Skip to content

Commit d5206d3

Browse files
azurelinux-securityKanishk Bansal
azurelinux-security
and
Kanishk Bansal
authored
[AutoPR- Security] Patch edk2 for CVE-2026-22796, CVE-2025-69421, CVE-2025-69420, CVE-2025-69418, CVE-2025-68160 [HIGH] (#15702)
Co-authored-by: Kanishk Bansal <kanbansal@microsoft.com>
1 parent 347a49c commit d5206d3

File tree

7 files changed

+341
-2
lines changed

7 files changed

+341
-2
lines changed

‎SPECS-SIGNED/edk2-hvloader-signed/edk2-hvloader-signed.spec‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
Summary: Signed HvLoader.efi for %{buildarch} systems
1212
Name: edk2-hvloader-signed-%{buildarch}
1313
Version: %{GITDATE}git%{GITCOMMIT}
14-
Release: 13%{?dist}
14+
Release: 14%{?dist}
1515
License: MIT
1616
Vendor: Microsoft Corporation
1717
Distribution: Azure Linux
@@ -74,6 +74,9 @@ popd
7474
/boot/efi/HvLoader.efi
7575

7676
%changelog
77+
* Tue Feb 03 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 20240524git3e722403cd16-14
78+
- Bump release for consistency with edk2 spec.
79+
7780
* Sun Feb 01 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 20240524git3e722403cd16-13
7881
- Bump release for consistency with edk2 spec.
7982

‎SPECS/edk2/CVE-2025-68160.patch‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
From 8433c3ab7b435f3ee12a7177e85cb8b16f93aa39 Mon Sep 17 00:00:00 2001
2+
From: Neil Horman <nhorman@openssl.org>
3+
Date: Wed, 7 Jan 2026 11:52:09 -0500
4+
Subject: [PATCH] Fix heap buffer overflow in BIO_f_linebuffer
5+
MIME-Version: 1.0
6+
Content-Type: text/plain; charset=UTF-8
7+
Content-Transfer-Encoding: 8bit
8+
9+
When a FIO_f_linebuffer is part of a bio chain, and the next BIO
10+
preforms short writes, the remainder of the unwritten buffer is copied
11+
unconditionally to the internal buffer ctx->obuf, which may not be
12+
sufficiently sized to handle the remaining data, resulting in a buffer
13+
overflow.
14+
15+
Fix it by only copying data when ctx->obuf has space, flushing to the
16+
next BIO to increase available storage if needed.
17+
18+
Fixes openssl/srt#48
19+
20+
Fixes CVE-2025-68160
21+
22+
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
23+
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
24+
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
25+
Reviewed-by: Tomas Mraz <tomas@openssl.org>
26+
MergeDate: Mon Jan 26 19:41:40 2026
27+
(cherry picked from commit b21663c35a6f0ed4c8de06855bdc7a6a21f00c2f)
28+
Signed-off-by: rpm-build <rpm-build>
29+
Upstream-reference: https://github.com/openssl/openssl/commit/475c466ef2fbd8fc1df6fae1c3eed9c813fc8ff6.patch
30+
---
31+
.../OpensslLib/openssl/crypto/bio/bf_lbuf.c | 32 +++++++++++++++----
32+
1 file changed, 26 insertions(+), 6 deletions(-)
33+
34+
diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/bio/bf_lbuf.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/bio/bf_lbuf.c
35+
index 73f1216..a471b28 100644
36+
--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/bio/bf_lbuf.c
37+
+++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/bio/bf_lbuf.c
38+
@@ -189,14 +189,34 @@ static int linebuffer_write(BIO *b, const char *in, int inl)
39+
while (foundnl && inl > 0);
40+
/*
41+
* We've written as much as we can. The rest of the input buffer, if
42+
- * any, is text that doesn't and with a NL and therefore needs to be
43+
- * saved for the next trip.
44+
+ * any, is text that doesn't end with a NL and therefore we need to try
45+
+ * free up some space in our obuf so we can make forward progress.
46+
*/
47+
- if (inl > 0) {
48+
- memcpy(&(ctx->obuf[ctx->obuf_len]), in, inl);
49+
- ctx->obuf_len += inl;
50+
- num += inl;
51+
+ while (inl > 0) {
52+
+ size_t avail = (size_t)ctx->obuf_size - (size_t)ctx->obuf_len;
53+
+ size_t to_copy;
54+
+
55+
+ if (avail == 0) {
56+
+ /* Flush buffered data to make room */
57+
+ i = BIO_write(b->next_bio, ctx->obuf, ctx->obuf_len);
58+
+ if (i <= 0) {
59+
+ BIO_copy_next_retry(b);
60+
+ return num > 0 ? num : i;
61+
+ }
62+
+ if (i < ctx->obuf_len)
63+
+ memmove(ctx->obuf, ctx->obuf + i, ctx->obuf_len - i);
64+
+ ctx->obuf_len -= i;
65+
+ continue;
66+
+ }
67+
+
68+
+ to_copy = inl > (int)avail ? avail : (size_t)inl;
69+
+ memcpy(&(ctx->obuf[ctx->obuf_len]), in, to_copy);
70+
+ ctx->obuf_len += (int)to_copy;
71+
+ in += to_copy;
72+
+ inl -= (int)to_copy;
73+
+ num += (int)to_copy;
74+
}
75+
+
76+
return num;
77+
}
78+
79+
--
80+
2.45.4
81+

‎SPECS/edk2/CVE-2025-69418.patch‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
From 3adfe1f39f64b4cde3b4c2b2f3c3a1bc50ad4ffe Mon Sep 17 00:00:00 2001
2+
From: Norbert Pocs <norbertp@openssl.org>
3+
Date: Thu, 8 Jan 2026 15:04:54 +0100
4+
Subject: [PATCH] Fix OCB AES-NI/HW stream path unauthenticated/unencrypted
5+
trailing bytes
6+
MIME-Version: 1.0
7+
Content-Type: text/plain; charset=UTF-8
8+
Content-Transfer-Encoding: 8bit
9+
10+
When ctx->stream (e.g., AES‑NI or ARMv8 CE) is available, the fast path
11+
encrypts/decrypts full blocks but does not advance in/out pointers. The
12+
tail-handling code then operates on the base pointers, effectively reprocessing
13+
the beginning of the buffer while leaving the actual trailing bytes
14+
unencrypted (encryption) or using the wrong plaintext (decryption). The
15+
authentication checksum excludes the true tail.
16+
17+
CVE-2025-69418
18+
19+
Fixes: https://github.com/openssl/srt/issues/58
20+
21+
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
22+
23+
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
24+
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
25+
Reviewed-by: Tomas Mraz <tomas@openssl.org>
26+
MergeDate: Mon Jan 26 19:48:35 2026
27+
(cherry picked from commit be9375d5d45dfaf897b56ef148a0b58402491fcb)
28+
Signed-off-by: rpm-build <rpm-build>
29+
Upstream-reference: https://github.com/openssl/openssl/commit/52d23c86a54adab5ee9f80e48b242b52c4cc2347.patch
30+
---
31+
.../Library/OpensslLib/openssl/crypto/modes/ocb128.c | 10 ++++++++--
32+
1 file changed, 8 insertions(+), 2 deletions(-)
33+
34+
diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/modes/ocb128.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/modes/ocb128.c
35+
index b5202ba..95601da 100644
36+
--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/modes/ocb128.c
37+
+++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/modes/ocb128.c
38+
@@ -342,7 +342,7 @@ int CRYPTO_ocb128_encrypt(OCB128_CONTEXT *ctx,
39+
40+
if (num_blocks && all_num_blocks == (size_t)all_num_blocks
41+
&& ctx->stream != NULL) {
42+
- size_t max_idx = 0, top = (size_t)all_num_blocks;
43+
+ size_t max_idx = 0, top = (size_t)all_num_blocks, processed_bytes = 0;
44+
45+
/*
46+
* See how many L_{i} entries we need to process data at hand
47+
@@ -356,6 +356,9 @@ int CRYPTO_ocb128_encrypt(OCB128_CONTEXT *ctx,
48+
ctx->stream(in, out, num_blocks, ctx->keyenc,
49+
(size_t)ctx->sess.blocks_processed + 1, ctx->sess.offset.c,
50+
(const unsigned char (*)[16])ctx->l, ctx->sess.checksum.c);
51+
+ processed_bytes = num_blocks * 16;
52+
+ in += processed_bytes;
53+
+ out += processed_bytes;
54+
} else {
55+
/* Loop through all full blocks to be encrypted */
56+
for (i = ctx->sess.blocks_processed + 1; i <= all_num_blocks; i++) {
57+
@@ -434,7 +437,7 @@ int CRYPTO_ocb128_decrypt(OCB128_CONTEXT *ctx,
58+
59+
if (num_blocks && all_num_blocks == (size_t)all_num_blocks
60+
&& ctx->stream != NULL) {
61+
- size_t max_idx = 0, top = (size_t)all_num_blocks;
62+
+ size_t max_idx = 0, top = (size_t)all_num_blocks, processed_bytes = 0;
63+
64+
/*
65+
* See how many L_{i} entries we need to process data at hand
66+
@@ -448,6 +451,9 @@ int CRYPTO_ocb128_decrypt(OCB128_CONTEXT *ctx,
67+
ctx->stream(in, out, num_blocks, ctx->keydec,
68+
(size_t)ctx->sess.blocks_processed + 1, ctx->sess.offset.c,
69+
(const unsigned char (*)[16])ctx->l, ctx->sess.checksum.c);
70+
+ processed_bytes = num_blocks * 16;
71+
+ in += processed_bytes;
72+
+ out += processed_bytes;
73+
} else {
74+
OCB_BLOCK tmp;
75+
76+
--
77+
2.45.4
78+

‎SPECS/edk2/CVE-2025-69420.patch‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
From 2a7b27649a32878b91c1f0632cca1f502b7ac349 Mon Sep 17 00:00:00 2001
2+
From: Bob Beck <beck@openssl.org>
3+
Date: Wed, 7 Jan 2026 11:29:48 -0700
4+
Subject: [PATCH] Verify ASN1 object's types before attempting to access them
5+
as a particular type
6+
MIME-Version: 1.0
7+
Content-Type: text/plain; charset=UTF-8
8+
Content-Transfer-Encoding: 8bit
9+
10+
Issue was reported in ossl_ess_get_signing_cert but is also present in
11+
ossl_ess_get_signing_cert_v2.
12+
13+
Fixes: https://github.com/openssl/srt/issues/61
14+
Fixes CVE-2025-69420
15+
16+
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
17+
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
18+
Reviewed-by: Tomas Mraz <tomas@openssl.org>
19+
MergeDate: Mon Jan 26 19:53:36 2026
20+
(cherry picked from commit ea8fc4c345fbd749048809c9f7c881ea656b0b94)
21+
Signed-off-by: rpm-build <rpm-build>
22+
Upstream-reference: https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a.patch
23+
---
24+
.../Library/OpensslLib/openssl/crypto/ts/ts_rsp_verify.c | 4 ++--
25+
1 file changed, 2 insertions(+), 2 deletions(-)
26+
27+
diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/ts/ts_rsp_verify.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/ts/ts_rsp_verify.c
28+
index 792a27c..d940c49 100644
29+
--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/ts/ts_rsp_verify.c
30+
+++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/ts/ts_rsp_verify.c
31+
@@ -209,7 +209,7 @@ static ESS_SIGNING_CERT *ossl_ess_get_signing_cert(const PKCS7_SIGNER_INFO *si)
32+
const unsigned char *p;
33+
34+
attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificate);
35+
- if (attr == NULL)
36+
+ if (attr == NULL || attr->type != V_ASN1_SEQUENCE)
37+
return NULL;
38+
p = attr->value.sequence->data;
39+
return d2i_ESS_SIGNING_CERT(NULL, &p, attr->value.sequence->length);
40+
@@ -222,7 +222,7 @@ ESS_SIGNING_CERT_V2 *ossl_ess_get_signing_cert_v2(const PKCS7_SIGNER_INFO *si)
41+
const unsigned char *p;
42+
43+
attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificateV2);
44+
- if (attr == NULL)
45+
+ if (attr == NULL || attr->type != V_ASN1_SEQUENCE)
46+
return NULL;
47+
p = attr->value.sequence->data;
48+
return d2i_ESS_SIGNING_CERT_V2(NULL, &p, attr->value.sequence->length);
49+
--
50+
2.45.4
51+

‎SPECS/edk2/CVE-2025-69421.patch‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
From 8743dcc66b5c38ce0f8eac69fd800001f3868337 Mon Sep 17 00:00:00 2001
2+
From: Andrew Dinh <andrewd@openssl.org>
3+
Date: Thu, 8 Jan 2026 01:24:30 +0900
4+
Subject: [PATCH] PKCS12_item_decrypt_d2i_ex(): Check oct argument for NULL
5+
MIME-Version: 1.0
6+
Content-Type: text/plain; charset=UTF-8
7+
Content-Transfer-Encoding: 8bit
8+
9+
Fixes CVE-2025-69421
10+
11+
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
12+
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
13+
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
14+
Reviewed-by: Tomas Mraz <tomas@openssl.org>
15+
MergeDate: Mon Jan 26 19:56:08 2026
16+
(cherry picked from commit 2c13bf15286328641a805eb3b7c97e27d42881fb)
17+
Signed-off-by: rpm-build <rpm-build>
18+
Upstream-reference: https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7.patch
19+
---
20+
.../Library/OpensslLib/openssl/crypto/pkcs12/p12_decr.c | 5 +++++
21+
1 file changed, 5 insertions(+)
22+
23+
diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_decr.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_decr.c
24+
index a5adafa..2e14a49 100644
25+
--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_decr.c
26+
+++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_decr.c
27+
@@ -137,6 +137,11 @@ void *PKCS12_item_decrypt_d2i_ex(const X509_ALGOR *algor, const ASN1_ITEM *it,
28+
void *ret;
29+
int outlen = 0;
30+
31+
+ if (oct == NULL) {
32+
+ ERR_raise(ERR_LIB_PKCS12, ERR_R_PASSED_NULL_PARAMETER);
33+
+ return NULL;
34+
+ }
35+
+
36+
if (!PKCS12_pbe_crypt_ex(algor, pass, passlen, oct->data, oct->length,
37+
&out, &outlen, 0, libctx, propq))
38+
return NULL;
39+
--
40+
2.45.4
41+

‎SPECS/edk2/CVE-2026-22796.patch‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
From f581ce76c38647656736e8f56912ee65b51ae584 Mon Sep 17 00:00:00 2001
2+
From: Bob Beck <beck@openssl.org>
3+
Date: Wed, 7 Jan 2026 11:29:48 -0700
4+
Subject: [PATCH] Ensure ASN1 types are checked before use.
5+
6+
Some of these were fixed by LibreSSL in commit https://github.com/openbsd/src/commit/aa1f637d454961d22117b4353f98253e984b3ba8
7+
this fix includes the other fixes in that commit, as well as fixes for others found by a scan
8+
for a similar unvalidated access paradigm in the tree.
9+
10+
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
11+
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
12+
Reviewed-by: Tomas Mraz <tomas@openssl.org>
13+
(Merged from https://github.com/openssl/openssl/pull/29582)
14+
15+
Signed-off-by: rpm-build <rpm-build>
16+
Upstream-reference: https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49.patch
17+
---
18+
CryptoPkg/Library/OpensslLib/openssl/apps/s_client.c | 3 ++-
19+
.../OpensslLib/openssl/crypto/pkcs12/p12_kiss.c | 10 ++++++++--
20+
.../Library/OpensslLib/openssl/crypto/pkcs7/pk7_doit.c | 2 ++
21+
3 files changed, 12 insertions(+), 3 deletions(-)
22+
23+
diff --git a/CryptoPkg/Library/OpensslLib/openssl/apps/s_client.c b/CryptoPkg/Library/OpensslLib/openssl/apps/s_client.c
24+
index a914238..a21e0a6 100644
25+
--- a/CryptoPkg/Library/OpensslLib/openssl/apps/s_client.c
26+
+++ b/CryptoPkg/Library/OpensslLib/openssl/apps/s_client.c
27+
@@ -2650,8 +2650,9 @@ int s_client_main(int argc, char **argv)
28+
goto end;
29+
}
30+
atyp = ASN1_generate_nconf(genstr, cnf);
31+
- if (atyp == NULL) {
32+
+ if (atyp == NULL || atyp->type != V_ASN1_SEQUENCE) {
33+
NCONF_free(cnf);
34+
+ ASN1_TYPE_free(atyp);
35+
BIO_printf(bio_err, "ASN1_generate_nconf failed\n");
36+
goto end;
37+
}
38+
diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_kiss.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_kiss.c
39+
index 229b34c..d7e5f2c 100644
40+
--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_kiss.c
41+
+++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs12/p12_kiss.c
42+
@@ -190,11 +190,17 @@ static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen,
43+
ASN1_BMPSTRING *fname = NULL;
44+
ASN1_OCTET_STRING *lkid = NULL;
45+
46+
- if ((attrib = PKCS12_SAFEBAG_get0_attr(bag, NID_friendlyName)))
47+
+ if ((attrib = PKCS12_SAFEBAG_get0_attr(bag, NID_friendlyName))) {
48+
+ if (attrib->type != V_ASN1_BMPSTRING)
49+
+ return 0;
50+
fname = attrib->value.bmpstring;
51+
+ }
52+
53+
- if ((attrib = PKCS12_SAFEBAG_get0_attr(bag, NID_localKeyID)))
54+
+ if ((attrib = PKCS12_SAFEBAG_get0_attr(bag, NID_localKeyID))) {
55+
+ if (attrib->type != V_ASN1_OCTET_STRING)
56+
+ return 0;
57+
lkid = attrib->value.octet_string;
58+
+ }
59+
60+
switch (PKCS12_SAFEBAG_get_nid(bag)) {
61+
case NID_keyBag:
62+
diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs7/pk7_doit.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs7/pk7_doit.c
63+
index f52d64a..f05ed5e 100644
64+
--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs7/pk7_doit.c
65+
+++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs7/pk7_doit.c
66+
@@ -1189,6 +1189,8 @@ ASN1_OCTET_STRING *PKCS7_digest_from_attributes(STACK_OF(X509_ATTRIBUTE) *sk)
67+
ASN1_TYPE *astype;
68+
if ((astype = get_attribute(sk, NID_pkcs9_messageDigest)) == NULL)
69+
return NULL;
70+
+ if (astype->type != V_ASN1_OCTET_STRING)
71+
+ return NULL;
72+
return astype->value.octet_string;
73+
}
74+
75+
--
76+
2.45.4
77+

‎SPECS/edk2/edk2.spec‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ ExclusiveArch: x86_64
5555

5656
Name: edk2
5757
Version: %{GITDATE}git%{GITCOMMIT}
58-
Release: 13%{?dist}
58+
Release: 14%{?dist}
5959
Summary: UEFI firmware for 64-bit virtual machines
6060
License: Apache-2.0 AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-Patent AND BSD-3-Clause AND BSD-4-Clause AND ISC AND MIT AND LicenseRef-Fedora-Public-Domain
6161
URL: https://www.tianocore.org
@@ -143,6 +143,11 @@ Patch1006: CVE-2025-3770.patch
143143
Patch1007: CVE-2025-9230.patch
144144
Patch1008: CVE-2025-15467.patch
145145
Patch1009: CVE-2025-2295.patch
146+
Patch1010: CVE-2025-68160.patch
147+
Patch1011: CVE-2025-69418.patch
148+
Patch1012: CVE-2025-69420.patch
149+
Patch1013: CVE-2025-69421.patch
150+
Patch1014: CVE-2026-22796.patch
146151

147152
# python3-devel and libuuid-devel are required for building tools.
148153
# python3-devel is also needed for varstore template generation and
@@ -804,6 +809,9 @@ done
804809
/boot/efi/HvLoader.efi
805810

806811
%changelog
812+
* Tue Feb 03 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 20240524git3e722403cd16-14
813+
- Patch for CVE-2026-22796, CVE-2025-69421, CVE-2025-69420, CVE-2025-69418, CVE-2025-68160
814+
807815
* Sun Feb 01 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 20240524git3e722403cd16-13
808816
- Patch for CVE-2025-2295
809817

0 commit comments

Comments
 (0)