Skip to content

Commit 884e179

Browse files
akhila-gurujuakhila-guruju
authored
[Medium] Patch gnutls for CVE-2025-9820 (#15603)
1 parent 9819417 commit 884e179

File tree

2 files changed

+241
-1
lines changed

2 files changed

+241
-1
lines changed

‎SPECS/gnutls/CVE-2025-9820.patch‎

Lines changed: 236 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,236 @@
1+
From 1d56f96f6ab5034d677136b9d50b5a75dff0faf5 Mon Sep 17 00:00:00 2001
2+
From: Daiki Ueno <ueno@gnu.org>
3+
Date: Tue, 18 Nov 2025 13:17:55 +0900
4+
Subject: [PATCH] pkcs11: avoid stack overwrite when initializing a token
5+
6+
If gnutls_pkcs11_token_init is called with label longer than 32
7+
characters, the internal storage used to blank-fill it would
8+
overflow. This adds a guard to prevent that.
9+
10+
Signed-off-by: Daiki Ueno <ueno@gnu.org>
11+
12+
Upstream Patch reference:
13+
https://gitlab.com/gnutls/gnutls/-/commit/1d56f96f6ab5034d677136b9d50b5a75dff0faf5.patch
14+
---
15+
lib/pkcs11_write.c | 5 +-
16+
tests/Makefile.am | 2 +-
17+
tests/pkcs11/long-label.c | 164 ++++++++++++++++++++++++++++++++++++++
18+
3 files changed, 168 insertions(+), 3 deletions(-)
19+
create mode 100644 tests/pkcs11/long-label.c
20+
21+
diff --git a/lib/pkcs11_write.c b/lib/pkcs11_write.c
22+
index a3201dd..e923dcd 100644
23+
--- a/lib/pkcs11_write.c
24+
+++ b/lib/pkcs11_write.c
25+
@@ -28,6 +28,7 @@
26+
#include "pkcs11x.h"
27+
#include "x509/common.h"
28+
#include "pk.h"
29+
+#include "minmax.h"
30+
31+
static const ck_bool_t tval = 1;
32+
static const ck_bool_t fval = 0;
33+
@@ -1170,7 +1171,7 @@ int gnutls_pkcs11_delete_url(const char *object_url, unsigned int flags)
34+
* gnutls_pkcs11_token_init:
35+
* @token_url: A PKCS #11 URL specifying a token
36+
* @so_pin: Security Officer's PIN
37+
- * @label: A name to be used for the token
38+
+ * @label: A name to be used for the token, at most 32 characters
39+
*
40+
* This function will initialize (format) a token. If the token is
41+
* at a factory defaults state the security officer's PIN given will be
42+
@@ -1208,7 +1209,7 @@ int gnutls_pkcs11_token_init(const char *token_url, const char *so_pin,
43+
/* so it seems memset has other uses than zeroing! */
44+
memset(flabel, ' ', sizeof(flabel));
45+
if (label != NULL)
46+
- memcpy(flabel, label, strlen(label));
47+
+ memcpy(flabel, label, MIN(sizeof(flabel), strlen(label)));
48+
49+
rv = pkcs11_init_token(module, slot, (uint8_t *)so_pin, strlen(so_pin),
50+
(uint8_t *)flabel);
51+
diff --git a/tests/Makefile.am b/tests/Makefile.am
52+
index babf3be..5367ff2 100644
53+
--- a/tests/Makefile.am
54+
+++ b/tests/Makefile.am
55+
@@ -493,7 +493,7 @@ pathbuf_CPPFLAGS = $(AM_CPPFLAGS) \
56+
if ENABLE_PKCS11
57+
if !WINDOWS
58+
ctests += tls13/post-handshake-with-cert-pkcs11 pkcs11/tls-neg-pkcs11-no-key \
59+
- global-init-override pkcs11/distrust-after
60+
+ global-init-override pkcs11/distrust-after pkcs11/long-label
61+
tls13_post_handshake_with_cert_pkcs11_DEPENDENCIES = libpkcs11mock2.la libutils.la
62+
tls13_post_handshake_with_cert_pkcs11_LDADD = $(LDADD) $(LIBDL)
63+
pkcs11_tls_neg_pkcs11_no_key_DEPENDENCIES = libpkcs11mock2.la libutils.la
64+
diff --git a/tests/pkcs11/long-label.c b/tests/pkcs11/long-label.c
65+
new file mode 100644
66+
index 0000000..a70bc97
67+
--- /dev/null
68+
+++ b/tests/pkcs11/long-label.c
69+
@@ -0,0 +1,164 @@
70+
+/*
71+
+ * Copyright (C) 2025 Red Hat, Inc.
72+
+ *
73+
+ * Author: Daiki Ueno
74+
+ *
75+
+ * This file is part of GnuTLS.
76+
+ *
77+
+ * GnuTLS is free software; you can redistribute it and/or modify it
78+
+ * under the terms of the GNU General Public License as published by
79+
+ * the Free Software Foundation; either version 3 of the License, or
80+
+ * (at your option) any later version.
81+
+ *
82+
+ * GnuTLS is distributed in the hope that it will be useful, but
83+
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
84+
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
85+
+ * General Public License for more details.
86+
+ *
87+
+ * You should have received a copy of the GNU Lesser General Public License
88+
+ * along with this program. If not, see <https://www.gnu.org/licenses/>
89+
+ */
90+
+
91+
+#ifdef HAVE_CONFIG_H
92+
+#include "config.h"
93+
+#endif
94+
+
95+
+#include <stdbool.h>
96+
+#include <stdio.h>
97+
+#include <stdlib.h>
98+
+
99+
+#if defined(_WIN32)
100+
+
101+
+int main(void)
102+
+{
103+
+ exit(77);
104+
+}
105+
+
106+
+#else
107+
+
108+
+#include <string.h>
109+
+#include <unistd.h>
110+
+#include <gnutls/gnutls.h>
111+
+
112+
+#include "cert-common.h"
113+
+#include "pkcs11/softhsm.h"
114+
+#include "utils.h"
115+
+
116+
+/* This program tests that a token can be initialized with
117+
+ * a label longer than 32 characters.
118+
+ */
119+
+
120+
+static void tls_log_func(int level, const char *str)
121+
+{
122+
+ fprintf(stderr, "server|<%d>| %s", level, str);
123+
+}
124+
+
125+
+#define PIN "1234"
126+
+
127+
+#define CONFIG_NAME "softhsm-long-label"
128+
+#define CONFIG CONFIG_NAME ".config"
129+
+
130+
+static int pin_func(void *userdata, int attempt, const char *url,
131+
+ const char *label, unsigned flags, char *pin,
132+
+ size_t pin_max)
133+
+{
134+
+ if (attempt == 0) {
135+
+ strcpy(pin, PIN);
136+
+ return 0;
137+
+ }
138+
+ return -1;
139+
+}
140+
+
141+
+static void test(const char *provider)
142+
+{
143+
+ int ret;
144+
+ size_t i;
145+
+
146+
+ gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
147+
+
148+
+ success("test with %s\n", provider);
149+
+
150+
+ if (debug) {
151+
+ gnutls_global_set_log_function(tls_log_func);
152+
+ gnutls_global_set_log_level(4711);
153+
+ }
154+
+
155+
+ /* point to SoftHSM token that libpkcs11mock4.so internally uses */
156+
+ setenv(SOFTHSM_ENV, CONFIG, 1);
157+
+
158+
+ gnutls_pkcs11_set_pin_function(pin_func, NULL);
159+
+
160+
+ ret = gnutls_pkcs11_add_provider(provider, "trusted");
161+
+ if (ret != 0) {
162+
+ fail("gnutls_pkcs11_add_provider: %s\n", gnutls_strerror(ret));
163+
+ }
164+
+
165+
+ /* initialize softhsm token */
166+
+ ret = gnutls_pkcs11_token_init(
167+
+ SOFTHSM_URL, PIN,
168+
+ "this is a very long label whose length exceeds 32");
169+
+ if (ret < 0) {
170+
+ fail("gnutls_pkcs11_token_init: %s\n", gnutls_strerror(ret));
171+
+ }
172+
+
173+
+ for (i = 0;; i++) {
174+
+ char *url = NULL;
175+
+
176+
+ ret = gnutls_pkcs11_token_get_url(i, 0, &url);
177+
+ if (ret < 0)
178+
+ break;
179+
+ if (strstr(url,
180+
+ "token=this%20is%20a%20very%20long%20label%20whose"))
181+
+ break;
182+
+ }
183+
+ if (ret < 0)
184+
+ fail("gnutls_pkcs11_token_get_url: %s\n", gnutls_strerror(ret));
185+
+
186+
+ gnutls_pkcs11_deinit();
187+
+}
188+
+
189+
+void doit(void)
190+
+{
191+
+ const char *bin;
192+
+ const char *lib;
193+
+ char buf[128];
194+
+
195+
+ if (gnutls_fips140_mode_enabled())
196+
+ exit(77);
197+
+
198+
+ /* this must be called once in the program */
199+
+ global_init();
200+
+
201+
+ /* we call gnutls_pkcs11_init manually */
202+
+ gnutls_pkcs11_deinit();
203+
+
204+
+ /* check if softhsm module is loadable */
205+
+ lib = softhsm_lib();
206+
+
207+
+ /* initialize SoftHSM token that libpkcs11mock4.so internally uses */
208+
+ bin = softhsm_bin();
209+
+
210+
+ set_softhsm_conf(CONFIG);
211+
+ snprintf(buf, sizeof(buf),
212+
+ "%s --init-token --slot 0 --label test --so-pin " PIN
213+
+ " --pin " PIN,
214+
+ bin);
215+
+ system(buf);
216+
+
217+
+ test(lib);
218+
+
219+
+ lib = getenv("P11MOCKLIB4");
220+
+ if (lib == NULL) {
221+
+ fail("P11MOCKLIB4 is not set\n");
222+
+ }
223+
+
224+
+ set_softhsm_conf(CONFIG);
225+
+ snprintf(buf, sizeof(buf),
226+
+ "%s --init-token --slot 0 --label test --so-pin " PIN
227+
+ " --pin " PIN,
228+
+ bin);
229+
+ system(buf);
230+
+
231+
+ test(lib);
232+
+}
233+
+#endif /* _WIN32 */
234+
--
235+
2.43.0
236+

‎SPECS/gnutls/gnutls.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: The GnuTLS Transport Layer Security Library
22
Name: gnutls
33
Version: 3.8.3
4-
Release: 7%{?dist}
4+
Release: 8%{?dist}
55
License: GPLv3+ AND LGPLv2.1+
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -19,6 +19,7 @@ Patch6: CVE-2025-32989.patch
1919
Patch7: CVE-2025-32988.patch
2020
Patch8: CVE-2025-6395.patch
2121
Patch9: CVE-2025-13151.patch
22+
Patch10: CVE-2025-9820.patch
2223
BuildRequires: autogen-libopts-devel
2324
BuildRequires: gc-devel
2425
BuildRequires: libtasn1-devel
@@ -100,6 +101,9 @@ sed -i 's/TESTS += test-ciphers-openssl.sh//' tests/slow/Makefile.am
100101
%{_mandir}/man3/*
101102

102103
%changelog
104+
* Wed Jan 28 2026 Akhila Guruju <v-guakhila@microsoft.com> - 3.8.3-8
105+
- Patch CVE-2025-9820
106+
103107
* Mon Jan 12 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.8.3-7
104108
- Patch for CVE-2025-13151
105109

0 commit comments

Comments
 (0)