Hi, Simon Thank you so much for working on this update.
El 06/11/26 a las 12:34, Simon Quigley escribió: > Hello, > > I've prepared srt 1.5.1-1+deb12u2 for bookworm-security, and it's ready for > review. > > DSA-6450-1 shipped this fix in srt 1.5.4-1+deb13u1 in Trixie, and srt 1.5.7-1 > in Sid is past the upstream 1.5.6 release that contains it. The debdiff > against 1.5.1-1+deb12u1 is attached, and so is the draft DLA. > > - CVE-2026-55868: > https://github.com/Haivision/srt/security/advisories/GHSA-4mc6-qmpp-g7gw > - CVE-2026-55869: > https://github.com/Haivision/srt/security/advisories/GHSA-6xg9-784j-24rm > > The upload builds both the OpenSSL library and the GnuTLS library from the > same patches. Each one exports one extra C++ logging helper that a new log > line pulled in. The srt_* entry points match libsrt 1.5.1-1+deb12u1. > > For testing, I built this in a Bookworm schroot. > > On 1.5.1-1+deb12u1, an oversized keying-material request (KMREQ) and an > oversized keying-material response (KMRSP) write past the stack buffer in the > host-to-network copy (HtoNLA). AddressSanitizer reports that as a > stack-buffer-overflow. A forged KMREQ on a socket that is already secured > moves it to NOSECRET (no secret is available for the keying material), so the > next payload comes back as garbage. > > On 1.5.1-1+deb12u2, those control packets are rejected and the socket stays > secured. A clear data packet is counted and dropped, and the encrypted > payload after it still arrives. > > srt-file-transmit copied a 128 KiB file in the clear, and again with a > passphrase, on both the OpenSSL build and the GnuTLS build. The bytes matched. > > ffmpeg 7:5.1.9-0+deb12u1 and gstreamer1.0-plugins-bad 1.22.0-4+deb12u8 were > linked to the patched GnuTLS library and carried media over Secure Reliable > Transport (SRT). vlc-plugin-access-extra 3.0.24-0+deb12u1 loaded that same > library, and a listener with a passphrase rejected an unencrypted caller. > > The sbuild test suite passed 216 tests on the OpenSSL build and 216 tests on > the GnuTLS build. > > The programs I ran were srt-file-transmit, ffmpeg, GStreamer, and VLC's SRT > plugin. obs-studio 29.0.2+dfsg-1 links libsrt1.5-openssl, and nageru 2.2.1 > links libsrt1.5-gnutls. > > Here is my Salsa fork: > https://salsa.debian.org/tsimonq2/libsrt/-/tree/bookworm > > Here is the Debusine work request: > https://debusine.debian.net/debian/developers/work-request/1589404/ > > Feedback is welcome. If nothing showstopping comes up, I'll upload this and > issue the DLA on Tuesday afternoon (November 10th, 2026). > > Best regards, > Simon Quigley > [email protected] > ------------------------------------------------------------------------- > Debian LTS Advisory DLA-XXXX-1 [email protected] > https://www.debian.org/lts/security/ Simon Quigley > November 10, 2026 https://wiki.debian.org/LTS > ------------------------------------------------------------------------- > > Package : srt > Version : 1.5.1-1+deb12u2 > CVE ID : CVE-2026-55868 CVE-2026-55869 > > srt is a latency-aware UDP streaming library. Programs that send or > receive live video over the Secure Reliable Transport (SRT) protocol > use it. > > A remote attacker who can reach an SRT socket can crash the process > using that socket. When the socket is carrying an encrypted stream, > that attacker can also make the receiver accept clear packets, so the > live stream can be replaced or interrupted. > > CVE-2026-55868 > > A keying-material request (KMREQ) that failed to install a key > moved an already secured receiver into a failed encryption state. > A clear data packet was then stored for playback. > > CVE-2026-55869 > > A KMREQ or keying-material response (KMRSP) control packet was > copied into a fixed-size stack buffer using the length carried in > the packet. An oversized packet writes past the end of that buffer. > > For Debian 12 bookworm, these problems have been fixed in version > 1.5.1-1+deb12u2. > > We recommend that you upgrade your srt packages. > > For the detailed security status of srt please refer to > its security tracker page at: > https://security-tracker.debian.org/tracker/srt > > Further information about Debian LTS security advisories, how to apply > these updates to your system, and frequently asked questions can be > found at: https://wiki.debian.org/LTS > diff -Nru srt-1.5.1/debian/changelog srt-1.5.1/debian/changelog > --- srt-1.5.1/debian/changelog 2024-11-08 08:09:06.000000000 -0600 > +++ srt-1.5.1/debian/changelog 2026-11-06 09:52:27.000000000 -0600 > @@ -1,3 +1,11 @@ > +srt (1.5.1-1+deb12u2) bookworm-security; urgency=high > + > + * Non-maintainer upload by the LTS Team. > + * CVE-2026-55869: Reject an oversized KMREQ or KMRSP before the stack copy. > + * CVE-2026-55868: Ignore a forged key refresh on a secured session. > + > + -- Simon Quigley <[email protected]> Fri, 06 Nov 2026 09:52:27 -0600 > + > srt (1.5.1-1+deb12u1) bookworm; urgency=medium > > * [1e9db13] d/control: correct hard dependencies for dev packages. > diff -Nru srt-1.5.1/debian/patches/CVE-2026-55868-d17cc7b4.patch > srt-1.5.1/debian/patches/CVE-2026-55868-d17cc7b4.patch > --- srt-1.5.1/debian/patches/CVE-2026-55868-d17cc7b4.patch 1969-12-31 > 18:00:00.000000000 -0600 > +++ srt-1.5.1/debian/patches/CVE-2026-55868-d17cc7b4.patch 2026-11-06 > 09:52:27.000000000 -0600 > @@ -0,0 +1,304 @@ > +Origin: > https://github.com/Haivision/srt/commit/d17cc7b4dbe4658eb3ac71c7eec3c71780553250 Very small nitpick (for next update): according to dep-3, the origin field should include the "backport" tag: Origin: backport, https://github.com/Haivision/srt/commit/d17cc7b4dbe4658eb3ac71c7eec3c71780553250 (and maybe, to make it more clear, list the other commits as well) > +Reviewed-by: Simon Quigley <[email protected]> > +Last-Update: 2026-11-05 > + > +Backported to 1.5.1. Net of d17cc7b4, > +e02c8b0785e2771103003fa16fe8a2033ff19605 (restore the previous KEK > +when unwrap fails), 80d7f419360e5ec620f77da43c9333daacfd4df5 (one > +failure state), and 78e7e144bb49b70fc1c20b44e9aa1f5705919e3e (a failed > +refresh sends no KMRSP). 15a7c6f79af572b84740745339deb0cfbd881c58 > +removed a key-index check that d17cc7b4 had added; that check is not > +included. 1.5.1 has no AES-GCM. > + [snip] > diff -Nru srt-1.5.1/debian/patches/CVE-2026-55869-e020c3bb.patch > srt-1.5.1/debian/patches/CVE-2026-55869-e020c3bb.patch > --- srt-1.5.1/debian/patches/CVE-2026-55869-e020c3bb.patch 1969-12-31 > 18:00:00.000000000 -0600 > +++ srt-1.5.1/debian/patches/CVE-2026-55869-e020c3bb.patch 2026-11-06 > 09:52:27.000000000 -0600 > @@ -0,0 +1,31 @@ > +Origin: > https://github.com/Haivision/srt/commit/e020c3bb8e04e204b36f9fb56cdcbb6756cd0d28 AFAICS, these changes were not included into trixie. Do you know why? > +Reviewed-by: Simon Quigley <[email protected]> > +Last-Update: 2026-11-05 > + > +Backported to 1.5.1. The check rejects the KMREQ before HtoNLA copies it > +into the caller's fixed stack buffer. > + > +From e020c3bb8e04e204b36f9fb56cdcbb6756cd0d28 Mon Sep 17 00:00:00 2001 > +From: =?UTF-8?q?Cl=C3=A9ment=20G=C3=A9rouville?= <[email protected]> > +Date: Thu, 25 Jun 2026 17:22:30 +0200 > +Subject: [PATCH] Fix KMREQ buffer overflow at the right place. > + > + > +diff --git a/srtcore/crypto.cpp b/srtcore/crypto.cpp > +index 4740102..8703d0b 100644 > +--- a/srtcore/crypto.cpp > ++++ b/srtcore/crypto.cpp > +@@ -131,6 +131,13 @@ int srt::CCryptoControl::processSrtMsg_KMREQ( > + * Re-swap to cancel it. > + */ > + #ifdef SRT_ENABLE_ENCRYPTION > ++ // Reject before HtoNLA. The caller passes a stack buffer of > SRTDATA_MAXSIZE > ++ // words (processSrtMsg), and an oversized or misaligned KMREQ writes > past it. > ++ if (bytelen % sizeof(uint32_t) != 0 || bytelen > HCRYPT_MSG_KM_MAX_SZ) > ++ { > ++ LOGC(cnlog.Error, log << "processSrtMsg_KMREQ: size of the KM (" << > bytelen << ") is too high, must be < " << HCRYPT_MSG_KM_MAX_SZ); > ++ return SRT_CMD_NONE; > ++ } > + w_srtlen = bytelen/sizeof(srtdata[SRT_KMR_KMSTATE]); > + HtoNLA((pw_srtdata_out), srtdata, w_srtlen); > + unsigned char* kmdata = reinterpret_cast<unsigned > char*>(pw_srtdata_out); > diff -Nru srt-1.5.1/debian/patches/series srt-1.5.1/debian/patches/series > --- srt-1.5.1/debian/patches/series 2022-07-02 04:10:44.000000000 -0500 > +++ srt-1.5.1/debian/patches/series 2026-11-06 09:52:27.000000000 -0600 > @@ -1,2 +1,5 @@ > 001-multiarch-rpath.patch > test_failures.patch > +CVE-2026-55869-05708112.patch > +CVE-2026-55869-e020c3bb.patch > +CVE-2026-55868-d17cc7b4.patch Thanks, -- Santiago
