On 2026-07-13 Jonathan Wiltshire <[email protected]> wrote: > Control: tag -1 confirmed
> Hi, > d-i ack needed for the udeb but as far as I'm concerned please go ahead. I would like to amend this and add the fix for CVE-2026-24882, too. cu Andreas
diff --git a/debian/changelog b/debian/changelog index 786180728..bee79ca42 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,14 @@ +gnupg2 (2.4.7-21+deb13u2) trixie; urgency=medium + + * Fix CVE-2026-57062. + CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through + 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is + supposed to be 12 bytes but 4 bytes is accepted. + * Fix CVE-2026-24882: Stack-based buffer overflow in tpm2daemon during + handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. + + -- Andreas Metzler <[email protected]> Sat, 15 Aug 2026 13:40:37 +0200 + gnupg2 (2.4.7-21+deb13u1) trixie; urgency=high * Avoid potential downgrade to SHA1 in 3rd party key signatures. diff --git a/debian/patches/freepg/0050-tpm-Fix-possible-buffer-overflow-in-PKDECRYPT.patch b/debian/patches/freepg/0050-tpm-Fix-possible-buffer-overflow-in-PKDECRYPT.patch new file mode 100644 index 000000000..dc952def2 --- /dev/null +++ b/debian/patches/freepg/0050-tpm-Fix-possible-buffer-overflow-in-PKDECRYPT.patch @@ -0,0 +1,65 @@ +From 01c130031806010f4c563694501e8739f1580228 Mon Sep 17 00:00:00 2001 +From: Werner Koch <[email protected]> +Date: Mon, 26 Jan 2026 11:13:44 +0100 +Subject: tpm: Fix possible buffer overflow in PKDECRYPT + +* tpm2d/tpm2.c (tpm2_ecc_decrypt): Bail out on too long CIPHERTEXT. +(tpm2_rsa_decrypt): Ditto. +-- + +Cherry pick master commit of: + 93fa34d9a346020355cd51d54102d30d4f177323 + +GnuPG-bug-id: 8045 +Co-authored-by: NIIBE Yutaka <[email protected]> +Reported-by: OpenAI Security Research +--- + tpm2d/tpm2.c | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/tpm2d/tpm2.c b/tpm2d/tpm2.c +index 3e908ddb1..cd0347c6e 100644 +--- a/tpm2d/tpm2.c ++++ b/tpm2d/tpm2.c +@@ -917,10 +917,20 @@ tpm2_ecc_decrypt (ctrl_t ctrl, TSS_CONTEXT *tssc, TPM_HANDLE key, + size_t len; + int ret; + ++#if defined(TPM2_MAX_ECC_KEY_BYTES) /* Intel stack */ ++ if (ciphertext_len > 2*TPM2_MAX_ECC_KEY_BYTES + 1) ++ return GPG_ERR_TOO_LARGE; ++#elif defined(MAX_ECC_KEY_BYTES) /* IBM stack */ ++ if (ciphertext_len > 2*MAX_ECC_KEY_BYTES + 1) ++ return GPG_ERR_TOO_LARGE; ++#else ++# error TMP2 header are not correctly installed ++#endif ++ + /* This isn't really a decryption per se. The ciphertext actually + * contains an EC Point which we must multiply by the private key number. + * +- * The reason is to generate a diffe helman agreement on a shared ++ * The reason is to generate a diffie-hellman agreement on a shared + * point. This shared point is then used to generate the per + * session encryption key. + */ +@@ -976,6 +986,16 @@ tpm2_rsa_decrypt (ctrl_t ctrl, TSS_CONTEXT *tssc, TPM_HANDLE key, + TPM_HANDLE ah; + char *auth; + ++#if defined(TPM2_MAX_RSA_KEY_BYTES) /* Intel stack */ ++ if (ciphertext_len > TPM2_MAX_RSA_KEY_BYTES) ++ return GPG_ERR_TOO_LARGE; ++#elif defined(MAX_RSA_KEY_BYTES) /* IBM stack */ ++ if (ciphertext_len > MAX_RSA_KEY_BYTES) ++ return GPG_ERR_TOO_LARGE; ++#else ++# error TMP2 header are not correctly installed ++#endif ++ + inScheme.scheme = TPM_ALG_RSAES; + /* + * apparent gcrypt error: occasionally rsa ciphertext will +-- +2.39.5 + diff --git a/debian/patches/freepg/0051-agent-Fix-the-regression-in-pkdecrypt-with-TPM-RSA.patch b/debian/patches/freepg/0051-agent-Fix-the-regression-in-pkdecrypt-with-TPM-RSA.patch new file mode 100644 index 000000000..2277dcee3 --- /dev/null +++ b/debian/patches/freepg/0051-agent-Fix-the-regression-in-pkdecrypt-with-TPM-RSA.patch @@ -0,0 +1,42 @@ +From 555a9f5b3a0ca69e663373d47902e0bec0bd49d0 Mon Sep 17 00:00:00 2001 +From: NIIBE Yutaka <[email protected]> +Date: Thu, 12 Feb 2026 11:51:17 +0900 +Subject: agent: Fix the regression in pkdecrypt with TPM RSA. + +* agent/divert-tpm2.c (divert_tpm2_pkdecrypt): Care about additional +0x00. + +-- + +Cherry pick master commit of: + 6eed3959303c81c9699fe9273030e480732f72be + +GnuPG-bug-id: 8045 +Signed-off-by: NIIBE Yutaka <[email protected]> +--- + agent/divert-tpm2.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/agent/divert-tpm2.c b/agent/divert-tpm2.c +index 2496d091a..5b5bd14bb 100644 +--- a/agent/divert-tpm2.c ++++ b/agent/divert-tpm2.c +@@ -135,6 +135,15 @@ divert_tpm2_pkdecrypt (ctrl_t ctrl, + if (!smatch (&s, n, "a")) + return gpg_error (GPG_ERR_UNKNOWN_SEXP); + n = snext (&s); ++ /* NOTE: gpg-agent protocol uses signed integer for RSA (%m in ++ * MPI), where 0x00 is added when the MSB is 1. TPM2 uses ++ * unsigned integer. We need to remove this 0x00, or else ++ * it may result GPG_ERR_TOO_LARGE in tpm2daemon. */ ++ if (!*s && (n&1)) ++ { ++ s++; ++ n--; ++ } + } + else if (smatch (&s, n, "ecdh")) + { +-- +2.39.5 + diff --git a/debian/patches/from-master/0004-gpgsm-Require-a-minimum-tag-length-for-GCM-decryptio.patch b/debian/patches/from-master/0004-gpgsm-Require-a-minimum-tag-length-for-GCM-decryptio.patch new file mode 100644 index 000000000..be629b0ee --- /dev/null +++ b/debian/patches/from-master/0004-gpgsm-Require-a-minimum-tag-length-for-GCM-decryptio.patch @@ -0,0 +1,45 @@ +From 4c7e68cf3d335328821bdbb70db309a60d0e4fd4 Mon Sep 17 00:00:00 2001 +From: Werner Koch <[email protected]> +Date: Thu, 18 Jun 2026 10:51:34 +0200 +Subject: [PATCH] gpgsm: Require a minimum tag length for GCM decryption. + +* sm/decrypt.c (gpgsm_decrypt): Require a minimum authtaglen. +-- + +Reported-by: Thai Duong <[email protected]> +CVE-id: CVE-2026-57062 +--- + sm/decrypt.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/sm/decrypt.c b/sm/decrypt.c +index 20fb96060..92a33c6e6 100644 +--- a/sm/decrypt.c ++++ b/sm/decrypt.c +@@ -1443,15 +1443,22 @@ gpgsm_decrypt (ctrl_t ctrl, estream_t in_fp, estream_t out_fp) + if (rc) + { + log_error ("error getting authtag: %s\n", gpg_strerror (rc)); + goto leave; + } + if (DBG_CRYPTO) + log_printhex (authtag, authtaglen, "Authtag ...:"); +- rc = gcry_cipher_checktag (dfparm.hd, authtag, authtaglen); ++ if (authtaglen < 12) ++ { ++ log_info ("authentication tag is too short (%zu octets)\n", ++ authtaglen); ++ rc = gpg_error (GPG_ERR_CHECKSUM); ++ } ++ else ++ rc = gcry_cipher_checktag (dfparm.hd, authtag, authtaglen); + xfree (authtag); + if (rc) + log_error ("data is not authentic: %s\n", gpg_strerror (rc)); + goto leave; + } + } + } +-- +2.53.0 + diff --git a/debian/patches/series b/debian/patches/series index 3b42e1375..870ea4e34 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -20,6 +20,8 @@ freepg/0026-gpg-Default-to-compliance-openpgp.patch freepg/0029-Add-keyboxd-systemd-support.patch freepg/0033-Support-large-RSA-keygen-in-non-batch-mode.patch freepg/0034-gpg-Verify-Text-mode-Signatures-over-binary-Literal-.patch +freepg/0050-tpm-Fix-possible-buffer-overflow-in-PKDECRYPT.patch +freepg/0051-agent-Fix-the-regression-in-pkdecrypt-with-TPM-RSA.patch debian-packaging/avoid-beta-warning.patch debian-packaging/avoid-regenerating-defsincdate-use-shipped-file.patch dirmngr-idling/dirmngr-hkp-Avoid-potential-race-condition-when-some.patch @@ -36,6 +38,7 @@ from-master/gpg-agent-idling/0007-agent-Fix-the-previous-commit.patch from-master/gpg-agent-idling/0008-agent-Fix-timer-list-management.patch from-master/gpg-agent-idling/0009-agent-Fix-sock_inotify_fd-handling.patch from-master/gpg-agent-idling/0010-agent-Fix-timer-round-up-check-when-inserting-an-ent.patch +from-master/0004-gpgsm-Require-a-minimum-tag-length-for-GCM-decryptio.patch Use-hkps-keys.openpgp.org-as-the-default-keyserver.patch debian-packaging/Build-regexp-against-debian-s-unicode-data-package.patch debian-packaging/Always-build-common-status-codes.h-and-common-audit-event.patch
signature.asc
Description: PGP signature
