mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-25 19:40:35 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/swupdate: add upstream patch for CVE-2026-28525

Browse Source 
- CVE-2026-28525:
    SWUpdate contains an integer underflow vulnerability in the multipart
    upload parser in mongoose_multipart.c that allows unauthenticated
    attackers to cause a denial of service by sending a crafted HTTP POST
    request to /upload with a malformed multipart boundary and controlled
    TCP stream timing. Attackers can trigger an integer underflow in the
    mg_http_multipart_continue_wait_for_chunk() function when the buffer
    length falls within a specific range, causing an out-of-bounds heap
    read past the allocated receive buffer to a local IPC socket.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-28525
  - beee2dc0fe

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
(cherry picked from commit 0c6595aaac)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Thomas Perale
2026-06-25 16:12:31 +02:00
parent 456b26cdf4
commit acea9f4703
2 changed files with 54 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
package/swupdate/0002-CVE-2026-28525.patch Normal file
View File

@@ -0,0 +1,51 @@
From beee2dc0feef1cfe84f1aa6fc980e104b2e47a74 Mon Sep 17 00:00:00 2001
From: Stefano Babic <stefano.babic@swupdate.org>
Date: Thu, 19 Mar 2026 10:50:13 +0100
Subject: [PATCH] mongoose: Integer Underflow in Multipart Upload Parser
The function mg_http_multipart_continue_wait_for_chunk() has
a discrepancy between its guard condition and a subsequent
subtraction in the else branch. The guard at line 250 checks
`(int) io->len < mp_stream->boundary.len + 6`, allowing execution
to continue when io->len >= boundary.len + 6.
However, when mg_strstr() finds the boundary string in the
buffer (else branch at line 264), data_len is computed as
`io->len - (mp_stream->boundary.len + 8)`. The +6 vs +8
mismatch means that when io->len is in the range [boundary.len + 6,
boundary.len + 7], the subtraction underflows the size_t
variable to SIZE_MAX or SIZE_MAX - 1.
This will fix CVE-2026-28525.
Description of issue copied from vulnerability report - many thanks to
Kazuma for his analyses.
Signed-off-by: Stefano Babic <stefano.babic@swupdate.org>
Reported by: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc."
Upstream: https://github.com/sbabic/swupdate/commit/beee2dc0feef1cfe84f1aa6fc980e104b2e47a74
CVE: CVE-2026-28525
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
mongoose/mongoose_multipart.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/mongoose/mongoose_multipart.c b/mongoose/mongoose_multipart.c
index 12ea54348..7fdc18632 100644
--- a/mongoose/mongoose_multipart.c
+++ b/mongoose/mongoose_multipart.c
@@ -260,12 +260,12 @@ static int mg_http_multipart_continue_wait_for_chunk(struct mg_connection *c) {
}
return 0;
} else {
- size_t data_len = io->len - (mp_stream->boundary.len + 8);
+ size_t data_len = io->len - (mp_stream->boundary.len + 6);
size_t consumed = mg_http_multipart_call_handler(c, MG_EV_HTTP_PART_DATA,
- (char *) io->buf, data_len);
+ (char *) io->buf, data_len);
mg_iobuf_del(io, 0, consumed);
if (consumed == data_len) {
- mg_iobuf_del(io, 0, mp_stream->boundary.len + 8);
+ mg_iobuf_del(io, 0, mp_stream->boundary.len + 6);
mp_stream->state = MPS_FINALIZE;
return 1;
} else {

3
package/swupdate/swupdate.mk
View File

@@ -20,6 +20,9 @@ SWUPDATE_LICENSE_FILES = LICENSES/BSD-1-Clause.txt \
SWUPDATE_INSTALL_STAGING = YES
SWUPDATE_DEPENDENCIES = json-c libubootenv
# 0002-CVE-2026-28525.patch
SWUPDATE_IGNORE_CVES += CVE-2026-28525
# swupdate uses $CROSS-cc instead of $CROSS-gcc, which is not
# available in all external toolchains, and use CC for linking. Ensure
# TARGET_CC is used for both.