Skip to content

Commit 8fb8d1c

Browse files
CBL-Mariner-Botazurelinux-securityBinduSri-6522866jslobodzianKanishk Bansal
authored
[AUTO-CHERRYPICK] [AutoPR- Security] Patch edk2 for CVE-2026-22795, CVE-2025-69421, CVE-2025-69419, CVE-2025-69420 [HIGH] - branch main (#15828)
Signed-off-by: Kanishk Bansal <kanbansal@microsoft.com> Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: BinduSri-6522866 <v-badabala@microsoft.com> Co-authored-by: jslobodzian <joslobo@microsoft.com> Co-authored-by: Kanishk Bansal <kanbansal@microsoft.com> Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>
1 parent 547b735 commit 8fb8d1c

6 files changed

Lines changed: 137 additions & 7 deletions

File tree

‎SPECS/edk2/CVE-2025-69419.patch‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
From 56d62202357855589885daaa4deb5b97c635a250 Mon Sep 17 00:00:00 2001
2+
From: AllSpark <allspark@microsoft.com>
3+
Date: Mon, 9 Feb 2026 09:14:39 +0000
4+
Subject: [PATCH] Check return code of UTF8_putc in a_strex.c and p12_utl.c;
5+
handle failures gracefully (backport)
6+
7+
Signed-off-by: rpm-build <rpm-build>
8+
Upstream-reference: AI Backport of https://github.com/openssl/openssl/commit/41be0f216404f14457bbf3b9cc488dba60b49296.patch
9+
---
10+
CryptoPkg/Library/OpensslLib/openssl/crypto/asn1/a_strex.c | 6 ++++--
11+
.../Library/OpensslLib/openssl/crypto/pkcs12/p12_utl.c | 5 +++++
12+
2 files changed, 9 insertions(+), 2 deletions(-)
13+
14+
diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/asn1/a_strex.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/asn1/a_strex.c
15+
index 4879b33..b852e06 100644
16+
--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/asn1/a_strex.c
17+
+++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/asn1/a_strex.c
18+
@@ -203,8 +203,10 @@ static int do_buf(unsigned char *buf, int buflen,
19+
orflags = CHARTYPE_LAST_ESC_2253;
20+
if (type & BUF_TYPE_CONVUTF8) {
21+
unsigned char utfbuf[6];
22+
- int utflen;
23+
- utflen = UTF8_putc(utfbuf, sizeof(utfbuf), c);
24+
+ int utflen = UTF8_putc(utfbuf, sizeof(utfbuf), c);
25+
+
26+
+ if (utflen < 0)
27+
+ return -1; /* error happened with UTF8 */
28+
for (i = 0; i < utflen; i++) {
29+
/*
30+
* We don't need to worry about setting orflags correctly
31+
diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_utl.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_utl.c
32+
index 43b9e3a..4998fcc 100644
33+
--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_utl.c
34+
+++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_utl.c
35+
@@ -207,6 +207,11 @@ char *OPENSSL_uni2utf8(const unsigned char *uni, int unilen)
36+
/* re-run the loop emitting UTF-8 string */
37+
for (asclen = 0, i = 0; i < unilen; ) {
38+
j = bmp_to_utf8(asctmp+asclen, uni+i, unilen-i);
39+
+ /* when UTF8_putc fails */
40+
+ if (j < 0) {
41+
+ OPENSSL_free(asctmp);
42+
+ return NULL;
43+
+ }
44+
if (j == 4) i += 4;
45+
else i += 2;
46+
asclen += j;
47+
--
48+
2.45.4
49+

‎SPECS/edk2/CVE-2025-69420.patch‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
From 3268f491a18d4567460ebc7e284ce2da9778bf18 Mon Sep 17 00:00:00 2001
2+
From: AllSpark <allspark@microsoft.com>
3+
Date: Mon, 9 Feb 2026 09:13:29 +0000
4+
Subject: [PATCH] Verify ASN1 object's types before accessing sequence in
5+
ess_get_signing_cert/v2 to avoid invalid type access.
6+
7+
Signed-off-by: rpm-build <rpm-build>
8+
Upstream-reference: AI Backport of https://github.com/openssl/openssl/commit/ea8fc4c345fbd749048809c9f7c881ea656b0b94.patch
9+
---
10+
.../Library/OpensslLib/openssl/crypto/ts/ts_rsp_verify.c | 4 ++--
11+
1 file changed, 2 insertions(+), 2 deletions(-)
12+
13+
diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/ts/ts_rsp_verify.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/ts/ts_rsp_verify.c
14+
index c2e7abd..156958c 100644
15+
--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/ts/ts_rsp_verify.c
16+
+++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/ts/ts_rsp_verify.c
17+
@@ -262,7 +262,7 @@ static ESS_SIGNING_CERT *ess_get_signing_cert(PKCS7_SIGNER_INFO *si)
18+
ASN1_TYPE *attr;
19+
const unsigned char *p;
20+
attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificate);
21+
- if (!attr)
22+
+ if (attr == NULL || attr->type != V_ASN1_SEQUENCE)
23+
return NULL;
24+
p = attr->value.sequence->data;
25+
return d2i_ESS_SIGNING_CERT(NULL, &p, attr->value.sequence->length);
26+
@@ -274,7 +274,7 @@ static ESS_SIGNING_CERT_V2 *ess_get_signing_cert_v2(PKCS7_SIGNER_INFO *si)
27+
const unsigned char *p;
28+
29+
attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificateV2);
30+
- if (attr == NULL)
31+
+ if (attr == NULL || attr->type != V_ASN1_SEQUENCE)
32+
return NULL;
33+
p = attr->value.sequence->data;
34+
return d2i_ESS_SIGNING_CERT_V2(NULL, &p, attr->value.sequence->length);
35+
--
36+
2.45.4
37+

‎SPECS/edk2/CVE-2025-69421.patch‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
From 3a1e9f9341230d304e7ce341c651188bd6af93f8 Mon Sep 17 00:00:00 2001
2+
From: AllSpark <allspark@microsoft.com>
3+
Date: Mon, 9 Feb 2026 09:13:55 +0000
4+
Subject: [PATCH] PKCS12_item_decrypt_d2i_ex(): Check oct argument for NULL
5+
6+
Fixes CVE-2025-69421
7+
8+
(cherry picked from commit 2c13bf15286328641a805eb3b7c97e27d42881fb)
9+
10+
Backport: This tree lacks PKCS12_item_decrypt_d2i_ex and ERR_raise, so we add the NULL check in PKCS12_item_decrypt_d2i and report ERR_R_PASSED_NULL_PARAMETER via PKCS12err.
11+
Signed-off-by: rpm-build <rpm-build>
12+
Upstream-reference: AI Backport of https://github.com/openssl/openssl/commit/2c13bf15286328641a805eb3b7c97e27d42881fb.patch
13+
---
14+
.../Library/OpensslLib/openssl/crypto/pkcs12/p12_decr.c | 6 ++++++
15+
1 file changed, 6 insertions(+)
16+
17+
diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_decr.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_decr.c
18+
index 3c86058..bb9491c 100644
19+
--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_decr.c
20+
+++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_decr.c
21+
@@ -88,6 +88,12 @@ void *PKCS12_item_decrypt_d2i(const X509_ALGOR *algor, const ASN1_ITEM *it,
22+
void *ret;
23+
int outlen;
24+
25+
+
26+
+ if (oct == NULL) {
27+
+ PKCS12err(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I, ERR_R_PASSED_NULL_PARAMETER);
28+
+ return NULL;
29+
+ }
30+
+
31+
if (!PKCS12_pbe_crypt(algor, pass, passlen, oct->data, oct->length,
32+
&out, &outlen, 0)) {
33+
PKCS12err(PKCS12_F_PKCS12_ITEM_DECRYPT_D2I,
34+
--
35+
2.45.4
36+

SPECS/edk2/CVE-2026-22796.patch renamed to SPECS/edk2/CVE-2026-22795.patch

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
From 4e90b4cffa497bdc711d985f40b61bd4939b0776 Mon Sep 17 00:00:00 2001
1+
From 1bef0f0a772f6b8229d1bcc85187a076394aa468 Mon Sep 17 00:00:00 2001
22
From: Bob Beck <beck@openssl.org>
33
Date: Wed, 7 Jan 2026 11:29:48 -0700
44
Subject: [PATCH] Ensure ASN1 types are checked before use.

‎SPECS/edk2/CVE-2026-22796.nopatch‎

Whitespace-only changes.

‎SPECS/edk2/edk2.spec‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ ExclusiveArch: x86_64
4545

4646
Name: edk2
4747
Version: %{GITDATE}git%{GITCOMMIT}
48-
Release: 46%{?dist}
48+
Release: 47%{?dist}
4949
Summary: UEFI firmware for 64-bit virtual machines
5050
License: BSD-2-Clause-Patent and OpenSSL and MIT
5151
URL: http://www.tianocore.org
@@ -135,9 +135,13 @@ Patch1005: vendored-openssl-1.1.1-Only-free-the-read-buffers-if-we-re-not-using-
135135
Patch1006: CVE-2022-4304.patch
136136
Patch1007: CVE-2025-3770.patch
137137
Patch1008: CVE-2025-2295.patch
138-
Patch1009: CVE-2025-68160.patch
139-
Patch1010: CVE-2025-69418.patch
140-
Patch1011: CVE-2026-22796.patch
138+
Patch1009: CVE-2025-69419.patch
139+
Patch1010: CVE-2025-69420.patch
140+
Patch1011: CVE-2025-69421.patch
141+
Patch1012: CVE-2026-22795.patch
142+
Patch1013: CVE-2025-68160.patch
143+
Patch1014: CVE-2025-69418.patch
144+
Patch1015: CVE-2026-22796.nopatch
141145

142146
# python3-devel and libuuid-devel are required for building tools.
143147
# python3-devel is also needed for varstore template generation and
@@ -721,8 +725,12 @@ $tests_ok
721725

722726

723727
%changelog
724-
* Mon Feb 02 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 20230301gitf80f052277c8-46
725-
- Patch for CVE-2026-22796, CVE-2025-69418, CVE-2025-68160
728+
* Thu Feb 12 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 20230301gitf80f052277c8-47
729+
- Patch for CVE-2025-69418, CVE-2025-68160
730+
- Add nopatch for CVE-2026-22796 (fixed with CVE-2026-22795)
731+
732+
* Mon Feb 09 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 20230301gitf80f052277c8-46
733+
- Patch for CVE-2026-22795, CVE-2025-69421, CVE-2025-69419, CVE-2025-69420
726734

727735
* Tue Jan 06 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 20230301gitf80f052277c8-45
728736
- Patch for CVE-2025-2295

0 commit comments

Comments
 (0)