Backport patch to fix CVE-2026-41989. References: https://nvd.nist.gov/vuln/detail/CVE-2026-41989 https://osv.dev/list?q=CVE-2026-41989
Upstream fix: https://github.com/gpg/libgcrypt/commit/2d3d732c9bf87cc10729f69678dd9e6862f99fa3 Signed-off-by: Leonid Iziumtsev <[email protected]> --- .../libgcrypt/files/CVE-2026-41989.patch | 42 +++++++++++++++++++ .../libgcrypt/libgcrypt_1.12.1.bb | 1 + 2 files changed, 43 insertions(+) create mode 100644 meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch diff --git a/meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch b/meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch new file mode 100644 index 0000000000..aba3ca318b --- /dev/null +++ b/meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch @@ -0,0 +1,42 @@ +From d8874dd38f78454dd3a760617ebe8d9aa9270649 Mon Sep 17 00:00:00 2001 +From: NIIBE Yutaka <[email protected]> +Date: Fri, 10 Apr 2026 16:58:57 +0900 +Subject: [PATCH] cipher:ecc: Fix decoding a point on Montgomery curve. + +* cipher/ecc-misc.c (_gcry_ecc_mont_decodepoint): Fix the padding +mistake and add updating RAWMPILEN. + +-- + +Reported by Calif.io in collaboration with Claude and Anthropic +Research. + +GnuPG-bug-id: 8211 +Fixes-commit: bbe15758c893dbf546416c1a6bccdad1ab000ad7 +Suggested-by: Bronson Yen <[email protected]> +Signed-off-by: NIIBE Yutaka <[email protected]> + +CVE: CVE-2026-41989 +Upstream-Status: Backport [https://github.com/gpg/libgcrypt/commit/2d3d732c9bf87cc10729f69678dd9e6862f99fa3] + +Signed-off-by: Leonid Iziumtsev <[email protected]> +--- + cipher/ecc-misc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/cipher/ecc-misc.c b/cipher/ecc-misc.c +index 615b0df2..ab3799dc 100644 +--- a/cipher/ecc-misc.c ++++ b/cipher/ecc-misc.c +@@ -438,7 +438,10 @@ _gcry_ecc_mont_decodepoint (gcry_mpi_t pk, mpi_ec_t ec, mpi_point_t result) + *--p = *buf++; + + if (rawmpilen < nbytes) +- memset (rawmpi + nbytes - rawmpilen, 0, nbytes - rawmpilen); ++ { ++ memset (rawmpi + rawmpilen, 0, nbytes - rawmpilen); ++ rawmpilen = nbytes; ++ } + } + else + { diff --git a/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb b/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb index b3c0d050b7..55872a5c23 100644 --- a/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb +++ b/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb @@ -25,6 +25,7 @@ SRC_URI = "${GNUPG_MIRROR}/libgcrypt/libgcrypt-${PV}.tar.bz2 \ file://no-native-gpg-error.patch \ file://no-bench-slope.patch \ file://run-ptest \ + file://CVE-2026-41989.patch \ " SRC_URI[sha256sum] = "7df5c08d952ba33f9b6bdabdb06a61a78b2cf62d2122c2d1d03a91a79832aa3c" -- 2.53.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241828): https://lists.openembedded.org/g/openembedded-core/message/241828 Mute This Topic: https://lists.openembedded.org/mt/120409556/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
