Pedro Monreal Gonzalez
b0d78d2994
* Missing ASN1_TYPE validation in PKCS#12 parsing
- openssl-CVE-2026-22795.patch [bsc#1256839, CVE-2026-22795]
* ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
- openssl-CVE-2026-22795.patch [bsc#1256840, CVE-2026-22796]
* Missing ASN1_TYPE validation in TS_RESP_verify_response() function
- openssl-CVE-2025-69420.patch [bsc#1256837, CVE-2025-69420]
* NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
- openssl-CVE-2025-69421.patch [bsc#1256838, CVE-2025-69421]
* Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
- openssl-CVE-2025-69419.patch [bsc#1256836, CVE-2025-69419]
* TLS 1.3 CompressedCertificate excessive memory allocation
- openssl-CVE-2025-66199.patch [bsc#1256833, CVE-2025-66199]
* Heap out-of-bounds write in BIO_f_linebuffer on short writes
- openssl-CVE-2025-68160.patch [bsc#1256834, CVE-2025-68160]
* Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
- openssl-CVE-2025-69418.patch [bsc#1256835, CVE-2025-69418]
* 'openssl dgst' one-shot codepath silently truncates inputs greater than 16MB
- openssl-CVE-2025-15469.patch [bsc#1256832, CVE-2025-15469]
* Stack buffer overflow in CMS AuthEnvelopedData parsing
- openssl-CVE-2025-15467.patch [bsc#1256830, CVE-2025-15467]
- openssl-CVE-2025-15467-comments.patch
- openssl-CVE-2025-15467-test.patch
* Improper validation of PBMAC1 parameters in PKCS#12 MAC verification
- openssl-CVE-2025-11187.patch [bsc#1256829, CVE-2025-11187]
* NULL dereference in SSL_CIPHER_find() function on unknown cipher ID
- openssl-CVE-2025-15468.patch [bsc#1256831, CVE-2025-15468]
- Enable livepatching support for ppc64le [bsc#1257274]
- Security fix: [bsc#1250232 CVE-2025-9230]
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-3?expand=0&rev=160
65 lines
2.3 KiB
Diff
65 lines
2.3 KiB
Diff
From 701aa270db8ad424cece68702b9bb2e05290af9b Mon Sep 17 00:00:00 2001
|
|
From: Neil Horman <nhorman@openssl.org>
|
|
Date: Wed, 7 Jan 2026 11:52:09 -0500
|
|
Subject: [PATCH] Fix heap buffer overflow in BIO_f_linebuffer
|
|
|
|
When a FIO_f_linebuffer is part of a bio chain, and the next BIO
|
|
preforms short writes, the remainder of the unwritten buffer is copied
|
|
unconditionally to the internal buffer ctx->obuf, which may not be
|
|
sufficiently sized to handle the remaining data, resulting in a buffer
|
|
overflow.
|
|
|
|
Fix it by only copying data when ctx->obuf has space, flushing to the
|
|
next BIO to increase available storage if needed.
|
|
|
|
Fixes CVE-2025-68160
|
|
---
|
|
crypto/bio/bf_lbuf.c | 32 ++++++++++++++++++++++++++------
|
|
1 file changed, 26 insertions(+), 6 deletions(-)
|
|
|
|
Index: openssl-3.5.0/crypto/bio/bf_lbuf.c
|
|
===================================================================
|
|
--- openssl-3.5.0.orig/crypto/bio/bf_lbuf.c
|
|
+++ openssl-3.5.0/crypto/bio/bf_lbuf.c
|
|
@@ -186,14 +186,34 @@ static int linebuffer_write(BIO *b, cons
|
|
while (foundnl && inl > 0);
|
|
/*
|
|
* We've written as much as we can. The rest of the input buffer, if
|
|
- * any, is text that doesn't and with a NL and therefore needs to be
|
|
- * saved for the next trip.
|
|
+ * any, is text that doesn't end with a NL and therefore we need to try
|
|
+ * free up some space in our obuf so we can make forward progress.
|
|
*/
|
|
- if (inl > 0) {
|
|
- memcpy(&(ctx->obuf[ctx->obuf_len]), in, inl);
|
|
- ctx->obuf_len += inl;
|
|
- num += inl;
|
|
+ while (inl > 0) {
|
|
+ size_t avail = (size_t)ctx->obuf_size - (size_t)ctx->obuf_len;
|
|
+ size_t to_copy;
|
|
+
|
|
+ if (avail == 0) {
|
|
+ /* Flush buffered data to make room */
|
|
+ i = BIO_write(b->next_bio, ctx->obuf, ctx->obuf_len);
|
|
+ if (i <= 0) {
|
|
+ BIO_copy_next_retry(b);
|
|
+ return num > 0 ? num : i;
|
|
+ }
|
|
+ if (i < ctx->obuf_len)
|
|
+ memmove(ctx->obuf, ctx->obuf + i, ctx->obuf_len - i);
|
|
+ ctx->obuf_len -= i;
|
|
+ continue;
|
|
+ }
|
|
+
|
|
+ to_copy = inl > (int)avail ? avail : (size_t)inl;
|
|
+ memcpy(&(ctx->obuf[ctx->obuf_len]), in, to_copy);
|
|
+ ctx->obuf_len += (int)to_copy;
|
|
+ in += to_copy;
|
|
+ inl -= (int)to_copy;
|
|
+ num += (int)to_copy;
|
|
}
|
|
+
|
|
return num;
|
|
}
|
|
|