summaryrefslogtreecommitdiffstats
path: root/meta-networking
diff options
context:
space:
mode:
authorAnkur Tyagi <ankur.tyagi85@gmail.com>2026-01-09 22:28:41 +1300
committerAnuj Mittal <anuj.mittal@oss.qualcomm.com>2026-01-12 08:12:18 +0530
commitc49bff12733a0c7581eab7b6eb9e2646cee6c928 (patch)
tree2a3ef2f368e4a5cb21b94459559ab7f1fb39f53a /meta-networking
parentdf26bbaabaeb46dc88576966cd61bec1acc63a2d (diff)
downloadmeta-openembedded-c49bff12733a0c7581eab7b6eb9e2646cee6c928.tar.gz
wolfssl: patch CVE-2025-7394
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-7394 Backport patches from the PR[1][2][3] mentioned in the changelog[4]. [1] https://github.com/wolfSSL/wolfssl/pull/8849 [2] https://github.com/wolfSSL/wolfssl/pull/8867 [3] https://github.com/wolfSSL/wolfssl/pull/8898 [4] https://github.com/wolfSSL/wolfssl/blob/master/ChangeLog.md#wolfssl-release-582-july-17-2025 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Diffstat (limited to 'meta-networking')
-rw-r--r--meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-1.patch46
-rw-r--r--meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-2.patch275
-rw-r--r--meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-3.patch125
-rw-r--r--meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-4.patch85
-rw-r--r--meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-5.patch40
-rw-r--r--meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-6.patch48
-rw-r--r--meta-networking/recipes-connectivity/wolfssl/wolfssl_5.7.2.bb6
7 files changed, 625 insertions, 0 deletions
diff --git a/meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-1.patch b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-1.patch
new file mode 100644
index 0000000000..e561b266f0
--- /dev/null
+++ b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-1.patch
@@ -0,0 +1,46 @@
1From 6d0ee56813d69eee72108e1dc859743e02f70077 Mon Sep 17 00:00:00 2001
2From: Josh Holtrop <josh@wolfssl.com>
3Date: Thu, 5 Jun 2025 19:48:34 -0400
4Subject: [PATCH] Reseed DRBG in RAND_poll()
5
6CVE: CVE-2025-7394
7Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/0c12337194ee6dd082f082f0ccaed27fc4ee44f5]
8(cherry picked from commit 0c12337194ee6dd082f082f0ccaed27fc4ee44f5)
9Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
10---
11 src/ssl.c | 20 +++++++++++++++++---
12 1 file changed, 17 insertions(+), 3 deletions(-)
13
14diff --git a/src/ssl.c b/src/ssl.c
15index 9ba891d62..a1421d523 100644
16--- a/src/ssl.c
17+++ b/src/ssl.c
18@@ -24159,11 +24159,25 @@ int wolfSSL_RAND_poll(void)
19 return WOLFSSL_FAILURE;
20 }
21 ret = wc_GenerateSeed(&globalRNG.seed, entropy, entropy_sz);
22- if (ret != 0){
23+ if (ret != 0) {
24 WOLFSSL_MSG("Bad wc_RNG_GenerateBlock");
25 ret = WOLFSSL_FAILURE;
26- }else
27- ret = WOLFSSL_SUCCESS;
28+ }
29+ else {
30+#ifdef HAVE_HASHDRBG
31+ ret = wc_RNG_DRBG_Reseed(&globalRNG, entropy, entropy_sz);
32+ if (ret != 0) {
33+ WOLFSSL_MSG("Error reseeding DRBG");
34+ ret = WOLFSSL_FAILURE;
35+ }
36+ else {
37+ ret = WOLFSSL_SUCCESS;
38+ }
39+#else
40+ WOLFSSL_MSG("RAND_poll called with HAVE_HASHDRBG not set");
41+ ret = WOLFSSL_FAILURE;
42+#endif
43+ }
44
45 return ret;
46 }
diff --git a/meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-2.patch b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-2.patch
new file mode 100644
index 0000000000..883a5a1137
--- /dev/null
+++ b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-2.patch
@@ -0,0 +1,275 @@
1From b506ed4aeb2c86788422427624a03eb9bda52efc Mon Sep 17 00:00:00 2001
2From: JacobBarthelmeh <jacob@wolfssl.com>
3Date: Tue, 10 Jun 2025 12:49:08 -0600
4Subject: [PATCH] add sanity checks on pid with RNG
5
6CVE: CVE-2025-7394
7Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/31490ab813a5aac096f50800c26c690d8ae586d2]
8Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
9---
10 CMakeLists.txt | 1 +
11 configure.ac | 4 +-
12 src/ssl.c | 40 +++++++++++-
13 wolfcrypt/src/random.c | 126 ++++++++++++++++++++++---------------
14 wolfssl/wolfcrypt/random.h | 3 +
15 5 files changed, 118 insertions(+), 56 deletions(-)
16
17diff --git a/CMakeLists.txt b/CMakeLists.txt
18index 4e6f05fc6..910a36648 100644
19--- a/CMakeLists.txt
20+++ b/CMakeLists.txt
21@@ -124,6 +124,7 @@ check_function_exists("memset" HAVE_MEMSET)
22 check_function_exists("socket" HAVE_SOCKET)
23 check_function_exists("strftime" HAVE_STRFTIME)
24 check_function_exists("__atomic_fetch_add" HAVE_C___ATOMIC)
25+check_function_exists("getpid" HAVE_GETPID)
26
27 include(CheckTypeSize)
28
29diff --git a/configure.ac b/configure.ac
30index c973b7e39..43ddd4767 100644
31--- a/configure.ac
32+++ b/configure.ac
33@@ -125,8 +125,8 @@ AC_CHECK_HEADER(stdatomic.h, [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSL_HAVE_ATOMIC_H"
34 # check if functions of interest are linkable, but also check if
35 # they're declared by the expected headers, and if not, supersede the
36 # unusable positive from AC_CHECK_FUNCS().
37-AC_CHECK_FUNCS([gethostbyname getaddrinfo gettimeofday gmtime_r gmtime_s inet_ntoa memset socket strftime atexit])
38-AC_CHECK_DECLS([gethostbyname, getaddrinfo, gettimeofday, gmtime_r, gmtime_s, inet_ntoa, memset, socket, strftime, atexit], [], [
39+AC_CHECK_FUNCS([gethostbyname getaddrinfo gettimeofday gmtime_r gmtime_s inet_ntoa memset socket strftime atexit getpid])
40+AC_CHECK_DECLS([gethostbyname, getaddrinfo, gettimeofday, gmtime_r, gmtime_s, inet_ntoa, memset, socket, strftime, atexit, getpid], [], [
41 if test "$(eval echo \$"$(eval 'echo ac_cv_func_${as_decl_name}')")" = "yes"
42 then
43 AC_MSG_NOTICE([ note: earlier check for $(eval 'echo ${as_decl_name}') superseded.])
44diff --git a/src/ssl.c b/src/ssl.c
45index a1421d523..872aed594 100644
46--- a/src/ssl.c
47+++ b/src/ssl.c
48@@ -23615,6 +23615,10 @@ int wolfSSL_RAND_Init(void)
49 if (initGlobalRNG == 0) {
50 ret = wc_InitRng(&globalRNG);
51 if (ret == 0) {
52+ #if defined(HAVE_GETPID) && defined(HAVE_FIPS) && \
53+ FIPS_VERSION3_LT(6,0,0)))
54+ currentPid = getpid();
55+ #endif
56 initGlobalRNG = 1;
57 ret = WOLFSSL_SUCCESS;
58 }
59@@ -24045,8 +24049,30 @@ int wolfSSL_RAND_pseudo_bytes(unsigned char* buf, int num)
60 return ret;
61 }
62
63-/* returns WOLFSSL_SUCCESS if the bytes generated are valid otherwise
64- * WOLFSSL_FAILURE */
65+#if defined(HAVE_GETPID) && defined(HAVE_FIPS) && FIPS_VERSION3_LT(6,0,0)))
66+/* In older FIPS bundles add check for reseed here since it does not exist in
67+ * the older random.c certified files. */
68+static pid_t currentPid = 0;
69+
70+/* returns WOLFSSL_SUCCESS on success and WOLFSSL_FAILURE on failure */
71+static int RandCheckReSeed()
72+{
73+ int ret = WOLFSSL_SUCCESS;
74+ pid_t p;
75+
76+ p = getpid();
77+ if (p != currentPid) {
78+ currentPid = p;
79+ if (wolfSSL_RAND_poll() != WOLFSSL_SUCCESS) {
80+ ret = WOLFSSL_FAILURE;
81+ }
82+ }
83+ return ret;
84+}
85+#endif
86+
87+/* returns WOLFSSL_SUCCESS (1) if the bytes generated are valid otherwise 0
88+ * on failure */
89 int wolfSSL_RAND_bytes(unsigned char* buf, int num)
90 {
91 int ret = 0;
92@@ -24089,6 +24115,16 @@ int wolfSSL_RAND_bytes(unsigned char* buf, int num)
93 */
94 if (initGlobalRNG) {
95 rng = &globalRNG;
96+
97+ #if defined(HAVE_GETPID) && defined(HAVE_FIPS) && \
98+ FIPS_VERSION3_LT(6,0,0)))
99+ if (RandCheckReSeed() != WOLFSSL_SUCCESS) {
100+ wc_UnLockMutex(&globalRNGMutex);
101+ WOLFSSL_MSG("Issue with check pid and reseed");
102+ return ret;
103+ }
104+ #endif
105+
106 used_global = 1;
107 }
108 else {
109diff --git a/wolfcrypt/src/random.c b/wolfcrypt/src/random.c
110index 89c7411c9..b440e274b 100644
111--- a/wolfcrypt/src/random.c
112+++ b/wolfcrypt/src/random.c
113@@ -1599,6 +1599,9 @@ static int _InitRng(WC_RNG* rng, byte* nonce, word32 nonceSz,
114 #else
115 rng->heap = heap;
116 #endif
117+#ifdef HAVE_GETPID
118+ rng->pid = getpid();
119+#endif
120 #if defined(WOLFSSL_ASYNC_CRYPT) || defined(WOLF_CRYPTO_CB)
121 rng->devId = devId;
122 #if defined(WOLF_CRYPTO_CB)
123@@ -1849,6 +1852,63 @@ int wc_InitRngNonce_ex(WC_RNG* rng, byte* nonce, word32 nonceSz,
124 return _InitRng(rng, nonce, nonceSz, heap, devId);
125 }
126
127+#ifdef HAVE_HASHDRBG
128+static int PollAndReSeed(WC_RNG* rng)
129+{
130+ int ret = DRBG_NEED_RESEED;
131+ int devId = INVALID_DEVID;
132+#if defined(WOLFSSL_ASYNC_CRYPT) || defined(WOLF_CRYPTO_CB)
133+ devId = rng->devId;
134+#endif
135+ if (wc_RNG_HealthTestLocal(1, rng->heap, devId) == 0) {
136+ #ifndef WOLFSSL_SMALL_STACK
137+ byte newSeed[SEED_SZ + SEED_BLOCK_SZ];
138+ ret = DRBG_SUCCESS;
139+ #else
140+ byte* newSeed = (byte*)XMALLOC(SEED_SZ + SEED_BLOCK_SZ, rng->heap,
141+ DYNAMIC_TYPE_SEED);
142+ ret = (newSeed == NULL) ? MEMORY_E : DRBG_SUCCESS;
143+ #endif
144+ if (ret == DRBG_SUCCESS) {
145+ #ifdef WC_RNG_SEED_CB
146+ if (seedCb == NULL) {
147+ ret = DRBG_NO_SEED_CB;
148+ }
149+ else {
150+ ret = seedCb(&rng->seed, newSeed, SEED_SZ + SEED_BLOCK_SZ);
151+ if (ret != 0) {
152+ ret = DRBG_FAILURE;
153+ }
154+ }
155+ #else
156+ ret = wc_GenerateSeed(&rng->seed, newSeed,
157+ SEED_SZ + SEED_BLOCK_SZ);
158+ #endif
159+ if (ret != 0)
160+ ret = DRBG_FAILURE;
161+ }
162+ if (ret == DRBG_SUCCESS)
163+ ret = wc_RNG_TestSeed(newSeed, SEED_SZ + SEED_BLOCK_SZ);
164+
165+ if (ret == DRBG_SUCCESS)
166+ ret = Hash_DRBG_Reseed((DRBG_internal *)rng->drbg,
167+ newSeed + SEED_BLOCK_SZ, SEED_SZ);
168+ #ifdef WOLFSSL_SMALL_STACK
169+ if (newSeed != NULL) {
170+ ForceZero(newSeed, SEED_SZ + SEED_BLOCK_SZ);
171+ }
172+ XFREE(newSeed, rng->heap, DYNAMIC_TYPE_SEED);
173+ #else
174+ ForceZero(newSeed, sizeof(newSeed));
175+ #endif
176+ }
177+ else {
178+ ret = DRBG_CONT_FAILURE;
179+ }
180+
181+ return ret;
182+}
183+#endif
184
185 /* place a generated block in output */
186 WOLFSSL_ABI
187@@ -1908,60 +1968,22 @@ int wc_RNG_GenerateBlock(WC_RNG* rng, byte* output, word32 sz)
188 if (rng->status != DRBG_OK)
189 return RNG_FAILURE_E;
190
191+#ifdef HAVE_GETPID
192+ if (rng->pid != getpid()) {
193+ rng->pid = getpid();
194+ ret = PollAndReSeed(rng);
195+ if (ret != DRBG_SUCCESS) {
196+ rng->status = DRBG_FAILED;
197+ return RNG_FAILURE_E;
198+ }
199+ }
200+#endif
201+
202 ret = Hash_DRBG_Generate((DRBG_internal *)rng->drbg, output, sz);
203 if (ret == DRBG_NEED_RESEED) {
204- int devId = INVALID_DEVID;
205- #if defined(WOLFSSL_ASYNC_CRYPT) || defined(WOLF_CRYPTO_CB)
206- devId = rng->devId;
207- #endif
208- if (wc_RNG_HealthTestLocal(1, rng->heap, devId) == 0) {
209- #ifndef WOLFSSL_SMALL_STACK
210- byte newSeed[SEED_SZ + SEED_BLOCK_SZ];
211- ret = DRBG_SUCCESS;
212- #else
213- byte* newSeed = (byte*)XMALLOC(SEED_SZ + SEED_BLOCK_SZ, rng->heap,
214- DYNAMIC_TYPE_SEED);
215- ret = (newSeed == NULL) ? MEMORY_E : DRBG_SUCCESS;
216- #endif
217- if (ret == DRBG_SUCCESS) {
218- #ifdef WC_RNG_SEED_CB
219- if (seedCb == NULL) {
220- ret = DRBG_NO_SEED_CB;
221- }
222- else {
223- ret = seedCb(&rng->seed, newSeed, SEED_SZ + SEED_BLOCK_SZ);
224- if (ret != 0) {
225- ret = DRBG_FAILURE;
226- }
227- }
228- #else
229- ret = wc_GenerateSeed(&rng->seed, newSeed,
230- SEED_SZ + SEED_BLOCK_SZ);
231- #endif
232- if (ret != 0)
233- ret = DRBG_FAILURE;
234- }
235- if (ret == DRBG_SUCCESS)
236- ret = wc_RNG_TestSeed(newSeed, SEED_SZ + SEED_BLOCK_SZ);
237-
238- if (ret == DRBG_SUCCESS)
239- ret = Hash_DRBG_Reseed((DRBG_internal *)rng->drbg,
240- newSeed + SEED_BLOCK_SZ, SEED_SZ);
241- if (ret == DRBG_SUCCESS)
242- ret = Hash_DRBG_Generate((DRBG_internal *)rng->drbg, output, sz);
243-
244- #ifdef WOLFSSL_SMALL_STACK
245- if (newSeed != NULL) {
246- ForceZero(newSeed, SEED_SZ + SEED_BLOCK_SZ);
247- }
248- XFREE(newSeed, rng->heap, DYNAMIC_TYPE_SEED);
249- #else
250- ForceZero(newSeed, sizeof(newSeed));
251- #endif
252- }
253- else {
254- ret = DRBG_CONT_FAILURE;
255- }
256+ ret = PollAndReSeed(rng);
257+ if (ret == DRBG_SUCCESS)
258+ ret = Hash_DRBG_Generate((DRBG_internal *)rng->drbg, output, sz);
259 }
260
261 if (ret == DRBG_SUCCESS) {
262diff --git a/wolfssl/wolfcrypt/random.h b/wolfssl/wolfcrypt/random.h
263index 9dd616328..f472e1f40 100644
264--- a/wolfssl/wolfcrypt/random.h
265+++ b/wolfssl/wolfcrypt/random.h
266@@ -183,6 +183,9 @@ struct WC_RNG {
267 #endif
268 byte status;
269 #endif
270+#ifdef HAVE_GETPID
271+ pid_t pid;
272+#endif
273 #ifdef WOLFSSL_ASYNC_CRYPT
274 WC_ASYNC_DEV asyncDev;
275 #endif
diff --git a/meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-3.patch b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-3.patch
new file mode 100644
index 0000000000..e70a3fec80
--- /dev/null
+++ b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-3.patch
@@ -0,0 +1,125 @@
1From 62a3a4f0b8b307bdacc34204db44627521de4bf9 Mon Sep 17 00:00:00 2001
2From: JacobBarthelmeh <jacob@wolfssl.com>
3Date: Tue, 10 Jun 2025 14:15:38 -0600
4Subject: [PATCH] add mutex locking and compat layer FIPS case
5
6CVE: CVE-2025-7394
7Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/fbbb6b7707f7f8ae1c38ab68daec0af02ee0208a]
8(cherry picked from commit fbbb6b7707f7f8ae1c38ab68daec0af02ee0208a)
9Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
10---
11 src/ssl.c | 62 +++++++++++++++++++++++++++----------------------------
12 1 file changed, 31 insertions(+), 31 deletions(-)
13
14diff --git a/src/ssl.c b/src/ssl.c
15index 872aed594..f0186b253 100644
16--- a/src/ssl.c
17+++ b/src/ssl.c
18@@ -23603,6 +23603,12 @@ static int wolfSSL_RAND_InitMutex(void)
19
20 #ifdef OPENSSL_EXTRA
21
22+#if defined(HAVE_GETPID) && defined(HAVE_FIPS) && FIPS_VERSION3_LT(6,0,0)
23+/* In older FIPS bundles add check for reseed here since it does not exist in
24+ * the older random.c certified files. */
25+static pid_t currentRandPid = 0;
26+#endif
27+
28 /* Checks if the global RNG has been created. If not then one is created.
29 *
30 * Returns WOLFSSL_SUCCESS when no error is encountered.
31@@ -23616,8 +23622,8 @@ int wolfSSL_RAND_Init(void)
32 ret = wc_InitRng(&globalRNG);
33 if (ret == 0) {
34 #if defined(HAVE_GETPID) && defined(HAVE_FIPS) && \
35- FIPS_VERSION3_LT(6,0,0)))
36- currentPid = getpid();
37+ FIPS_VERSION3_LT(6,0,0)
38+ currentRandPid = getpid();
39 #endif
40 initGlobalRNG = 1;
41 ret = WOLFSSL_SUCCESS;
42@@ -24049,28 +24055,6 @@ int wolfSSL_RAND_pseudo_bytes(unsigned char* buf, int num)
43 return ret;
44 }
45
46-#if defined(HAVE_GETPID) && defined(HAVE_FIPS) && FIPS_VERSION3_LT(6,0,0)))
47-/* In older FIPS bundles add check for reseed here since it does not exist in
48- * the older random.c certified files. */
49-static pid_t currentPid = 0;
50-
51-/* returns WOLFSSL_SUCCESS on success and WOLFSSL_FAILURE on failure */
52-static int RandCheckReSeed()
53-{
54- int ret = WOLFSSL_SUCCESS;
55- pid_t p;
56-
57- p = getpid();
58- if (p != currentPid) {
59- currentPid = p;
60- if (wolfSSL_RAND_poll() != WOLFSSL_SUCCESS) {
61- ret = WOLFSSL_FAILURE;
62- }
63- }
64- return ret;
65-}
66-#endif
67-
68 /* returns WOLFSSL_SUCCESS (1) if the bytes generated are valid otherwise 0
69 * on failure */
70 int wolfSSL_RAND_bytes(unsigned char* buf, int num)
71@@ -24114,17 +24098,27 @@ int wolfSSL_RAND_bytes(unsigned char* buf, int num)
72 * have the lock.
73 */
74 if (initGlobalRNG) {
75- rng = &globalRNG;
76-
77 #if defined(HAVE_GETPID) && defined(HAVE_FIPS) && \
78- FIPS_VERSION3_LT(6,0,0)))
79- if (RandCheckReSeed() != WOLFSSL_SUCCESS) {
80+ FIPS_VERSION3_LT(6,0,0)
81+ pid_t p;
82+
83+ p = getpid();
84+ if (p != currentRandPid) {
85 wc_UnLockMutex(&globalRNGMutex);
86- WOLFSSL_MSG("Issue with check pid and reseed");
87- return ret;
88+ if (wolfSSL_RAND_poll() != WOLFSSL_SUCCESS) {
89+ WOLFSSL_MSG("Issue with check pid and reseed");
90+ ret = WOLFSSL_FAILURE;
91+ }
92+
93+ /* reclaim lock after wolfSSL_RAND_poll */
94+ if (wc_LockMutex(&globalRNGMutex) != 0) {
95+ WOLFSSL_MSG("Bad Lock Mutex rng");
96+ return ret;
97+ }
98+ currentRandPid = p;
99 }
100 #endif
101-
102+ rng = &globalRNG;
103 used_global = 1;
104 }
105 else {
106@@ -24201,6 +24195,11 @@ int wolfSSL_RAND_poll(void)
107 }
108 else {
109 #ifdef HAVE_HASHDRBG
110+ if (wc_LockMutex(&globalRNGMutex) != 0) {
111+ WOLFSSL_MSG("Bad Lock Mutex rng");
112+ return ret;
113+ }
114+
115 ret = wc_RNG_DRBG_Reseed(&globalRNG, entropy, entropy_sz);
116 if (ret != 0) {
117 WOLFSSL_MSG("Error reseeding DRBG");
118@@ -24209,6 +24208,7 @@ int wolfSSL_RAND_poll(void)
119 else {
120 ret = WOLFSSL_SUCCESS;
121 }
122+ wc_UnLockMutex(&globalRNGMutex);
123 #else
124 WOLFSSL_MSG("RAND_poll called with HAVE_HASHDRBG not set");
125 ret = WOLFSSL_FAILURE;
diff --git a/meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-4.patch b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-4.patch
new file mode 100644
index 0000000000..7d6413f7ca
--- /dev/null
+++ b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-4.patch
@@ -0,0 +1,85 @@
1From d7a68e85ebe4705e7345b0e5012c806615cd86c7 Mon Sep 17 00:00:00 2001
2From: JacobBarthelmeh <jacob@wolfssl.com>
3Date: Tue, 10 Jun 2025 16:12:09 -0600
4Subject: [PATCH] add a way to restore previous pid behavior
5
6CVE: CVE-2025-7394
7Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/47cf634965a3aabe82fd97a8feed9efd6688e34a]
8Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
9---
10 src/ssl.c | 11 ++++++-----
11 wolfcrypt/src/random.c | 4 ++--
12 wolfssl/wolfcrypt/random.h | 2 +-
13 3 files changed, 9 insertions(+), 8 deletions(-)
14
15diff --git a/src/ssl.c b/src/ssl.c
16index f0186b253..e214fa504 100644
17--- a/src/ssl.c
18+++ b/src/ssl.c
19@@ -23603,7 +23603,8 @@ static int wolfSSL_RAND_InitMutex(void)
20
21 #ifdef OPENSSL_EXTRA
22
23-#if defined(HAVE_GETPID) && defined(HAVE_FIPS) && FIPS_VERSION3_LT(6,0,0)
24+#if defined(HAVE_GETPID) && !defined(WOLFSSL_NO_GETPID) && \
25+ defined(HAVE_FIPS) && FIPS_VERSION3_LT(6,0,0)
26 /* In older FIPS bundles add check for reseed here since it does not exist in
27 * the older random.c certified files. */
28 static pid_t currentRandPid = 0;
29@@ -23621,8 +23622,8 @@ int wolfSSL_RAND_Init(void)
30 if (initGlobalRNG == 0) {
31 ret = wc_InitRng(&globalRNG);
32 if (ret == 0) {
33- #if defined(HAVE_GETPID) && defined(HAVE_FIPS) && \
34- FIPS_VERSION3_LT(6,0,0)
35+ #if defined(HAVE_GETPID) && !defined(WOLFSSL_NO_GETPID) && \
36+ defined(HAVE_FIPS) && FIPS_VERSION3_LT(6,0,0)
37 currentRandPid = getpid();
38 #endif
39 initGlobalRNG = 1;
40@@ -24098,8 +24099,8 @@ int wolfSSL_RAND_bytes(unsigned char* buf, int num)
41 * have the lock.
42 */
43 if (initGlobalRNG) {
44- #if defined(HAVE_GETPID) && defined(HAVE_FIPS) && \
45- FIPS_VERSION3_LT(6,0,0)
46+ #if defined(HAVE_GETPID) && !defined(WOLFSSL_NO_GETPID) && \
47+ defined(HAVE_FIPS) && FIPS_VERSION3_LT(6,0,0)
48 pid_t p;
49
50 p = getpid();
51diff --git a/wolfcrypt/src/random.c b/wolfcrypt/src/random.c
52index b440e274b..dc89db542 100644
53--- a/wolfcrypt/src/random.c
54+++ b/wolfcrypt/src/random.c
55@@ -1599,7 +1599,7 @@ static int _InitRng(WC_RNG* rng, byte* nonce, word32 nonceSz,
56 #else
57 rng->heap = heap;
58 #endif
59-#ifdef HAVE_GETPID
60+#if defined(HAVE_GETPID) && !defined(WOLFSSL_NO_GETPID)
61 rng->pid = getpid();
62 #endif
63 #if defined(WOLFSSL_ASYNC_CRYPT) || defined(WOLF_CRYPTO_CB)
64@@ -1968,7 +1968,7 @@ int wc_RNG_GenerateBlock(WC_RNG* rng, byte* output, word32 sz)
65 if (rng->status != DRBG_OK)
66 return RNG_FAILURE_E;
67
68-#ifdef HAVE_GETPID
69+#if defined(HAVE_GETPID) && !defined(WOLFSSL_NO_GETPID)
70 if (rng->pid != getpid()) {
71 rng->pid = getpid();
72 ret = PollAndReSeed(rng);
73diff --git a/wolfssl/wolfcrypt/random.h b/wolfssl/wolfcrypt/random.h
74index f472e1f40..320641548 100644
75--- a/wolfssl/wolfcrypt/random.h
76+++ b/wolfssl/wolfcrypt/random.h
77@@ -183,7 +183,7 @@ struct WC_RNG {
78 #endif
79 byte status;
80 #endif
81-#ifdef HAVE_GETPID
82+#if defined(HAVE_GETPID) && !defined(WOLFSSL_NO_GETPID)
83 pid_t pid;
84 #endif
85 #ifdef WOLFSSL_ASYNC_CRYPT
diff --git a/meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-5.patch b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-5.patch
new file mode 100644
index 0000000000..6747f24352
--- /dev/null
+++ b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-5.patch
@@ -0,0 +1,40 @@
1From 670437d91ae3025b4721eb4f450e5dc31fc3d6ee Mon Sep 17 00:00:00 2001
2From: Chris Conlon <chris@wolfssl.com>
3Date: Wed, 18 Jun 2025 16:08:34 -0600
4Subject: [PATCH] Add HAVE_GETPID to options.h if getpid detected, needed for
5 apps to correctly detect size of WC_RNG struct
6
7CVE: CVE-2025-7394
8Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/9c35c0de65e135e621400958f22829c0d2555ed4]
9Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
10---
11 configure.ac | 9 +++++++++
12 1 file changed, 9 insertions(+)
13
14diff --git a/configure.ac b/configure.ac
15index 43ddd4767..636c45aef 100644
16--- a/configure.ac
17+++ b/configure.ac
18@@ -156,6 +156,9 @@ fi
19 #ifdef HAVE_STDLIB_H
20 #include <stdlib.h>
21 #endif
22+#ifdef HAVE_UNISTD_H
23+ #include <unistd.h>
24+#endif
25 ]])
26
27 AC_PROG_INSTALL
28@@ -9479,6 +9482,12 @@ then
29 AM_CFLAGS="$AM_CFLAGS -DHAVE___UINT128_T=1"
30 fi
31
32+# Add HAVE_GETPID to AM_CFLAGS for inclusion in options.h
33+if test "$ac_cv_func_getpid" = "yes"
34+then
35+ AM_CFLAGS="$AM_CFLAGS -DHAVE_GETPID=1"
36+fi
37+
38 LIB_SOCKET_NSL
39 AX_HARDEN_CC_COMPILER_FLAGS
40
diff --git a/meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-6.patch b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-6.patch
new file mode 100644
index 0000000000..e86bc8bc56
--- /dev/null
+++ b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2025-7394-6.patch
@@ -0,0 +1,48 @@
1From aaad0035e4e795b8b225bd481e3942de015a362d Mon Sep 17 00:00:00 2001
2From: Chris Conlon <chris@wolfssl.com>
3Date: Wed, 18 Jun 2025 16:57:02 -0600
4Subject: [PATCH] Add check for reseed in ssl.c for HAVE_SELFTEST, similar to
5 old FIPS bundles that do not have older random.c files
6
7CVE: CVE-2025-7394
8Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/cdd02f9665ef43126503307972e4389070a00a73
9(cherry picked from commit cdd02f9665ef43126503307972e4389070a00a73)
10Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
11---
12 src/ssl.c | 9 ++++++---
13 1 file changed, 6 insertions(+), 3 deletions(-)
14
15diff --git a/src/ssl.c b/src/ssl.c
16index e214fa504..e538233fc 100644
17--- a/src/ssl.c
18+++ b/src/ssl.c
19@@ -23604,7 +23604,7 @@ static int wolfSSL_RAND_InitMutex(void)
20 #ifdef OPENSSL_EXTRA
21
22 #if defined(HAVE_GETPID) && !defined(WOLFSSL_NO_GETPID) && \
23- defined(HAVE_FIPS) && FIPS_VERSION3_LT(6,0,0)
24+ ((defined(HAVE_FIPS) && FIPS_VERSION3_LT(6,0,0)) || defined(HAVE_SELFTEST))
25 /* In older FIPS bundles add check for reseed here since it does not exist in
26 * the older random.c certified files. */
27 static pid_t currentRandPid = 0;
28@@ -23623,7 +23623,9 @@ int wolfSSL_RAND_Init(void)
29 ret = wc_InitRng(&globalRNG);
30 if (ret == 0) {
31 #if defined(HAVE_GETPID) && !defined(WOLFSSL_NO_GETPID) && \
32- defined(HAVE_FIPS) && FIPS_VERSION3_LT(6,0,0)
33+ ((defined(HAVE_FIPS) && FIPS_VERSION3_LT(6,0,0)) || \
34+ defined(HAVE_SELFTEST))
35+
36 currentRandPid = getpid();
37 #endif
38 initGlobalRNG = 1;
39@@ -24100,7 +24102,8 @@ int wolfSSL_RAND_bytes(unsigned char* buf, int num)
40 */
41 if (initGlobalRNG) {
42 #if defined(HAVE_GETPID) && !defined(WOLFSSL_NO_GETPID) && \
43- defined(HAVE_FIPS) && FIPS_VERSION3_LT(6,0,0)
44+ ((defined(HAVE_FIPS) && FIPS_VERSION3_LT(6,0,0)) || \
45+ defined(HAVE_SELFTEST))
46 pid_t p;
47
48 p = getpid();
diff --git a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.7.2.bb b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.7.2.bb
index 5e66c8b186..0dc488dc24 100644
--- a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.7.2.bb
+++ b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.7.2.bb
@@ -17,6 +17,12 @@ SRC_URI = "git://github.com/wolfSSL/wolfssl.git;protocol=https;branch=master \
17 file://CVE-2025-7395-1.patch \ 17 file://CVE-2025-7395-1.patch \
18 file://CVE-2025-7395-2.patch \ 18 file://CVE-2025-7395-2.patch \
19 file://CVE-2025-7395-3.patch \ 19 file://CVE-2025-7395-3.patch \
20 file://CVE-2025-7394-1.patch \
21 file://CVE-2025-7394-2.patch \
22 file://CVE-2025-7394-3.patch \
23 file://CVE-2025-7394-4.patch \
24 file://CVE-2025-7394-5.patch \
25 file://CVE-2025-7394-6.patch \
20 " 26 "
21SRCREV = "00e42151ca061463ba6a95adb2290f678cbca472" 27SRCREV = "00e42151ca061463ba6a95adb2290f678cbca472"
22 28
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-08-17 16:20:22 +0000