Hello, On Wed Sep 9, 2026 at 3:35 PM CEST, Jakub Szczudlo (Nokia) wrote: > Backport patch to fix CVE-2026-42012. > > References: > https://nvd.nist.gov/vuln/detail/CVE-2026-42012 > > Upstream fix: > > https://gitlab.com/gnutls/gnutls/-/commit/8dcc6a1f48945997666ac9f10896819edd01a03b
> > Tested with ptest > Pre patches taken from upstream so CVE fix will land cleanly > > Signed-off-by: Jakub Szczudlo <[email protected]> > --- > .../gnutls/gnutls/CVE-2026-42012-pre1.patch | 70 ++++++++ > .../gnutls/gnutls/CVE-2026-42012-pre2.patch | 153 ++++++++++++++++++ > .../gnutls/gnutls/CVE-2026-42012.patch | 48 ++++++ > meta/recipes-support/gnutls/gnutls_3.8.12.bb | 3 + > 4 files changed, 274 insertions(+) > create mode 100644 > meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre1.patch > create mode 100644 > meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre2.patch > create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42012.patch > > diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre1.patch > b/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre1.patch > new file mode 100644 > index 0000000000..1149dafef2 > --- /dev/null > +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre1.patch Hello, While this patch does apply, it has some surprizing format (CVE-2026-42012.patch looks fine, though): > @@ -0,0 +1,70 @@ > +Backport of: > + ^ Why this "Backport of"? > +From 6133fb459b74a9dcfa2d0ff010a4e03c56822d39 Mon Sep 17 00:00:00 2001 > +From: Alexander Sosedkin <[email protected]> > +Date: Fri, 13 Mar 2026 17:00:03 +0100 > +Subject: [PATCH] x509/hostname-verify: refactor and simplify CN fallback > logic > + > +Signed-off-by: Alexander Sosedkin <[email protected]> > +CVE: CVE-2026-42012 > +Upstream-Status: Backport > [https://gitlab.com/gnutls/gnutls/-/commit/6133fb459b74a9dcfa2d0ff010a4e03c56822d39] > + > +Signed-off-by: Jakub Szczudlo <[email protected]> > +--- > + lib/x509/hostname-verify.c | 15 ++++++--------- > + 1 file changed, 6 insertions(+), 9 deletions(-) > + Very minor thing but here we usualy have a "diff ..." line > +--- a/lib/x509/hostname-verify.c > ++++ b/lib/x509/hostname-verify.c > +@@ -108,7 +108,7 @@ unsigned gnutls_x509_crt_check_ip(gnutls > + * that we do not fallback to CN-ID if we encounter a supported name > + * type. > + */ > +-#define IS_SAN_SUPPORTED(san) \ > ++#define PRECLUDES_CN_FALLBACK(san) \ > + (san == GNUTLS_SAN_DNSNAME || san == GNUTLS_SAN_IPADDRESS) > + > + /** > +@@ -151,13 +151,12 @@ unsigned gnutls_x509_crt_check_hostname2 > + { > + char dnsname[MAX_CN]; > + size_t dnsnamesize; > +- int found_dnsname = 0; > + int ret = 0; > + int i = 0; > + struct in_addr ipv4; > + char *p = NULL; > + char *a_hostname; > +- unsigned have_other_addresses = 0; > ++ bool cn_fallback_allowed = true; > + gnutls_datum_t out; > + > + /* check whether @hostname is an ip address */ > +@@ -213,9 +212,10 @@ hostname_fallback: > + ret = gnutls_x509_crt_get_subject_alt_name(cert, i, dnsname, > + &dnsnamesize, NULL); > + > +- if (ret == GNUTLS_SAN_DNSNAME) { > +- found_dnsname = 1; > ++ if (PRECLUDES_CN_FALLBACK(ret)) > ++ cn_fallback_allowed = false; > + > ++ if (ret == GNUTLS_SAN_DNSNAME) { > + if (memchr(dnsname, '\0', dnsnamesize)) { > + _gnutls_debug_log( > + "certificate has %s with embedded null > in name\n", > +@@ -236,13 +236,10 @@ hostname_fallback: > + ret = 1; > + goto cleanup; > + } > +- } else { > +- if (IS_SAN_SUPPORTED(ret)) > +- have_other_addresses = 1; > + } > + } > + > +- if (!have_other_addresses && !found_dnsname && > ++ if (cn_fallback_allowed && > + _gnutls_check_key_purpose(cert, GNUTLS_KP_TLS_WWW_SERVER, 0) != 0) { > + /* did not get the necessary extension, use CN instead, if the > + * certificate would have been acceptable for a TLS WWW server > purpose. > diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre2.patch > b/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre2.patch > new file mode 100644 > index 0000000000..c192a144c0 > --- /dev/null > +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre2.patch > @@ -0,0 +1,153 @@ > +Backport of: > + > +From 5cc003b9688378f6c7934b1df0aa147e80006be4 Mon Sep 17 00:00:00 2001 > +From: Alexander Sosedkin <[email protected]> > +Date: Fri, 13 Mar 2026 17:41:33 +0100 > +Subject: [PATCH] x509: add bare-bones awareness of SRV virtual SAN > + > +There's no support for constraints, no certtool support, no nothing. > +Just added what's easy to add because I needed a virtual SAN for them. > + > +Signed-off-by: Alexander Sosedkin <[email protected]> > +CVE: CVE-2026-42012 > +Upstream-Status: Backport > [https://gitlab.com/gnutls/gnutls/-/commit/5cc003b9688378f6c7934b1df0aa147e80006be4] > + > +Signed-off-by: Jakub Szczudlo <[email protected]> > +--- > + lib/includes/gnutls/gnutls.h.in | 4 +++- > + lib/x509/common.h | 1 + > + lib/x509/name_constraints.c | 3 ++- > + lib/x509/output.c | 6 ++++++ > + lib/x509/virt-san.c | 23 +++++++++++++++++++++++ > + lib/x509/x509.c | 3 ++- > + 6 files changed, 37 insertions(+), 3 deletions(-) > + > +--- a/lib/includes/gnutls/gnutls.h.in > ++++ b/lib/includes/gnutls/gnutls.h.in > +@@ -2698,6 +2698,7 @@ void gnutls_psk_set_server_params_functi > + * @GNUTLS_SAN_OTHERNAME_XMPP: Virtual SAN, used by certain functions for > convenience. > + * @GNUTLS_SAN_OTHERNAME_KRB5PRINCIPAL: Virtual SAN, used by certain > functions for convenience. > + * @GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL: Virtual SAN, used by certain > functions for convenience. > ++ * @GNUTLS_SAN_OTHERNAME_SRV: Virtual SAN, used by certain functions for > convenience. > + * > + * Enumeration of different subject alternative names types. > + */ > +@@ -2715,7 +2716,8 @@ typedef enum gnutls_x509_subject_alt_nam > + Used by gnutls_x509_crt_get_subject_alt_othername_oid. */ > + GNUTLS_SAN_OTHERNAME_XMPP = 1000, > + GNUTLS_SAN_OTHERNAME_KRB5PRINCIPAL, > +- GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL > ++ GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL, > ++ GNUTLS_SAN_OTHERNAME_SRV > + } gnutls_x509_subject_alt_name_t; > + > + struct gnutls_openpgp_crt_int; > +--- a/lib/x509/common.h > ++++ b/lib/x509/common.h > +@@ -107,6 +107,7 @@ > + #define XMPP_OID "1.3.6.1.5.5.7.8.5" > + #define KRB5_PRINCIPAL_OID "1.3.6.1.5.2.2" > + #define MSUSER_PRINCIPAL_NAME_OID "1.3.6.1.4.1.311.20.2.3" > ++#define SRV_OID "1.3.6.1.5.5.7.8.7" > + #define PKIX1_RSA_PSS_MGF1_OID "1.2.840.113549.1.1.8" > + #define PKIX1_RSA_OAEP_P_SPECIFIED_OID "1.9" > + > +--- a/lib/x509/name_constraints.c > ++++ b/lib/x509/name_constraints.c > +@@ -516,7 +516,8 @@ static int validate_name_constraints_nod > + if (type != GNUTLS_SAN_DNSNAME && type != GNUTLS_SAN_RFC822NAME && > + type != GNUTLS_SAN_DN && type != GNUTLS_SAN_URI && > + type != GNUTLS_SAN_IPADDRESS && > +- type != GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL) { > ++ type != GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL && > ++ type != GNUTLS_SAN_OTHERNAME_SRV) { > + return gnutls_assert_val(GNUTLS_E_X509_UNKNOWN_SAN); > + } > + > +--- a/lib/x509/output.c > ++++ b/lib/x509/output.c > +@@ -121,6 +121,7 @@ static void print_name(gnutls_buffer_st > + if ((type == GNUTLS_SAN_DNSNAME || type == GNUTLS_SAN_OTHERNAME_XMPP || > + type == GNUTLS_SAN_OTHERNAME_KRB5PRINCIPAL || > + type == GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL || > ++ type == GNUTLS_SAN_OTHERNAME_SRV || > + type == GNUTLS_SAN_RFC822NAME || type == GNUTLS_SAN_URI) && > + sname != NULL && strlen(sname) != name->size) { > + adds(str, _("warning: SAN contains an embedded NUL, " > +@@ -180,6 +181,11 @@ static void print_name(gnutls_buffer_st > + name->size, NON_NULL(name->data)); > + break; > + > ++ case GNUTLS_SAN_OTHERNAME_SRV: > ++ addf(str, _("%sSRVName: %.*s\n"), prefix, name->size, > ++ NON_NULL(name->data)); > ++ break; > ++ > + default: > + addf(str, _("%sUnknown name: "), prefix); > + _gnutls_buffer_hexprint(str, name->data, name->size); > +--- a/lib/x509/virt-san.c > ++++ b/lib/x509/virt-san.c > +@@ -45,6 +45,9 @@ static int san_othername_to_virtual(cons > + memcmp(oid, MSUSER_PRINCIPAL_NAME_OID, > + sizeof(MSUSER_PRINCIPAL_NAME_OID) - 1) == 0) > + return GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL; > ++ else if ((unsigned)size == (sizeof(SRV_OID) - 1) && > ++ memcmp(oid, SRV_OID, sizeof(SRV_OID) - 1) == 0) > ++ return GNUTLS_SAN_OTHERNAME_SRV; > + } > + > + return GNUTLS_SAN_OTHERNAME; > +@@ -59,6 +62,8 @@ static const char *virtual_to_othername_ > + return KRB5_PRINCIPAL_OID; > + case GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL: > + return MSUSER_PRINCIPAL_NAME_OID; > ++ case GNUTLS_SAN_OTHERNAME_SRV: > ++ return SRV_OID; > + default: > + return NULL; > + } > +@@ -126,6 +131,15 @@ int _gnutls_alt_name_assign_virt_type(st > + name->type = GNUTLS_SAN_OTHERNAME; > + break; > + > ++ case GNUTLS_SAN_OTHERNAME_SRV: > ++ ret = _gnutls_x509_encode_string(ASN1_ETYPE_IA5_STRING, > ++ san->data, san->size, > ++ &encoded); > ++ if (ret < 0) > ++ return gnutls_assert_val(ret); > ++ name->san = _gnutls_steal_datum(&encoded); ^ This function call is not the same as upstream's patch. Please document any non-trivial change in the patch file (just after your signed-off-by). Can you please send a v2 with the above fixed. The format "issues" are minor and mainly an issue for me : I compare upstream patches with the sent one and any format change creates noise. Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245864): https://lists.openembedded.org/g/openembedded-core/message/245864 Mute This Topic: https://lists.openembedded.org/mt/121162215/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
