Skip to content

Commit 4f89bd8

Browse files
azurelinux-securityBinduSri-6522866Kanishk Bansal
authored
[AutoPR- Security] Patch hvloader for CVE-2026-22795, CVE-2025-69421, CVE-2025-69420, CVE-2025-69419 [HIGH] (#15767)
Signed-off-by: Kanishk Bansal <kanbansal@microsoft.com> Co-authored-by: BinduSri-6522866 <v-badabala@microsoft.com> Co-authored-by: Kanishk Bansal <kanbansal@microsoft.com>
1 parent f9c0b4e commit 4f89bd8

6 files changed

Lines changed: 232 additions & 2 deletions

File tree

‎SPECS-SIGNED/hvloader-signed/hvloader-signed.spec‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
Summary: Signed HvLoader.efi for %{buildarch} systems
77
Name: hvloader-signed-%{buildarch}
88
Version: 1.0.1
9-
Release: 16%{?dist}
9+
Release: 17%{?dist}
1010
License: MIT
1111
Vendor: Microsoft Corporation
1212
Distribution: Mariner
@@ -69,6 +69,9 @@ popd
6969
/boot/efi/HvLoader.efi
7070

7171
%changelog
72+
* Mon Feb 09 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.0.1-17
73+
- Bump release for consistency with hvloader spec.
74+
7275
* Tue Jan 06 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.0.1-16
7376
- Bump release for consistency with hvloader spec.
7477

‎SPECS/hvloader/CVE-2025-69419.patch‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
From 7c55e722e1ee27020d9e52df9a194c2e3a5ab4de Mon Sep 17 00:00:00 2001
2+
From: AllSpark <allspark@microsoft.com>
3+
Date: Mon, 9 Feb 2026 11:04:29 +0000
4+
Subject: [PATCH] Check return code of UTF8_putc: handle failure in ASN.1
5+
string conversion and PKCS12 UTF-8 emission per upstream patch. Preserves
6+
comments from patch.
7+
8+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
9+
Upstream-reference: AI Backport of https://github.com/openssl/openssl/commit/41be0f216404f14457bbf3b9cc488dba60b49296.patch
10+
---
11+
.../Library/OpensslLib/openssl/crypto/asn1/a_strex.c | 6 ++++--
12+
.../OpensslLib/openssl/crypto/pkcs12/p12_utl.c | 11 +++++++++--
13+
2 files changed, 13 insertions(+), 4 deletions(-)
14+
15+
diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/asn1/a_strex.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/asn1/a_strex.c
16+
index 284dde27..843b0f94 100644
17+
--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/asn1/a_strex.c
18+
+++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/asn1/a_strex.c
19+
@@ -203,8 +203,10 @@ static int do_buf(unsigned char *buf, int buflen,
20+
orflags = CHARTYPE_LAST_ESC_2253;
21+
if (type & BUF_TYPE_CONVUTF8) {
22+
unsigned char utfbuf[6];
23+
- int utflen;
24+
- utflen = UTF8_putc(utfbuf, sizeof(utfbuf), c);
25+
+ int utflen = UTF8_putc(utfbuf, sizeof(utfbuf), c);
26+
+
27+
+ if (utflen < 0)
28+
+ return -1; /* error happened with UTF8 */
29+
for (i = 0; i < utflen; i++) {
30+
/*
31+
* We don't need to worry about setting orflags correctly
32+
diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_utl.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_utl.c
33+
index 43b9e3a5..1c6b59d5 100644
34+
--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_utl.c
35+
+++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_utl.c
36+
@@ -207,8 +207,15 @@ char *OPENSSL_uni2utf8(const unsigned char *uni, int unilen)
37+
/* re-run the loop emitting UTF-8 string */
38+
for (asclen = 0, i = 0; i < unilen; ) {
39+
j = bmp_to_utf8(asctmp+asclen, uni+i, unilen-i);
40+
- if (j == 4) i += 4;
41+
- else i += 2;
42+
+ /* when UTF8_putc fails */
43+
+ if (j < 0) {
44+
+ OPENSSL_free(asctmp);
45+
+ return NULL;
46+
+ }
47+
+ if (j == 4)
48+
+ i += 4;
49+
+ else
50+
+ i += 2;
51+
asclen += j;
52+
}
53+
54+
--
55+
2.45.4
56+

‎SPECS/hvloader/CVE-2025-69420.patch‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
From dbb834e047a19711836cb61561d9273e89f320fa Mon Sep 17 00:00:00 2001
2+
From: AllSpark <allspark@microsoft.com>
3+
Date: Mon, 9 Feb 2026 11:04:59 +0000
4+
Subject: [PATCH] Verify ASN1 object's types before attempting to access them
5+
as a particular type
6+
MIME-Version: 1.0
7+
Content-Type: text/plain; charset=UTF-8
8+
Content-Transfer-Encoding: 8bit
9+
10+
Issue was reported in ossl_ess_get_signing_cert but is also present in ossl_ess_get_signing_cert_v2.
11+
12+
Fixes: https://github.com/openssl/srt/issues/61
13+
Fixes CVE-2025-69420
14+
15+
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
16+
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
17+
Reviewed-by: Tomas Mraz <tomas@openssl.org>
18+
MergeDate: Mon Jan 26 19:53:36 2026
19+
(cherry picked from commit ea8fc4c345fbd749048809c9f7c881ea656b0b94)
20+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
21+
Upstream-reference: AI Backport of https://github.com/openssl/openssl/commit/ea8fc4c345fbd749048809c9f7c881ea656b0b94.patch
22+
---
23+
.../Library/OpensslLib/openssl/crypto/ts/ts_rsp_verify.c | 4 ++--
24+
1 file changed, 2 insertions(+), 2 deletions(-)
25+
26+
diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/ts/ts_rsp_verify.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/ts/ts_rsp_verify.c
27+
index 7fe3d27e..5d452d26 100644
28+
--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/ts/ts_rsp_verify.c
29+
+++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/ts/ts_rsp_verify.c
30+
@@ -262,7 +262,7 @@ static ESS_SIGNING_CERT *ess_get_signing_cert(PKCS7_SIGNER_INFO *si)
31+
ASN1_TYPE *attr;
32+
const unsigned char *p;
33+
attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificate);
34+
- if (!attr)
35+
+ if (attr == NULL || attr->type != V_ASN1_SEQUENCE)
36+
return NULL;
37+
p = attr->value.sequence->data;
38+
return d2i_ESS_SIGNING_CERT(NULL, &p, attr->value.sequence->length);
39+
@@ -274,7 +274,7 @@ static ESS_SIGNING_CERT_V2 *ess_get_signing_cert_v2(PKCS7_SIGNER_INFO *si)
40+
const unsigned char *p;
41+
42+
attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificateV2);
43+
- if (attr == NULL)
44+
+ if (attr == NULL || attr->type != V_ASN1_SEQUENCE)
45+
return NULL;
46+
p = attr->value.sequence->data;
47+
return d2i_ESS_SIGNING_CERT_V2(NULL, &p, attr->value.sequence->length);
48+
--
49+
2.45.4
50+

‎SPECS/hvloader/CVE-2025-69421.patch‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
From d69f898077165b522ae19bf1a24b10c7a5367835 Mon Sep 17 00:00:00 2001
2+
From: AllSpark <allspark@microsoft.com>
3+
Date: Mon, 9 Feb 2026 11:05:00 +0000
4+
Subject: [PATCH] PKCS12_item_decrypt_d2i(): Check oct argument for NULL
5+
6+
Backport of upstream fix to validate ASN1_OCTET_STRING argument before use.
7+
Prevents NULL dereference when oct is NULL.
8+
9+
Inspired by upstream patch for PKCS12_item_decrypt_d2i_ex().
10+
11+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
12+
Upstream-reference: AI Backport of https://github.com/openssl/openssl/commit/2c13bf15286328641a805eb3b7c97e27d42881fb.patch
13+
---
14+
.../Library/OpensslLib/openssl/crypto/pkcs12/p12_decr.c | 7 +++++++
15+
1 file changed, 7 insertions(+)
16+
17+
diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_decr.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_decr.c
18+
index 3c860584..85835734 100644
19+
--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_decr.c
20+
+++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_decr.c
21+
@@ -88,6 +88,13 @@ void *PKCS12_item_decrypt_d2i(const X509_ALGOR *algor, const ASN1_ITEM *it,
22+
void *ret;
23+
int outlen;
24+
25+
+
26+
+ /* Check oct for NULL to avoid dereferencing a NULL pointer */
27+
+ if (oct == NULL) {
28+
+ PKCS12err(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I, ERR_R_PASSED_NULL_PARAMETER);
29+
+ return NULL;
30+
+ }
31+
+
32+
if (!PKCS12_pbe_crypt(algor, pass, passlen, oct->data, oct->length,
33+
&out, &outlen, 0)) {
34+
PKCS12err(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I,
35+
--
36+
2.45.4
37+

‎SPECS/hvloader/CVE-2026-22795.patch‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
From 1cbd2e0aef0cc6f6b6300408835cd6a3078c1ac4 Mon Sep 17 00:00:00 2001
2+
From: Bob Beck <beck@openssl.org>
3+
Date: Wed, 7 Jan 2026 11:29:48 -0700
4+
Subject: [PATCH] Ensure ASN1 types are checked before use.
5+
6+
Some of these were fixed by LibreSSL in commit https://github.com/openbsd/src/commit/aa1f637d454961d22117b4353f98253e984b3ba8
7+
this fix includes the other fixes in that commit, as well as fixes for others found by a scan
8+
for a similar unvalidated access paradigm in the tree.
9+
10+
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
11+
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
12+
Reviewed-by: Tomas Mraz <tomas@openssl.org>
13+
(Merged from https://github.com/openssl/openssl/pull/29582)
14+
15+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
16+
Upstream-reference: https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49.patch
17+
---
18+
CryptoPkg/Library/OpensslLib/openssl/apps/s_client.c | 3 ++-
19+
.../OpensslLib/openssl/crypto/pkcs12/p12_kiss.c | 10 ++++++++--
20+
.../Library/OpensslLib/openssl/crypto/pkcs7/pk7_doit.c | 2 ++
21+
3 files changed, 12 insertions(+), 3 deletions(-)
22+
23+
diff --git a/CryptoPkg/Library/OpensslLib/openssl/apps/s_client.c b/CryptoPkg/Library/OpensslLib/openssl/apps/s_client.c
24+
index 00effc80..6e8cc6e9 100644
25+
--- a/CryptoPkg/Library/OpensslLib/openssl/apps/s_client.c
26+
+++ b/CryptoPkg/Library/OpensslLib/openssl/apps/s_client.c
27+
@@ -2698,8 +2698,9 @@ int s_client_main(int argc, char **argv)
28+
goto end;
29+
}
30+
atyp = ASN1_generate_nconf(genstr, cnf);
31+
- if (atyp == NULL) {
32+
+ if (atyp == NULL || atyp->type != V_ASN1_SEQUENCE) {
33+
NCONF_free(cnf);
34+
+ ASN1_TYPE_free(atyp);
35+
BIO_printf(bio_err, "ASN1_generate_nconf failed\n");
36+
goto end;
37+
}
38+
diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_kiss.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_kiss.c
39+
index 7ab98385..d90404dd 100644
40+
--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_kiss.c
41+
+++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_kiss.c
42+
@@ -183,11 +183,17 @@ static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen,
43+
ASN1_BMPSTRING *fname = NULL;
44+
ASN1_OCTET_STRING *lkid = NULL;
45+
46+
- if ((attrib = PKCS12_SAFEBAG_get0_attr(bag, NID_friendlyName)))
47+
+ if ((attrib = PKCS12_SAFEBAG_get0_attr(bag, NID_friendlyName))) {
48+
+ if (attrib->type != V_ASN1_BMPSTRING)
49+
+ return 0;
50+
fname = attrib->value.bmpstring;
51+
+ }
52+
53+
- if ((attrib = PKCS12_SAFEBAG_get0_attr(bag, NID_localKeyID)))
54+
+ if ((attrib = PKCS12_SAFEBAG_get0_attr(bag, NID_localKeyID))) {
55+
+ if (attrib->type != V_ASN1_OCTET_STRING)
56+
+ return 0;
57+
lkid = attrib->value.octet_string;
58+
+ }
59+
60+
switch (PKCS12_SAFEBAG_get_nid(bag)) {
61+
case NID_keyBag:
62+
diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs7/pk7_doit.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs7/pk7_doit.c
63+
index f63fbc50..4e0eb1e8 100644
64+
--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs7/pk7_doit.c
65+
+++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs7/pk7_doit.c
66+
@@ -1092,6 +1092,8 @@ ASN1_OCTET_STRING *PKCS7_digest_from_attributes(STACK_OF(X509_ATTRIBUTE) *sk)
67+
ASN1_TYPE *astype;
68+
if ((astype = get_attribute(sk, NID_pkcs9_messageDigest)) == NULL)
69+
return NULL;
70+
+ if (astype->type != V_ASN1_OCTET_STRING)
71+
+ return NULL;
72+
return astype->value.octet_string;
73+
}
74+
75+
--
76+
2.45.4
77+

‎SPECS/hvloader/hvloader.spec‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
Summary: HvLoader.efi is an EFI application for loading an external hypervisor loader.
55
Name: hvloader
66
Version: 1.0.1
7-
Release: 16%{?dist}
7+
Release: 17%{?dist}
88
License: MIT
99
Vendor: Microsoft Corporation
1010
Distribution: Mariner
@@ -37,6 +37,10 @@ Patch19: CVE-2024-38796.patch
3737
Patch20: CVE-2025-3770.patch
3838
Patch21: CVE-2025-2296.patch
3939
Patch22: CVE-2025-2295.patch
40+
Patch23: CVE-2025-69419.patch
41+
Patch24: CVE-2025-69420.patch
42+
Patch25: CVE-2025-69421.patch
43+
Patch26: CVE-2026-22795.patch
4044

4145
BuildRequires: bc
4246
BuildRequires: gcc
@@ -82,6 +86,9 @@ cp ./Build/MdeModule/RELEASE_GCC5/X64/MdeModulePkg/Application/%{name_github}-%{
8286
/boot/efi/HvLoader.efi
8387

8488
%changelog
89+
* Mon Feb 09 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.0.1-17
90+
- Patch for CVE-2026-22795, CVE-2025-69421, CVE-2025-69420, CVE-2025-69419
91+
8592
* Tue Jan 06 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.0.1-16
8693
- Patch for CVE-2025-2295
8794

0 commit comments

Comments
 (0)