mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-09 07:51:59 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/libspdm: add patches for security issues fixed in libspdm 3.8.2

Browse Source 
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 80898249b7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Titouan Christophe
2026-04-29 16:11:29 +02:00
committed by Thomas Perale
parent d64056cc50
commit 89be84d22e
2 changed files with 94 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
package/libspdm/0002-Fix-security-vulnerability-in-GET_CSR-parsing-code.patch Normal file
View File

@@ -0,0 +1,65 @@
From 704bc9916ccd8c034f912f13b75fd890a19eb3f3 Mon Sep 17 00:00:00 2001
From: Steven Bellock <sbellock@nvidia.com>
Date: Tue, 27 Jan 2026 12:02:37 -0800
Subject: [PATCH] Fix security vulnerability in GET_CSR parsing code
Signed-off-by: Steven Bellock <sbellock@nvidia.com>
Co-Authored-By: Nicholas Carlini <nicholas@carlini.com>
Fixes: https://github.com/DMTF/libspdm/security/advisories/GHSA-j54w-759w-xj3m
Upstream: https://github.com/DMTF/libspdm/commit/704bc9916ccd8c034f912f13b75fd890a19eb3f3
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
---
os_stub/cryptlib_mbedtls/pk/x509.c | 25 +++++++++++++------------
1 file changed, 13 insertions(+), 12 deletions(-)
diff --git a/os_stub/cryptlib_mbedtls/pk/x509.c b/os_stub/cryptlib_mbedtls/pk/x509.c
index 65eff62bfd5..1b5d60d4f92 100644
--- a/os_stub/cryptlib_mbedtls/pk/x509.c
+++ b/os_stub/cryptlib_mbedtls/pk/x509.c
@@ -1768,6 +1768,19 @@ static bool libspdm_convert_subject_to_string(uint8_t *ptr, size_t obj_len,
(libspdm_consttime_is_mem_equal(cur->oid, internal_p, obj_len))) {
/*Concat subject string*/
+ /*move to string*/
+ internal_p += obj_len;
+ ret = libspdm_asn1_get_tag(&internal_p, end, &obj_len, cur->default_tag);
+ if (!ret) {
+ return false;
+ }
+
+ /*check total space needed: name + '=' + value + ',' + '\0'*/
+ if (buff_len < (int32_t)(cur->name_len + 1 + obj_len + 1 + 1)) {
+ LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO,"the buffer is too small"));
+ return false;
+ }
+
/*for example: CN=*/
libspdm_copy_mem(buffer, buff_len, cur->name, cur->name_len);
buff_len = (int32_t)(buff_len - cur->name_len);
@@ -1776,13 +1789,6 @@ static bool libspdm_convert_subject_to_string(uint8_t *ptr, size_t obj_len,
buff_len--;
buffer++;
- /*move to string*/
- internal_p += obj_len;
- ret = libspdm_asn1_get_tag(&internal_p, end, &obj_len, cur->default_tag);
- if (!ret) {
- return false;
- }
-
/*for example: AU,*/
libspdm_copy_mem(buffer, buff_len, internal_p, obj_len);
buff_len = (int32_t)(buff_len - obj_len);
@@ -1790,11 +1796,6 @@ static bool libspdm_convert_subject_to_string(uint8_t *ptr, size_t obj_len,
*buffer = ',';
buff_len--;
buffer++;
-
- if (buff_len < 0) {
- LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO,"the buffer is too small"));
- return false;
- }
break;
}
}

29
package/libspdm/0003-Update-libspdm_rsp_measurement_extension_log.patch Normal file
View File

@@ -0,0 +1,29 @@
From f55cf6d48ec69b4ac60a63903e9c6a2cb0fd155d Mon Sep 17 00:00:00 2001
From: Steven Bellock <sbellock@nvidia.com>
Date: Fri, 3 Apr 2026 11:00:07 -0700
Subject: [PATCH] Update libspdm_rsp_measurement_extension_log.c
Fix #3584 in 3.8.
Signed-off-by: Steven Bellock <sbellock@nvidia.com>
Fixes: https://github.com/DMTF/libspdm/security/advisories/GHSA-m4wc-xmvg-369f
Upstream: https://github.com/DMTF/libspdm/commit/f55cf6d48ec69b4ac60a63903e9c6a2cb0fd155d
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
---
.../spdm_responder_lib/libspdm_rsp_measurement_extension_log.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/library/spdm_responder_lib/libspdm_rsp_measurement_extension_log.c b/library/spdm_responder_lib/libspdm_rsp_measurement_extension_log.c
index 6dcb3a54bac..c5f2efa8c88 100644
--- a/library/spdm_responder_lib/libspdm_rsp_measurement_extension_log.c
+++ b/library/spdm_responder_lib/libspdm_rsp_measurement_extension_log.c
@@ -125,7 +125,7 @@ libspdm_return_t libspdm_get_response_measurement_extension_log(libspdm_context_
response_size, response);
}
- if ((uint64_t)(offset + length) > spdm_mel_len) {
+ if (((uint64_t)offset + length) > spdm_mel_len) {
length = (uint32_t)(spdm_mel_len - offset);
}
remainder_length = spdm_mel_len - (length + offset);