Skip to content

Commit 0c2e13e

Browse files
CBL-Mariner-Botazurelinux-securityKanishk-Bansal
authored
Merge PR "[AUTO-CHERRYPICK] [AutoPR- Security] Patch gnupg2 for CVE-2026-24882, CVE-2025-68973 [HIGH] - branch main" #15965
Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>
1 parent d6b66a7 commit 0c2e13e

File tree

7 files changed

+191
-12
lines changed

7 files changed

+191
-12
lines changed

SPECS/gnupg2/CVE-2025-68973.patch

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
From bc8e94b03af106b7f481abb36d8a8d5fdf723c77 Mon Sep 17 00:00:00 2001
2+
From: Werner Koch <wk@gnupg.org>
3+
Date: Thu, 23 Oct 2025 11:36:04 +0200
4+
Subject: [PATCH] gpg: Fix possible memory corruption in the armor parser.
5+
6+
* g10/armor.c (armor_filter): Fix faulty double increment.
7+
8+
* common/iobuf.c (underflow_target): Assert that the filter
9+
implementations behave well.
10+
--
11+
12+
This fixes a bug in a code path which can only be reached with special
13+
crafted input data and would then error out at an upper layer due to
14+
corrupt input (every second byte in the buffer is unitialized
15+
garbage). No fuzzing has yet hit this case and we don't have a test
16+
case for this code path. However memory corruption can never be
17+
tolerated as it always has the protential for remode code execution.
18+
19+
Reported-by: 8b79fe4dd0581c1cd000e1fbecba9f39e16a396a
20+
Fixes-commit: c27c7416d5148865a513e007fb6f0a34993a6073
21+
which fixed
22+
Fixes-commit: 7d0efec7cf5ae110c99511abc32587ff0c45b14f
23+
Backported-from-master: 115d138ba599328005c5321c0ef9f00355838ca9
24+
25+
The bug was introduced on 1999-01-07 by me:
26+
* armor.c: Rewrote large parts.
27+
which I fixed on 1999-03-02 but missed to fix the other case:
28+
* armor.c (armor_filter): Fixed armor bypassing.
29+
30+
Below is base64+gzipped test data which can be used with valgrind to
31+
show access to uninitalized memory in write(2) in the unpatched code.
32+
33+
--8<---------------cut here---------------start------------->8---
34+
H4sICIDd+WgCA3h4AO3QMQ6CQBCG0djOKbY3G05gscYFSRAJt/AExp6Di0cQG0ze
35+
a//MV0zOq3Pt+jFN3ZTKfLvP9ZLafqifJUe8juOjeZbVtSkbRPmRgICAgICAgICA
36+
gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA
37+
gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA
38+
gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA
39+
gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA
40+
gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA
41+
gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA
42+
gICAgICAgICAgICAgICAgICAgICAgICAgMCXF6dYDgAAAAAAAAAAAAAAAAAAAAAA
43+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7E14AAAAA
44+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
45+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
46+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
47+
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwZ94aieId3+8EAA==
48+
--8<---------------cut here---------------end--------------->8---
49+
50+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
51+
Upstream-reference: https://github.com/gpg/gnupg/commit/4ecc5122f20e10c17172ed72f4fa46c784b5fb48.patch
52+
---
53+
common/iobuf.c | 8 +++++++-
54+
g10/armor.c | 4 ++--
55+
2 files changed, 9 insertions(+), 3 deletions(-)
56+
57+
diff --git a/common/iobuf.c b/common/iobuf.c
58+
index 86bb296..368055b 100644
59+
--- a/common/iobuf.c
60+
+++ b/common/iobuf.c
61+
@@ -1933,6 +1933,8 @@ underflow_target (iobuf_t a, int clear_pending_eof, size_t target)
62+
rc = 0;
63+
else
64+
{
65+
+ size_t tmplen;
66+
+
67+
/* If no buffered data and drain buffer has been setup, and drain
68+
* buffer is largish, read data directly to drain buffer. */
69+
if (a->d.len == 0
70+
@@ -1945,8 +1947,10 @@ underflow_target (iobuf_t a, int clear_pending_eof, size_t target)
71+
log_debug ("iobuf-%d.%d: underflow: A->FILTER (%lu bytes, to external drain)\n",
72+
a->no, a->subno, (ulong)len);
73+
74+
- rc = a->filter (a->filter_ov, IOBUFCTRL_UNDERFLOW, a->chain,
75+
+ tmplen = len; /* Used to check for bugs in the filter. */
76+
+ rc = a->filter (a->filter_ov, IOBUFCTRL_UNDERFLOW, a->chain,
77+
a->e_d.buf, &len);
78+
+ log_assert (len <= tmplen);
79+
a->e_d.used = len;
80+
len = 0;
81+
}
82+
@@ -1956,8 +1960,10 @@ underflow_target (iobuf_t a, int clear_pending_eof, size_t target)
83+
log_debug ("iobuf-%d.%d: underflow: A->FILTER (%lu bytes)\n",
84+
a->no, a->subno, (ulong)len);
85+
86+
+ tmplen = len; /* Used to check for bugs in the filter. */
87+
rc = a->filter (a->filter_ov, IOBUFCTRL_UNDERFLOW, a->chain,
88+
&a->d.buf[a->d.len], &len);
89+
+ log_assert (len <= tmplen);
90+
}
91+
}
92+
a->d.len += len;
93+
diff --git a/g10/armor.c b/g10/armor.c
94+
index b47c04a..39294e2 100644
95+
--- a/g10/armor.c
96+
+++ b/g10/armor.c
97+
@@ -1302,8 +1302,8 @@ armor_filter( void *opaque, int control,
98+
n = 0;
99+
if( afx->buffer_len ) {
100+
/* Copy the data from AFX->BUFFER to BUF. */
101+
- for(; n < size && afx->buffer_pos < afx->buffer_len; n++ )
102+
- buf[n++] = afx->buffer[afx->buffer_pos++];
103+
+ for(; n < size && afx->buffer_pos < afx->buffer_len;)
104+
+ buf[n++] = afx->buffer[afx->buffer_pos++];
105+
if( afx->buffer_pos >= afx->buffer_len )
106+
afx->buffer_len = 0;
107+
}
108+
--
109+
2.45.4
110+

SPECS/gnupg2/CVE-2026-24882.patch

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
From faaf8b325791cbe9d04a2752f55831152181bea4 Mon Sep 17 00:00:00 2001
2+
From: Werner Koch <wk@gnupg.org>
3+
Date: Mon, 26 Jan 2026 11:13:44 +0100
4+
Subject: [PATCH] tpm: Fix possible buffer overflow in PKDECRYPT
5+
6+
* tpm2d/tpm2.c (tpm2_ecc_decrypt): Bail out on too long CIPHERTEXT.
7+
(tpm2_rsa_decrypt): Ditto.
8+
--
9+
10+
GnuPG-bug-id: 8045
11+
Co-authored-by: NIIBE Yutaka <gniibe@fsij.org>
12+
Reported-by: OpenAI Security Research
13+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
14+
Upstream-reference: https://github.com/gpg/gnupg/commit/93fa34d9a346.patch
15+
---
16+
tpm2d/tpm2.c | 22 +++++++++++++++++++++-
17+
1 file changed, 21 insertions(+), 1 deletion(-)
18+
19+
diff --git a/tpm2d/tpm2.c b/tpm2d/tpm2.c
20+
index 3e908dd..cd0347c 100644
21+
--- a/tpm2d/tpm2.c
22+
+++ b/tpm2d/tpm2.c
23+
@@ -917,10 +917,20 @@ tpm2_ecc_decrypt (ctrl_t ctrl, TSS_CONTEXT *tssc, TPM_HANDLE key,
24+
size_t len;
25+
int ret;
26+
27+
+#if defined(TPM2_MAX_ECC_KEY_BYTES) /* Intel stack */
28+
+ if (ciphertext_len > 2*TPM2_MAX_ECC_KEY_BYTES + 1)
29+
+ return GPG_ERR_TOO_LARGE;
30+
+#elif defined(MAX_ECC_KEY_BYTES) /* IBM stack */
31+
+ if (ciphertext_len > 2*MAX_ECC_KEY_BYTES + 1)
32+
+ return GPG_ERR_TOO_LARGE;
33+
+#else
34+
+# error TMP2 header are not correctly installed
35+
+#endif
36+
+
37+
/* This isn't really a decryption per se. The ciphertext actually
38+
* contains an EC Point which we must multiply by the private key number.
39+
*
40+
- * The reason is to generate a diffe helman agreement on a shared
41+
+ * The reason is to generate a diffie-hellman agreement on a shared
42+
* point. This shared point is then used to generate the per
43+
* session encryption key.
44+
*/
45+
@@ -976,6 +986,16 @@ tpm2_rsa_decrypt (ctrl_t ctrl, TSS_CONTEXT *tssc, TPM_HANDLE key,
46+
TPM_HANDLE ah;
47+
char *auth;
48+
49+
+#if defined(TPM2_MAX_RSA_KEY_BYTES) /* Intel stack */
50+
+ if (ciphertext_len > TPM2_MAX_RSA_KEY_BYTES)
51+
+ return GPG_ERR_TOO_LARGE;
52+
+#elif defined(MAX_RSA_KEY_BYTES) /* IBM stack */
53+
+ if (ciphertext_len > MAX_RSA_KEY_BYTES)
54+
+ return GPG_ERR_TOO_LARGE;
55+
+#else
56+
+# error TMP2 header are not correctly installed
57+
+#endif
58+
+
59+
inScheme.scheme = TPM_ALG_RSAES;
60+
/*
61+
* apparent gcrypt error: occasionally rsa ciphertext will
62+
--
63+
2.45.4
64+

SPECS/gnupg2/gnupg2.spec

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,15 @@
11
Summary: OpenPGP standard implementation used for encrypted communication and data storage.
22
Name: gnupg2
33
Version: 2.4.0
4-
Release: 2%{?dist}
4+
Release: 3%{?dist}
55
License: BSD and CC0 and GPLv2+ and LGPLv2+
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
88
Group: Applications/Cryptography.
99
URL: https://gnupg.org/index.html
1010
Source0: https://gnupg.org/ftp/gcrypt/gnupg/gnupg-%{version}.tar.bz2
11+
Patch0: CVE-2025-68973.patch
12+
Patch1: CVE-2026-24882.patch
1113
BuildRequires: zlib-devel
1214
BuildRequires: bzip2-devel
1315
BuildRequires: readline-devel
@@ -48,7 +50,7 @@ Requires: %{name} = %{version}-%{release}
4850
These are the additional language files of gnupg2
4951

5052
%prep
51-
%autosetup -n gnupg-%{version}
53+
%autosetup -p1 -n gnupg-%{version}
5254

5355
%build
5456
%configure \
@@ -89,6 +91,9 @@ ln -s $(pwd)/bin/gpg $(pwd)/bin/gpg2
8991
%defattr(-,root,root)
9092

9193
%changelog
94+
* Tue Feb 24 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.4.0-3
95+
- Patch for CVE-2026-24882, CVE-2025-68973
96+
9297
* Tue Mar 21 2023 Muhammad Falak <mwani@microsoft.com> - 2.4.0-2
9398
- Add correct version for libgpg-error-devel as a BR
9499

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -221,8 +221,8 @@ libksba-devel-1.6.3-1.cm2.aarch64.rpm
221221
libxslt-1.1.34-10.cm2.aarch64.rpm
222222
npth-1.6-4.cm2.aarch64.rpm
223223
pinentry-1.2.0-1.cm2.aarch64.rpm
224-
gnupg2-2.4.0-2.cm2.aarch64.rpm
225-
gnupg2-lang-2.4.0-2.cm2.aarch64.rpm
224+
gnupg2-2.4.0-3.cm2.aarch64.rpm
225+
gnupg2-lang-2.4.0-3.cm2.aarch64.rpm
226226
gpgme-1.16.0-2.cm2.aarch64.rpm
227227
mariner-repos-shared-2.0-9.cm2.noarch.rpm
228228
mariner-repos-2.0-9.cm2.noarch.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -221,8 +221,8 @@ libksba-devel-1.6.3-1.cm2.x86_64.rpm
221221
libxslt-1.1.34-10.cm2.x86_64.rpm
222222
npth-1.6-4.cm2.x86_64.rpm
223223
pinentry-1.2.0-1.cm2.x86_64.rpm
224-
gnupg2-2.4.0-2.cm2.x86_64.rpm
225-
gnupg2-lang-2.4.0-2.cm2.x86_64.rpm
224+
gnupg2-2.4.0-3.cm2.x86_64.rpm
225+
gnupg2-lang-2.4.0-3.cm2.x86_64.rpm
226226
gpgme-1.16.0-2.cm2.x86_64.rpm
227227
mariner-repos-shared-2.0-9.cm2.noarch.rpm
228228
mariner-repos-2.0-9.cm2.noarch.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -118,9 +118,9 @@ glibc-tools-2.35-10.cm2.aarch64.rpm
118118
gmp-6.2.1-4.cm2.aarch64.rpm
119119
gmp-debuginfo-6.2.1-4.cm2.aarch64.rpm
120120
gmp-devel-6.2.1-4.cm2.aarch64.rpm
121-
gnupg2-2.4.0-2.cm2.aarch64.rpm
122-
gnupg2-debuginfo-2.4.0-2.cm2.aarch64.rpm
123-
gnupg2-lang-2.4.0-2.cm2.aarch64.rpm
121+
gnupg2-2.4.0-3.cm2.aarch64.rpm
122+
gnupg2-debuginfo-2.4.0-3.cm2.aarch64.rpm
123+
gnupg2-lang-2.4.0-3.cm2.aarch64.rpm
124124
gperf-3.1-5.cm2.aarch64.rpm
125125
gperf-debuginfo-3.1-5.cm2.aarch64.rpm
126126
gpgme-1.16.0-2.cm2.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -123,9 +123,9 @@ glibc-tools-2.35-10.cm2.x86_64.rpm
123123
gmp-6.2.1-4.cm2.x86_64.rpm
124124
gmp-debuginfo-6.2.1-4.cm2.x86_64.rpm
125125
gmp-devel-6.2.1-4.cm2.x86_64.rpm
126-
gnupg2-2.4.0-2.cm2.x86_64.rpm
127-
gnupg2-debuginfo-2.4.0-2.cm2.x86_64.rpm
128-
gnupg2-lang-2.4.0-2.cm2.x86_64.rpm
126+
gnupg2-2.4.0-3.cm2.x86_64.rpm
127+
gnupg2-debuginfo-2.4.0-3.cm2.x86_64.rpm
128+
gnupg2-lang-2.4.0-3.cm2.x86_64.rpm
129129
gperf-3.1-5.cm2.x86_64.rpm
130130
gperf-debuginfo-3.1-5.cm2.x86_64.rpm
131131
gpgme-1.16.0-2.cm2.x86_64.rpm

0 commit comments

Comments
 (0)