:this @ is invalid"},
++ },
++ },
++
++ // #78: an invalid DNS SAN will be detected if any name constraint checking
++ // is triggered.
++ {
++ roots: []constraintsSpec{
++ {
++ bad: []string{"uri:"},
++ },
++ },
++ intermediates: [][]constraintsSpec{
++ {
++ {},
++ },
++ },
++ leaf: leafSpec{
++ sans: []string{"dns:this is invalid"},
++ },
++ expectedError: "cannot parse dnsName",
++ },
++
++ // #79: an invalid email SAN will be detected if any name constraint
++ // checking is triggered.
++ {
++ roots: []constraintsSpec{
++ {
++ bad: []string{"uri:"},
++ },
++ },
++ intermediates: [][]constraintsSpec{
++ {
++ {},
++ },
++ },
++ leaf: leafSpec{
++ sans: []string{"email:this @ is invalid"},
++ },
++ expectedError: "cannot parse rfc822Name",
++ },
++
++ // #80: if several EKUs are requested, satisfying any of them is sufficient.
+ {
+ roots: make([]constraintsSpec, 1),
+ intermediates: [][]constraintsSpec{
+@@ -1467,7 +1523,7 @@ var nameConstraintsTests = []nameConstraintsTest{
+ requestedEKUs: []ExtKeyUsage{ExtKeyUsageClientAuth, ExtKeyUsageEmailProtection},
+ },
+
+- // #78: EKUs that are not asserted in VerifyOpts are not required to be
++ // #81: EKUs that are not asserted in VerifyOpts are not required to be
+ // nested.
+ {
+ roots: make([]constraintsSpec, 1),
+@@ -1486,7 +1542,7 @@ var nameConstraintsTests = []nameConstraintsTest{
+ },
+ },
+
+- // #79: a certificate without SANs and CN is accepted in a constrained chain.
++ // #82: a certificate without SANs and CN is accepted in a constrained chain.
+ {
+ roots: []constraintsSpec{
+ {
+@@ -1503,7 +1559,7 @@ var nameConstraintsTests = []nameConstraintsTest{
+ },
+ },
+
+- // #80: a certificate without SANs and with a CN that does not parse as a
++ // #83: a certificate without SANs and with a CN that does not parse as a
+ // hostname is accepted in a constrained chain.
+ {
+ roots: []constraintsSpec{
+@@ -1522,7 +1578,7 @@ var nameConstraintsTests = []nameConstraintsTest{
+ },
+ },
+
+- // #81: a certificate with SANs and CN is accepted in a constrained chain.
++ // #84: a certificate with SANs and CN is accepted in a constrained chain.
+ {
+ roots: []constraintsSpec{
+ {
+diff --git a/src/crypto/x509/parser.go b/src/crypto/x509/parser.go
+index 0788210..cfe4c86 100644
+--- a/src/crypto/x509/parser.go
++++ b/src/crypto/x509/parser.go
+@@ -391,14 +391,10 @@ func parseSANExtension(der cryptobyte.String) (dnsNames, emailAddresses []string
+ if err := isIA5String(email); err != nil {
+ return errors.New("x509: SAN rfc822Name is malformed")
+ }
+- parsed, ok := parseRFC2821Mailbox(email)
+- if !ok || (ok && !domainNameValid(parsed.domain, false)) {
+- return errors.New("x509: SAN rfc822Name is malformed")
+- }
+ emailAddresses = append(emailAddresses, email)
+ case nameTypeDNS:
+ name := string(data)
+- if err := isIA5String(name); err != nil || (err == nil && !domainNameValid(name, false)) {
++ if err := isIA5String(name); err != nil {
+ return errors.New("x509: SAN dNSName is malformed")
+ }
+ dnsNames = append(dnsNames, string(name))
+@@ -408,9 +404,12 @@ func parseSANExtension(der cryptobyte.String) (dnsNames, emailAddresses []string
+ return errors.New("x509: SAN uniformResourceIdentifier is malformed")
+ }
+ uri, err := url.Parse(uriStr)
+- if err != nil || (err == nil && uri.Host != "" && !domainNameValid(uri.Host, false)) {
++ if err != nil {
+ return fmt.Errorf("x509: cannot parse URI %q: %s", uriStr, err)
+ }
++ if len(uri.Host) > 0 && !domainNameValid(uri.Host, false) {
++ return fmt.Errorf("x509: cannot parse URI %q: invalid domain", uriStr)
++ }
+ uris = append(uris, uri)
+ case nameTypeIP:
+ switch len(data) {
+@@ -990,36 +989,58 @@ func ParseCertificates(der []byte) ([]*Certificate, error) {
+ return certs, nil
+ }
+
+-// domainNameValid does minimal domain name validity checking. In particular it
+-// enforces the following properties:
+-// - names cannot have the trailing period
+-// - names can only have a leading period if constraint is true
+-// - names must be <= 253 characters
+-// - names cannot have empty labels
+-// - names cannot labels that are longer than 63 characters
+-//
+-// Note that this does not enforce the LDH requirements for domain names.
++// domainNameValid is an alloc-less version of the checks that
++// domainToReverseLabels does.
+ func domainNameValid(s string, constraint bool) bool {
+- if len(s) == 0 && constraint {
++ // TODO(#75835): This function omits a number of checks which we
++ // really should be doing to enforce that domain names are valid names per
++ // RFC 1034. We previously enabled these checks, but this broke a
++ // significant number of certificates we previously considered valid, and we
++ // happily create via CreateCertificate (et al). We should enable these
++ // checks, but will need to gate them behind a GODEBUG.
++ //
++ // I have left the checks we previously enabled, noted with "TODO(#75835)" so
++ // that we can easily re-enable them once we unbreak everyone.
++
++ // TODO(#75835): this should only be true for constraints.
++ if len(s) == 0 {
+ return true
+ }
+- if len(s) == 0 || (!constraint && s[0] == '.') || s[len(s)-1] == '.' || len(s) > 253 {
++
++ // Do not allow trailing period (FQDN format is not allowed in SANs or
++ // constraints).
++ if s[len(s)-1] == '.' {
+ return false
+ }
++
++ // TODO(#75835): domains must have at least one label, cannot have
++ // a leading empty label, and cannot be longer than 253 characters.
++ // if len(s) == 0 || (!constraint && s[0] == '.') || len(s) > 253 {
++ // return false
++ // }
++
+ lastDot := -1
+ if constraint && s[0] == '.' {
+ s = s[1:]
+ }
+
+ for i := 0; i <= len(s); i++ {
++ if i < len(s) && (s[i] < 33 || s[i] > 126) {
++ // Invalid character.
++ return false
++ }
+ if i == len(s) || s[i] == '.' {
+ labelLen := i
+ if lastDot >= 0 {
+ labelLen -= lastDot + 1
+ }
+- if labelLen == 0 || labelLen > 63 {
++ if labelLen == 0 {
+ return false
+ }
++ // TODO(#75835): labels cannot be longer than 63 characters.
++ // if labelLen > 63 {
++ // return false
++ // }
+ lastDot = i
+ }
+ }
+diff --git a/src/crypto/x509/parser_test.go b/src/crypto/x509/parser_test.go
+index 95ed116..662e305 100644
+--- a/src/crypto/x509/parser_test.go
++++ b/src/crypto/x509/parser_test.go
+@@ -4,6 +4,9 @@
+ package x509
+
+ import (
++ "crypto/ecdsa"
++ "crypto/elliptic"
++ "crypto/rand"
+ "encoding/asn1"
+ "strings"
+ "testing"
+@@ -109,7 +112,31 @@ func TestDomainNameValid(t *testing.T) {
+ constraint bool
+ valid bool
+ }{
+- {"empty name, name", "", false, false},
++ // TODO(#75835): these tests are for stricter name validation, which we
++ // had to disable. Once we reenable these strict checks, behind a
++ // GODEBUG, we should add them back in.
++ // {"empty name, name", "", false, false},
++ // {"254 char label, name", strings.Repeat("a.a", 84) + "aaa", false, false},
++ // {"254 char label, constraint", strings.Repeat("a.a", 84) + "aaa", true, false},
++ // {"253 char label, name", strings.Repeat("a.a", 84) + "aa", false, false},
++ // {"253 char label, constraint", strings.Repeat("a.a", 84) + "aa", true, false},
++ // {"64 char single label, name", strings.Repeat("a", 64), false, false},
++ // {"64 char single label, constraint", strings.Repeat("a", 64), true, false},
++ // {"64 char label, name", "a." + strings.Repeat("a", 64), false, false},
++ // {"64 char label, constraint", "a." + strings.Repeat("a", 64), true, false},
++
++ // TODO(#75835): these are the inverse of the tests above, they should be removed
++ // once the strict checking is enabled.
++ {"254 char label, name", strings.Repeat("a.a", 84) + "aaa", false, true},
++ {"254 char label, constraint", strings.Repeat("a.a", 84) + "aaa", true, true},
++ {"253 char label, name", strings.Repeat("a.a", 84) + "aa", false, true},
++ {"253 char label, constraint", strings.Repeat("a.a", 84) + "aa", true, true},
++ {"64 char single label, name", strings.Repeat("a", 64), false, true},
++ {"64 char single label, constraint", strings.Repeat("a", 64), true, true},
++ {"64 char label, name", "a." + strings.Repeat("a", 64), false, true},
++ {"64 char label, constraint", "a." + strings.Repeat("a", 64), true, true},
++
++ // Check we properly enforce properties of domain names.
+ {"empty name, constraint", "", true, true},
+ {"empty label, name", "a..a", false, false},
+ {"empty label, constraint", "a..a", true, false},
+@@ -123,23 +150,60 @@ func TestDomainNameValid(t *testing.T) {
+ {"trailing period, constraint", "a.", true, false},
+ {"bare label, name", "a", false, true},
+ {"bare label, constraint", "a", true, true},
+- {"254 char label, name", strings.Repeat("a.a", 84) + "aaa", false, false},
+- {"254 char label, constraint", strings.Repeat("a.a", 84) + "aaa", true, false},
+- {"253 char label, name", strings.Repeat("a.a", 84) + "aa", false, false},
+- {"253 char label, constraint", strings.Repeat("a.a", 84) + "aa", true, false},
+- {"64 char single label, name", strings.Repeat("a", 64), false, false},
+- {"64 char single label, constraint", strings.Repeat("a", 64), true, false},
+ {"63 char single label, name", strings.Repeat("a", 63), false, true},
+ {"63 char single label, constraint", strings.Repeat("a", 63), true, true},
+- {"64 char label, name", "a." + strings.Repeat("a", 64), false, false},
+- {"64 char label, constraint", "a." + strings.Repeat("a", 64), true, false},
+ {"63 char label, name", "a." + strings.Repeat("a", 63), false, true},
+ {"63 char label, constraint", "a." + strings.Repeat("a", 63), true, true},
+ } {
+ t.Run(tc.name, func(t *testing.T) {
+- if tc.valid != domainNameValid(tc.dnsName, tc.constraint) {
++ valid := domainNameValid(tc.dnsName, tc.constraint)
++ if tc.valid != valid {
+ t.Errorf("domainNameValid(%q, %t) = %v; want %v", tc.dnsName, tc.constraint, !tc.valid, tc.valid)
+ }
++ // Also check that we enforce the same properties as domainToReverseLabels
++ trimmedName := tc.dnsName
++ if tc.constraint && len(trimmedName) > 1 && trimmedName[0] == '.' {
++ trimmedName = trimmedName[1:]
++ }
++ _, revValid := domainToReverseLabels(trimmedName)
++ if valid != revValid {
++ t.Errorf("domainNameValid(%q, %t) = %t != domainToReverseLabels(%q) = %t", tc.dnsName, tc.constraint, valid, trimmedName, revValid)
++ }
+ })
+ }
+ }
++
++func TestRoundtripWeirdSANs(t *testing.T) {
++ // TODO(#75835): check that certificates we create with CreateCertificate that have malformed SAN values
++ // can be parsed by ParseCertificate. We should eventually restrict this, but for now we have to maintain
++ // this property as people have been relying on it.
++ k, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
++ if err != nil {
++ t.Fatal(err)
++ }
++ badNames := []string{
++ "baredomain",
++ "baredomain.",
++ strings.Repeat("a", 255),
++ strings.Repeat("a", 65) + ".com",
++ }
++ tmpl := &Certificate{
++ EmailAddresses: badNames,
++ DNSNames: badNames,
++ }
++ b, err := CreateCertificate(rand.Reader, tmpl, tmpl, &k.PublicKey, k)
++ if err != nil {
++ t.Fatal(err)
++ }
++ _, err = ParseCertificate(b)
++ if err != nil {
++ t.Fatalf("Couldn't roundtrip certificate: %v", err)
++ }
++}
++
++func FuzzDomainNameValid(f *testing.F) {
++ f.Fuzz(func(t *testing.T, data string) {
++ domainNameValid(data, false)
++ domainNameValid(data, true)
++ })
++}
+diff --git a/src/crypto/x509/verify.go b/src/crypto/x509/verify.go
+index fb2f4b2..99f38a0 100644
+--- a/src/crypto/x509/verify.go
++++ b/src/crypto/x509/verify.go
+@@ -390,7 +390,7 @@ func domainToReverseLabels(domain string) (reverseLabels []string, ok bool) {
+ return reverseLabels, true
+ }
+
+-func matchEmailConstraint(mailbox rfc2821Mailbox, constraint string) (bool, error) {
++func matchEmailConstraint(mailbox rfc2821Mailbox, constraint string, reversedDomainsCache map[string][]string, reversedConstraintsCache map[string][]string) (bool, error) {
+ // If the constraint contains an @, then it specifies an exact mailbox
+ // name.
+ if strings.Contains(constraint, "@") {
+@@ -403,10 +403,10 @@ func matchEmailConstraint(mailbox rfc2821Mailbox, constraint string) (bool, erro
+
+ // Otherwise the constraint is like a DNS constraint of the domain part
+ // of the mailbox.
+- return matchDomainConstraint(mailbox.domain, constraint)
++ return matchDomainConstraint(mailbox.domain, constraint, reversedDomainsCache, reversedConstraintsCache)
+ }
+
+-func matchURIConstraint(uri *url.URL, constraint string) (bool, error) {
++func matchURIConstraint(uri *url.URL, constraint string, reversedDomainsCache map[string][]string, reversedConstraintsCache map[string][]string) (bool, error) {
+ // From RFC 5280, Section 4.2.1.10:
+ // “a uniformResourceIdentifier that does not include an authority
+ // component with a host name specified as a fully qualified domain
+@@ -433,7 +433,7 @@ func matchURIConstraint(uri *url.URL, constraint string) (bool, error) {
+ return false, fmt.Errorf("URI with IP (%q) cannot be matched against constraints", uri.String())
+ }
+
+- return matchDomainConstraint(host, constraint)
++ return matchDomainConstraint(host, constraint, reversedDomainsCache, reversedConstraintsCache)
+ }
+
+ func matchIPConstraint(ip net.IP, constraint *net.IPNet) (bool, error) {
+@@ -450,16 +450,21 @@ func matchIPConstraint(ip net.IP, constraint *net.IPNet) (bool, error) {
+ return true, nil
+ }
+
+-func matchDomainConstraint(domain, constraint string) (bool, error) {
++func matchDomainConstraint(domain, constraint string, reversedDomainsCache map[string][]string, reversedConstraintsCache map[string][]string) (bool, error) {
+ // The meaning of zero length constraints is not specified, but this
+ // code follows NSS and accepts them as matching everything.
+ if len(constraint) == 0 {
+ return true, nil
+ }
+
+- domainLabels, ok := domainToReverseLabels(domain)
+- if !ok {
+- return false, fmt.Errorf("x509: internal error: cannot parse domain %q", domain)
++ domainLabels, found := reversedDomainsCache[domain]
++ if !found {
++ var ok bool
++ domainLabels, ok = domainToReverseLabels(domain)
++ if !ok {
++ return false, fmt.Errorf("x509: internal error: cannot parse domain %q", domain)
++ }
++ reversedDomainsCache[domain] = domainLabels
+ }
+
+ // RFC 5280 says that a leading period in a domain name means that at
+@@ -473,9 +478,14 @@ func matchDomainConstraint(domain, constraint string) (bool, error) {
+ constraint = constraint[1:]
+ }
+
+- constraintLabels, ok := domainToReverseLabels(constraint)
+- if !ok {
+- return false, fmt.Errorf("x509: internal error: cannot parse domain %q", constraint)
++ constraintLabels, found := reversedConstraintsCache[constraint]
++ if !found {
++ var ok bool
++ constraintLabels, ok = domainToReverseLabels(constraint)
++ if !ok {
++ return false, fmt.Errorf("x509: internal error: cannot parse domain %q", constraint)
++ }
++ reversedConstraintsCache[constraint] = constraintLabels
+ }
+
+ if len(domainLabels) < len(constraintLabels) ||
+@@ -598,6 +608,19 @@ func (c *Certificate) isValid(certType int, currentChain []*Certificate, opts *V
+ leaf = currentChain[0]
+ }
+
++ // Each time we do constraint checking, we need to check the constraints in
++ // the current certificate against all of the names that preceded it. We
++ // reverse these names using domainToReverseLabels, which is a relatively
++ // expensive operation. Since we check each name against each constraint,
++ // this requires us to do N*C calls to domainToReverseLabels (where N is the
++ // total number of names that preceed the certificate, and C is the total
++ // number of constraints in the certificate). By caching the results of
++ // calling domainToReverseLabels, we can reduce that to N+C calls at the
++ // cost of keeping all of the parsed names and constraints in memory until
++ // we return from isValid.
++ reversedDomainsCache := map[string][]string{}
++ reversedConstraintsCache := map[string][]string{}
++
+ if (certType == intermediateCertificate || certType == rootCertificate) &&
+ c.hasNameConstraints() && leaf.hasSANExtension() {
+ err := forEachSAN(leaf.getSANExtension(), func(tag int, data []byte) error {
+@@ -611,20 +634,20 @@ func (c *Certificate) isValid(certType int, currentChain []*Certificate, opts *V
+
+ if err := c.checkNameConstraints(&comparisonCount, maxConstraintComparisons, "email address", name, mailbox,
+ func(parsedName, constraint interface{}) (bool, error) {
+- return matchEmailConstraint(parsedName.(rfc2821Mailbox), constraint.(string))
++ return matchEmailConstraint(parsedName.(rfc2821Mailbox), constraint.(string), reversedDomainsCache, reversedConstraintsCache)
+ }, c.PermittedEmailAddresses, c.ExcludedEmailAddresses); err != nil {
+ return err
+ }
+
+ case nameTypeDNS:
+ name := string(data)
+- if _, ok := domainToReverseLabels(name); !ok {
++ if !domainNameValid(name, false) {
+ return fmt.Errorf("x509: cannot parse dnsName %q", name)
+ }
+
+ if err := c.checkNameConstraints(&comparisonCount, maxConstraintComparisons, "DNS name", name, name,
+ func(parsedName, constraint interface{}) (bool, error) {
+- return matchDomainConstraint(parsedName.(string), constraint.(string))
++ return matchDomainConstraint(parsedName.(string), constraint.(string), reversedDomainsCache, reversedConstraintsCache)
+ }, c.PermittedDNSDomains, c.ExcludedDNSDomains); err != nil {
+ return err
+ }
+@@ -638,7 +661,7 @@ func (c *Certificate) isValid(certType int, currentChain []*Certificate, opts *V
+
+ if err := c.checkNameConstraints(&comparisonCount, maxConstraintComparisons, "URI", name, uri,
+ func(parsedName, constraint interface{}) (bool, error) {
+- return matchURIConstraint(parsedName.(*url.URL), constraint.(string))
++ return matchURIConstraint(parsedName.(*url.URL), constraint.(string), reversedDomainsCache, reversedConstraintsCache)
+ }, c.PermittedURIDomains, c.ExcludedURIDomains); err != nil {
+ return err
+ }
+diff --git a/src/crypto/x509/verify_test.go b/src/crypto/x509/verify_test.go
+index 9da39ca..31e8149 100644
+--- a/src/crypto/x509/verify_test.go
++++ b/src/crypto/x509/verify_test.go
+@@ -1648,7 +1648,7 @@ var nameConstraintTests = []struct {
+
+ func TestNameConstraints(t *testing.T) {
+ for i, test := range nameConstraintTests {
+- result, err := matchDomainConstraint(test.domain, test.constraint)
++ result, err := matchDomainConstraint(test.domain, test.constraint, map[string][]string{}, map[string][]string{})
+
+ if err != nil && !test.expectError {
+ t.Errorf("unexpected error for test #%d: domain=%s, constraint=%s, err=%s", i, test.domain, test.constraint, err)
+--
+2.25.1
+
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 3/4] go: Fix CVE-2025-61727
2025-12-29 23:03 [OE-core][kirkstone 0/4] Patch review Steve Sakoman
2025-12-29 23:03 ` [OE-core][kirkstone 1/4] grub: fix CVE-2025-61661 CVE-2025-61662 CVE-2025-61663 CVE-2025-61664 Steve Sakoman
2025-12-29 23:03 ` [OE-core][kirkstone 2/4] go: Update CVE-2025-58187 Steve Sakoman
@ 2025-12-29 23:03 ` Steve Sakoman
2025-12-29 23:03 ` [OE-core][kirkstone 4/4] go: Fix CVE-2025-61729 Steve Sakoman
3 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-12-29 23:03 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport from https://github.com/golang/go/commit/04db77a423cac75bb82cc9a6859991ae9c016344
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/go/go-1.17.13.inc | 1 +
.../go/go-1.18/CVE-2025-61727.patch | 229 ++++++++++++++++++
2 files changed, 230 insertions(+)
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2025-61727.patch
diff --git a/meta/recipes-devtools/go/go-1.17.13.inc b/meta/recipes-devtools/go/go-1.17.13.inc
index 1433d54f06..0ea3b6704f 100644
--- a/meta/recipes-devtools/go/go-1.17.13.inc
+++ b/meta/recipes-devtools/go/go-1.17.13.inc
@@ -75,6 +75,7 @@ SRC_URI = "https://golang.org/dl/go${PV}.src.tar.gz;name=main \
file://CVE-2025-61723.patch \
file://CVE-2025-61724.patch \
file://CVE-2023-39323.patch \
+ file://CVE-2025-61727.patch \
"
SRC_URI[main.sha256sum] = "a1a48b23afb206f95e7bbaa9b898d965f90826f6f1d1fc0c1d784ada0cd300fd"
diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2025-61727.patch b/meta/recipes-devtools/go/go-1.18/CVE-2025-61727.patch
new file mode 100644
index 0000000000..23dc35b8b8
--- /dev/null
+++ b/meta/recipes-devtools/go/go-1.18/CVE-2025-61727.patch
@@ -0,0 +1,229 @@
+From 04db77a423cac75bb82cc9a6859991ae9c016344 Mon Sep 17 00:00:00 2001
+From: Roland Shoemaker <bracewell@google.com>
+Date: Mon, 24 Nov 2025 08:46:08 -0800
+Subject: [PATCH] [release-branch.go1.24] crypto/x509: excluded subdomain
+ constraints preclude wildcard SANs
+
+When evaluating name constraints in a certificate chain, the presence of
+an excluded subdomain constraint (e.g., excluding "test.example.com")
+should preclude the use of a wildcard SAN (e.g., "*.example.com").
+
+Fixes #76442
+Fixes #76463
+Fixes CVE-2025-61727
+
+Change-Id: I42a0da010cb36d2ec9d1239ae3f61cf25eb78bba
+Reviewed-on: https://go-review.googlesource.com/c/go/+/724401
+Reviewed-by: Nicholas Husin <husin@google.com>
+Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
+LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
+Reviewed-by: Nicholas Husin <nsh@golang.org>
+Reviewed-by: Neal Patel <nealpatel@google.com>
+
+Upstream-Status: Backport [https://github.com/golang/go/commit/04db77a423cac75bb82cc9a6859991ae9c016344]
+CVE: CVE-2025-61727
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ src/crypto/x509/name_constraints_test.go | 34 ++++++++++++++++++++
+ src/crypto/x509/verify.go | 40 +++++++++++++++---------
+ src/crypto/x509/verify_test.go | 2 +-
+ 3 files changed, 60 insertions(+), 16 deletions(-)
+
+diff --git a/src/crypto/x509/name_constraints_test.go b/src/crypto/x509/name_constraints_test.go
+index c59a7dc..963bc5a 100644
+--- a/src/crypto/x509/name_constraints_test.go
++++ b/src/crypto/x509/name_constraints_test.go
+@@ -1595,6 +1595,40 @@ var nameConstraintsTests = []nameConstraintsTest{
+ cn: "foo.bar",
+ },
+ },
++ // #87: subdomain excluded constraints preclude wildcard names
++ {
++ roots: []constraintsSpec{
++ {
++ bad: []string{"dns:foo.example.com"},
++ },
++ },
++ intermediates: [][]constraintsSpec{
++ {
++ {},
++ },
++ },
++ leaf: leafSpec{
++ sans: []string{"dns:*.example.com"},
++ },
++ expectedError: "\"*.example.com\" is excluded by constraint \"foo.example.com\"",
++ },
++ // #88: wildcard names are not matched by subdomain permitted constraints
++ {
++ roots: []constraintsSpec{
++ {
++ ok: []string{"dns:foo.example.com"},
++ },
++ },
++ intermediates: [][]constraintsSpec{
++ {
++ {},
++ },
++ },
++ leaf: leafSpec{
++ sans: []string{"dns:*.example.com"},
++ },
++ expectedError: "\"*.example.com\" is not permitted",
++ },
+ }
+
+ func makeConstraintsCACert(constraints constraintsSpec, name string, key *ecdsa.PrivateKey, parent *Certificate, parentKey *ecdsa.PrivateKey) (*Certificate, error) {
+diff --git a/src/crypto/x509/verify.go b/src/crypto/x509/verify.go
+index 99f38a0..88260ee 100644
+--- a/src/crypto/x509/verify.go
++++ b/src/crypto/x509/verify.go
+@@ -390,7 +390,7 @@ func domainToReverseLabels(domain string) (reverseLabels []string, ok bool) {
+ return reverseLabels, true
+ }
+
+-func matchEmailConstraint(mailbox rfc2821Mailbox, constraint string, reversedDomainsCache map[string][]string, reversedConstraintsCache map[string][]string) (bool, error) {
++func matchEmailConstraint(mailbox rfc2821Mailbox, constraint string, excluded bool, reversedDomainsCache map[string][]string, reversedConstraintsCache map[string][]string) (bool, error) {
+ // If the constraint contains an @, then it specifies an exact mailbox
+ // name.
+ if strings.Contains(constraint, "@") {
+@@ -403,10 +403,10 @@ func matchEmailConstraint(mailbox rfc2821Mailbox, constraint string, reversedDom
+
+ // Otherwise the constraint is like a DNS constraint of the domain part
+ // of the mailbox.
+- return matchDomainConstraint(mailbox.domain, constraint, reversedDomainsCache, reversedConstraintsCache)
++ return matchDomainConstraint(mailbox.domain, constraint, excluded, reversedDomainsCache, reversedConstraintsCache)
+ }
+
+-func matchURIConstraint(uri *url.URL, constraint string, reversedDomainsCache map[string][]string, reversedConstraintsCache map[string][]string) (bool, error) {
++func matchURIConstraint(uri *url.URL, constraint string, excluded bool, reversedDomainsCache map[string][]string, reversedConstraintsCache map[string][]string) (bool, error) {
+ // From RFC 5280, Section 4.2.1.10:
+ // “a uniformResourceIdentifier that does not include an authority
+ // component with a host name specified as a fully qualified domain
+@@ -433,7 +433,7 @@ func matchURIConstraint(uri *url.URL, constraint string, reversedDomainsCache ma
+ return false, fmt.Errorf("URI with IP (%q) cannot be matched against constraints", uri.String())
+ }
+
+- return matchDomainConstraint(host, constraint, reversedDomainsCache, reversedConstraintsCache)
++ return matchDomainConstraint(host, constraint, excluded, reversedDomainsCache, reversedConstraintsCache)
+ }
+
+ func matchIPConstraint(ip net.IP, constraint *net.IPNet) (bool, error) {
+@@ -450,7 +450,7 @@ func matchIPConstraint(ip net.IP, constraint *net.IPNet) (bool, error) {
+ return true, nil
+ }
+
+-func matchDomainConstraint(domain, constraint string, reversedDomainsCache map[string][]string, reversedConstraintsCache map[string][]string) (bool, error) {
++func matchDomainConstraint(domain, constraint string, excluded bool, reversedDomainsCache map[string][]string, reversedConstraintsCache map[string][]string) (bool, error) {
+ // The meaning of zero length constraints is not specified, but this
+ // code follows NSS and accepts them as matching everything.
+ if len(constraint) == 0 {
+@@ -467,6 +467,11 @@ func matchDomainConstraint(domain, constraint string, reversedDomainsCache map[s
+ reversedDomainsCache[domain] = domainLabels
+ }
+
++ wildcardDomain := false
++ if len(domain) > 0 && domain[0] == '*' {
++ wildcardDomain = true
++ }
++
+ // RFC 5280 says that a leading period in a domain name means that at
+ // least one label must be prepended, but only for URI and email
+ // constraints, not DNS constraints. The code also supports that
+@@ -493,6 +498,11 @@ func matchDomainConstraint(domain, constraint string, reversedDomainsCache map[s
+ return false, nil
+ }
+
++ if excluded && wildcardDomain && len(domainLabels) > 1 && len(constraintLabels) > 0 {
++ domainLabels = domainLabels[:len(domainLabels)-1]
++ constraintLabels = constraintLabels[:len(constraintLabels)-1]
++ }
++
+ for i, constraintLabel := range constraintLabels {
+ if !strings.EqualFold(constraintLabel, domainLabels[i]) {
+ return false, nil
+@@ -512,7 +522,7 @@ func (c *Certificate) checkNameConstraints(count *int,
+ nameType string,
+ name string,
+ parsedName interface{},
+- match func(parsedName, constraint interface{}) (match bool, err error),
++ match func(parsedName, constraint interface{}, excluded bool) (match bool, err error),
+ permitted, excluded interface{}) error {
+
+ excludedValue := reflect.ValueOf(excluded)
+@@ -524,7 +534,7 @@ func (c *Certificate) checkNameConstraints(count *int,
+
+ for i := 0; i < excludedValue.Len(); i++ {
+ constraint := excludedValue.Index(i).Interface()
+- match, err := match(parsedName, constraint)
++ match, err := match(parsedName, constraint, true)
+ if err != nil {
+ return CertificateInvalidError{c, CANotAuthorizedForThisName, err.Error()}
+ }
+@@ -546,7 +556,7 @@ func (c *Certificate) checkNameConstraints(count *int,
+ constraint := permittedValue.Index(i).Interface()
+
+ var err error
+- if ok, err = match(parsedName, constraint); err != nil {
++ if ok, err = match(parsedName, constraint, false); err != nil {
+ return CertificateInvalidError{c, CANotAuthorizedForThisName, err.Error()}
+ }
+
+@@ -633,8 +643,8 @@ func (c *Certificate) isValid(certType int, currentChain []*Certificate, opts *V
+ }
+
+ if err := c.checkNameConstraints(&comparisonCount, maxConstraintComparisons, "email address", name, mailbox,
+- func(parsedName, constraint interface{}) (bool, error) {
+- return matchEmailConstraint(parsedName.(rfc2821Mailbox), constraint.(string), reversedDomainsCache, reversedConstraintsCache)
++ func(parsedName, constraint interface{}, excluded bool) (bool, error) {
++ return matchEmailConstraint(parsedName.(rfc2821Mailbox), constraint.(string), excluded, reversedDomainsCache, reversedConstraintsCache)
+ }, c.PermittedEmailAddresses, c.ExcludedEmailAddresses); err != nil {
+ return err
+ }
+@@ -646,8 +656,8 @@ func (c *Certificate) isValid(certType int, currentChain []*Certificate, opts *V
+ }
+
+ if err := c.checkNameConstraints(&comparisonCount, maxConstraintComparisons, "DNS name", name, name,
+- func(parsedName, constraint interface{}) (bool, error) {
+- return matchDomainConstraint(parsedName.(string), constraint.(string), reversedDomainsCache, reversedConstraintsCache)
++ func(parsedName, constraint interface{}, excluded bool) (bool, error) {
++ return matchDomainConstraint(parsedName.(string), constraint.(string), excluded, reversedDomainsCache, reversedConstraintsCache)
+ }, c.PermittedDNSDomains, c.ExcludedDNSDomains); err != nil {
+ return err
+ }
+@@ -660,8 +670,8 @@ func (c *Certificate) isValid(certType int, currentChain []*Certificate, opts *V
+ }
+
+ if err := c.checkNameConstraints(&comparisonCount, maxConstraintComparisons, "URI", name, uri,
+- func(parsedName, constraint interface{}) (bool, error) {
+- return matchURIConstraint(parsedName.(*url.URL), constraint.(string), reversedDomainsCache, reversedConstraintsCache)
++ func(parsedName, constraint interface{}, excluded bool) (bool, error) {
++ return matchURIConstraint(parsedName.(*url.URL), constraint.(string), excluded, reversedDomainsCache, reversedConstraintsCache)
+ }, c.PermittedURIDomains, c.ExcludedURIDomains); err != nil {
+ return err
+ }
+@@ -673,7 +683,7 @@ func (c *Certificate) isValid(certType int, currentChain []*Certificate, opts *V
+ }
+
+ if err := c.checkNameConstraints(&comparisonCount, maxConstraintComparisons, "IP address", ip.String(), ip,
+- func(parsedName, constraint interface{}) (bool, error) {
++ func(parsedName, constraint interface{}, _ bool) (bool, error) {
+ return matchIPConstraint(parsedName.(net.IP), constraint.(*net.IPNet))
+ }, c.PermittedIPRanges, c.ExcludedIPRanges); err != nil {
+ return err
+diff --git a/src/crypto/x509/verify_test.go b/src/crypto/x509/verify_test.go
+index 31e8149..5f7c834 100644
+--- a/src/crypto/x509/verify_test.go
++++ b/src/crypto/x509/verify_test.go
+@@ -1648,7 +1648,7 @@ var nameConstraintTests = []struct {
+
+ func TestNameConstraints(t *testing.T) {
+ for i, test := range nameConstraintTests {
+- result, err := matchDomainConstraint(test.domain, test.constraint, map[string][]string{}, map[string][]string{})
++ result, err := matchDomainConstraint(test.domain, test.constraint, false, map[string][]string{}, map[string][]string{})
+
+ if err != nil && !test.expectError {
+ t.Errorf("unexpected error for test #%d: domain=%s, constraint=%s, err=%s", i, test.domain, test.constraint, err)
+--
+2.25.1
+
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 4/4] go: Fix CVE-2025-61729
2025-12-29 23:03 [OE-core][kirkstone 0/4] Patch review Steve Sakoman
` (2 preceding siblings ...)
2025-12-29 23:03 ` [OE-core][kirkstone 3/4] go: Fix CVE-2025-61727 Steve Sakoman
@ 2025-12-29 23:03 ` Steve Sakoman
3 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-12-29 23:03 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport from https://github.com/golang/go/commit/3a842bd5c6aa8eefa13c0174de3ab361e50bd672
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/go/go-1.17.13.inc | 1 +
.../go/go-1.18/CVE-2025-61729.patch | 172 ++++++++++++++++++
2 files changed, 173 insertions(+)
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2025-61729.patch
diff --git a/meta/recipes-devtools/go/go-1.17.13.inc b/meta/recipes-devtools/go/go-1.17.13.inc
index 0ea3b6704f..e95003db96 100644
--- a/meta/recipes-devtools/go/go-1.17.13.inc
+++ b/meta/recipes-devtools/go/go-1.17.13.inc
@@ -76,6 +76,7 @@ SRC_URI = "https://golang.org/dl/go${PV}.src.tar.gz;name=main \
file://CVE-2025-61724.patch \
file://CVE-2023-39323.patch \
file://CVE-2025-61727.patch \
+ file://CVE-2025-61729.patch \
"
SRC_URI[main.sha256sum] = "a1a48b23afb206f95e7bbaa9b898d965f90826f6f1d1fc0c1d784ada0cd300fd"
diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2025-61729.patch b/meta/recipes-devtools/go/go-1.18/CVE-2025-61729.patch
new file mode 100644
index 0000000000..6fdc2fd426
--- /dev/null
+++ b/meta/recipes-devtools/go/go-1.18/CVE-2025-61729.patch
@@ -0,0 +1,172 @@
+From 3a842bd5c6aa8eefa13c0174de3ab361e50bd672 Mon Sep 17 00:00:00 2001
+From: "Nicholas S. Husin" <nsh@golang.org>
+Date: Mon, 24 Nov 2025 14:56:23 -0500
+Subject: [PATCH] [release-branch.go1.24] crypto/x509: prevent
+ HostnameError.Error() from consuming excessive resource
+
+Constructing HostnameError.Error() takes O(N^2) runtime due to using a
+string concatenation in a loop. Additionally, there is no limit on how
+many names are included in the error message. As a result, a malicious
+attacker could craft a certificate with an infinite amount of names to
+unfairly consume resource.
+
+To remediate this, we will now use strings.Builder to construct the
+error message, preventing O(N^2) runtime. When a certificate has 100 or
+more names, we will also not print each name individually.
+
+Thanks to Philippe Antoine (Catena cyber) for reporting this issue.
+
+Updates #76445
+Fixes #76460
+Fixes CVE-2025-61729
+
+Change-Id: I6343776ec3289577abc76dad71766c491c1a7c81
+Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3000
+Reviewed-by: Neal Patel <nealpatel@google.com>
+Reviewed-by: Damien Neil <dneil@google.com>
+Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3220
+Reviewed-by: Roland Shoemaker <bracewell@google.com>
+Reviewed-on: https://go-review.googlesource.com/c/go/+/725820
+Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
+TryBot-Bypass: Dmitri Shuralyov <dmitshur@golang.org>
+Auto-Submit: Dmitri Shuralyov <dmitshur@google.com>
+Reviewed-by: Mark Freeman <markfreeman@google.com>
+
+Upstream-Status: Backport [https://github.com/golang/go/commit/3a842bd5c6aa8eefa13c0174de3ab361e50bd672]
+CVE: CVE-2025-61729
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ src/crypto/x509/verify.go | 21 ++++++++++-----
+ src/crypto/x509/verify_test.go | 47 ++++++++++++++++++++++++++++++++++
+ 2 files changed, 61 insertions(+), 7 deletions(-)
+
+diff --git a/src/crypto/x509/verify.go b/src/crypto/x509/verify.go
+index 88260ee..c167191 100644
+--- a/src/crypto/x509/verify.go
++++ b/src/crypto/x509/verify.go
+@@ -97,31 +97,38 @@ type HostnameError struct {
+
+ func (h HostnameError) Error() string {
+ c := h.Certificate
++ maxNamesIncluded := 100
+
+ if !c.hasSANExtension() && matchHostnames(c.Subject.CommonName, h.Host) {
+ return "x509: certificate relies on legacy Common Name field, use SANs instead"
+ }
+
+- var valid string
++ var valid strings.Builder
+ if ip := net.ParseIP(h.Host); ip != nil {
+ // Trying to validate an IP
+ if len(c.IPAddresses) == 0 {
+ return "x509: cannot validate certificate for " + h.Host + " because it doesn't contain any IP SANs"
+ }
++ if len(c.IPAddresses) >= maxNamesIncluded {
++ return fmt.Sprintf("x509: certificate is valid for %d IP SANs, but none matched %s", len(c.IPAddresses), h.Host)
++ }
+ for _, san := range c.IPAddresses {
+- if len(valid) > 0 {
+- valid += ", "
++ if valid.Len() > 0 {
++ valid.WriteString(", ")
+ }
+- valid += san.String()
++ valid.WriteString(san.String())
+ }
+ } else {
+- valid = strings.Join(c.DNSNames, ", ")
++ if len(c.DNSNames) >= maxNamesIncluded {
++ return fmt.Sprintf("x509: certificate is valid for %d names, but none matched %s", len(c.DNSNames), h.Host)
++ }
++ valid.WriteString(strings.Join(c.DNSNames, ", "))
+ }
+
+- if len(valid) == 0 {
++ if valid.Len() == 0 {
+ return "x509: certificate is not valid for any names, but wanted to match " + h.Host
+ }
+- return "x509: certificate is valid for " + valid + ", not " + h.Host
++ return "x509: certificate is valid for " + valid.String() + ", not " + h.Host
+ }
+
+ // UnknownAuthorityError results when the certificate issuer is unknown
+diff --git a/src/crypto/x509/verify_test.go b/src/crypto/x509/verify_test.go
+index 5f7c834..c2c2025 100644
+--- a/src/crypto/x509/verify_test.go
++++ b/src/crypto/x509/verify_test.go
+@@ -9,11 +9,14 @@ import (
+ "crypto/ecdsa"
+ "crypto/elliptic"
+ "crypto/rand"
++ "crypto/rsa"
+ "crypto/x509/pkix"
+ "encoding/pem"
+ "errors"
+ "fmt"
++ "log"
+ "math/big"
++ "net"
+ "runtime"
+ "strings"
+ "testing"
+@@ -70,6 +73,26 @@ var verifyTests = []verifyTest{
+
+ errorCallback: expectHostnameError("certificate is valid for"),
+ },
++ {
++ name: "TooManyDNS",
++ leaf: generatePEMCertWithRepeatSAN(1677615892, 200, "fake.dns"),
++ roots: []string{generatePEMCertWithRepeatSAN(1677615892, 200, "fake.dns")},
++ currentTime: 1677615892,
++ dnsName: "www.example.com",
++ systemSkip: true, // does not chain to a system root
++
++ errorCallback: expectHostnameError("certificate is valid for 200 names, but none matched"),
++ },
++ {
++ name: "TooManyIPs",
++ leaf: generatePEMCertWithRepeatSAN(1677615892, 150, "4.3.2.1"),
++ roots: []string{generatePEMCertWithRepeatSAN(1677615892, 150, "4.3.2.1")},
++ currentTime: 1677615892,
++ dnsName: "1.2.3.4",
++ systemSkip: true, // does not chain to a system root
++
++ errorCallback: expectHostnameError("certificate is valid for 150 IP SANs, but none matched"),
++ },
+ {
+ name: "IPMissing",
+ leaf: googleLeaf,
+@@ -584,6 +607,30 @@ func nameToKey(name *pkix.Name) string {
+ return strings.Join(name.Country, ",") + "/" + strings.Join(name.Organization, ",") + "/" + strings.Join(name.OrganizationalUnit, ",") + "/" + name.CommonName
+ }
+
++func generatePEMCertWithRepeatSAN(currentTime int64, count int, san string) string {
++ cert := Certificate{
++ NotBefore: time.Unix(currentTime, 0),
++ NotAfter: time.Unix(currentTime, 0),
++ }
++ if ip := net.ParseIP(san); ip != nil {
++ cert.IPAddresses = slices.Repeat([]net.IP{ip}, count)
++ } else {
++ cert.DNSNames = slices.Repeat([]string{san}, count)
++ }
++ privKey, err := rsa.GenerateKey(rand.Reader, 4096)
++ if err != nil {
++ log.Fatal(err)
++ }
++ certBytes, err := CreateCertificate(rand.Reader, &cert, &cert, &privKey.PublicKey, privKey)
++ if err != nil {
++ log.Fatal(err)
++ }
++ return string(pem.EncodeToMemory(&pem.Block{
++ Type: "CERTIFICATE",
++ Bytes: certBytes,
++ }))
++}
++
+ const geoTrustRoot = `-----BEGIN CERTIFICATE-----
+ MIIDVDCCAjygAwIBAgIDAjRWMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT
+ MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i
+--
+2.25.1
+
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread
end of thread, other threads:[~2025-12-29 23:03 UTC | newest]
Thread overview: 14+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-12-29 23:03 [OE-core][kirkstone 0/4] Patch review Steve Sakoman
2025-12-29 23:03 ` [OE-core][kirkstone 1/4] grub: fix CVE-2025-61661 CVE-2025-61662 CVE-2025-61663 CVE-2025-61664 Steve Sakoman
2025-12-29 23:03 ` [OE-core][kirkstone 2/4] go: Update CVE-2025-58187 Steve Sakoman
2025-12-29 23:03 ` [OE-core][kirkstone 3/4] go: Fix CVE-2025-61727 Steve Sakoman
2025-12-29 23:03 ` [OE-core][kirkstone 4/4] go: Fix CVE-2025-61729 Steve Sakoman
-- strict thread matches above, loose matches on Subject: below --
2025-12-09 21:53 [OE-core][kirkstone 0/4] Patch review Steve Sakoman
2025-10-29 2:54 Steve Sakoman
2025-08-05 16:43 Steve Sakoman
2025-04-15 20:52 Steve Sakoman
2025-03-27 14:43 Steve Sakoman
2025-01-31 14:15 Steve Sakoman
2024-03-07 18:38 Steve Sakoman
2024-02-01 19:37 Steve Sakoman
2023-12-29 16:07 Steve Sakoman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox