summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2025-11677.patch161
-rw-r--r--meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.3.5.bb1
2 files changed, 162 insertions, 0 deletions
diff --git a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2025-11677.patch b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2025-11677.patch
new file mode 100644
index 0000000000..bf11a893f8
--- /dev/null
+++ b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2025-11677.patch
@@ -0,0 +1,161 @@
1From c01cb06d99c08579ab33bef066fca8a5338b7c7b Mon Sep 17 00:00:00 2001
2From: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
3Date: Tue, 18 Nov 2025 16:59:22 +0100
4Subject: [PATCH] NN-2025-0102: UAF depending on upgrade allowed
5
6This document contains sensitive information collected during our
7security research activities related with the Libwebsockets library
8maintained by Andy Green (warmcat).
9
10+-------------------------------------------------------------------------------------------------------+
11| Report information |
12+:===================================:+:===============================================================:+
13| Vendor | warmcat |
14+-------------------------------------+-----------------------------------------------------------------+
15| Vendor URL | https://libwebsockets.org/git/libwebsockets |
16+-------------------------------------+-----------------------------------------------------------------+
17| Affected component | libwebsockets |
18+-------------------------------------+-----------------------------------------------------------------+
19| Affected version | 4.4 |
20+-------------------------------------+-----------------------------------------------------------------+
21| Vulnerability | CWE-416: Use After Free |
22+-------------------------------------+-----------------------------------------------------------------+
23| Proposed CVSS v3.1 Base Score | 6.0 |
24+-------------------------------------+-----------------------------------------------------------------+
25| Proposed CVSS v3.1 Vector | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
26+-------------------------------------+-----------------------------------------------------------------+
27
28+-----------------------------------------------------------------------------+
29| Security Researcher(s) |
30+:===================================:+:=====================================:+
31| Name | **Email address** |
32+-------------------------------------+---------------------------------------+
33| Raffaele Bova | labs-advisory@nozominetworks.com |
34+-------------------------------------+---------------------------------------+
35
36Libwebsockes is a C library that provides client and server
37implementation for various protocols (e.g., HTTP, websockets, MQTT) and
38more.
39
40Nozomi Networks Lab discovered a "CWE-416: Use After Free" in the latest
41software version of libwebsockets, specifically in the WebSocket server
42implementation.
43
44Depending on the use of the API, the vulnerability may allow an attacker
45to read or write data, that could cause a loss of integrity or
46availability.
47
48The issue is caused by the `lws_handshake_protocol` function, specifically
49when the upgrade header is not valid, the function calls
50`lws_http_transaction_completed`, which frees some of the data in the wsi
51structure, then it calls `user_callback_handle_rxflow` passing the up
52pointer and uses it on following strcasecmp calls.
53
54From our understanding, for this vulnerability to have a meaningful
55impact, a user that implements the Websocket server, must provide a user
56callback function which is going to handle
57`LWS_CALLBACK_HTTP_CONFIRM_UPGRADE`, while ignoring the length and doing
58operations on the up pointer.
59
60It is possible to compile the minimal websocket server using address
61sanitizer, to quickly verify the use after free.
62
63From our understanding of the code, if the upgrade header does not match
64the intended contents, then the code after the if statement when
65`lws_http_transaction_completed` is called, should not be executed, thus
66simply enclosing all that code in the else branch solves the issue.
67
68CVE: CVE-2025-11677
69Upstream-Status: Backport [https://github.com/warmcat/libwebsockets/commit/2f082ec31261f556969160143ba94875d783971a]
70
71Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
72---
73 lib/roles/http/server/server.c | 58 +++++++++++++++++-----------------
74 1 file changed, 29 insertions(+), 29 deletions(-)
75
76diff --git a/lib/roles/http/server/server.c b/lib/roles/http/server/server.c
77index 6b132a42..e6d714e3 100644
78--- a/lib/roles/http/server/server.c
79+++ b/lib/roles/http/server/server.c
80@@ -2375,49 +2375,49 @@ raw_transition:
81 HTTP_STATUS_FORBIDDEN, NULL) ||
82 lws_http_transaction_completed(wsi))
83 goto bail_nuke_ah;
84- }
85-
86- n = user_callback_handle_rxflow(wsi->a.protocol->callback,
87- wsi, LWS_CALLBACK_HTTP_CONFIRM_UPGRADE,
88- wsi->user_space, (char *)up, 0);
89+ } else {
90+ n = user_callback_handle_rxflow(wsi->a.protocol->callback,
91+ wsi, LWS_CALLBACK_HTTP_CONFIRM_UPGRADE,
92+ wsi->user_space, (char *)up, 0);
93
94- /* just hang up? */
95+ /* just hang up? */
96
97- if (n < 0)
98- goto bail_nuke_ah;
99+ if (n < 0)
100+ goto bail_nuke_ah;
101
102- /* callback returned headers already, do t_c? */
103+ /* callback returned headers already, do t_c? */
104
105- if (n > 0) {
106- if (lws_http_transaction_completed(wsi))
107+ if (n > 0) {
108+ if (lws_http_transaction_completed(wsi))
109 goto bail_nuke_ah;
110
111- /* continue on */
112+ /* continue on */
113
114- return 0;
115- }
116+ return 0;
117+ }
118
119- /* callback said 0, it was allowed */
120+ /* callback said 0, it was allowed */
121
122- if (wsi->a.vhost->options &
123- LWS_SERVER_OPTION_VHOST_UPG_STRICT_HOST_CHECK &&
124- lws_confirm_host_header(wsi))
125- goto bail_nuke_ah;
126+ if (wsi->a.vhost->options &
127+ LWS_SERVER_OPTION_VHOST_UPG_STRICT_HOST_CHECK &&
128+ lws_confirm_host_header(wsi))
129+ goto bail_nuke_ah;
130
131- if (!strcasecmp(up, "websocket")) {
132+ if (!strcasecmp(up, "websocket")) {
133 #if defined(LWS_ROLE_WS)
134- lws_metrics_tag_wsi_add(wsi, "upg", "ws");
135- lwsl_info("Upgrade to ws\n");
136- goto upgrade_ws;
137+ lws_metrics_tag_wsi_add(wsi, "upg", "ws");
138+ lwsl_info("Upgrade to ws\n");
139+ goto upgrade_ws;
140 #endif
141- }
142+ }
143 #if defined(LWS_WITH_HTTP2)
144- if (!strcasecmp(up, "h2c")) {
145- lws_metrics_tag_wsi_add(wsi, "upg", "h2c");
146- lwsl_info("Upgrade to h2c\n");
147- goto upgrade_h2c;
148- }
149+ if (!strcasecmp(up, "h2c")) {
150+ lws_metrics_tag_wsi_add(wsi, "upg", "h2c");
151+ lwsl_info("Upgrade to h2c\n");
152+ goto upgrade_h2c;
153+ }
154 #endif
155+ }
156 }
157
158 /* no upgrade ack... he remained as HTTP */
159--
1602.43.0
161
diff --git a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.3.5.bb b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.3.5.bb
index afe2124f65..0b74adf990 100644
--- a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.3.5.bb
+++ b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.3.5.bb
@@ -10,6 +10,7 @@ SRCREV = "ab9df9cfc39de7a49967f18387b6b76310947442"
10SRC_URI = "git://github.com/warmcat/libwebsockets.git;protocol=https;branch=v4.3-stable \ 10SRC_URI = "git://github.com/warmcat/libwebsockets.git;protocol=https;branch=v4.3-stable \
11 file://0001-sll_protocol-may-be-be16.patch \ 11 file://0001-sll_protocol-may-be-be16.patch \
12 file://0002-allow-build-with-cmake-4.patch \ 12 file://0002-allow-build-with-cmake-4.patch \
13 file://CVE-2025-11677.patch \
13 " 14 "
14 15
15UPSTREAM_CHECK_URI = "https://github.com/warmcat/${BPN}/releases" 16UPSTREAM_CHECK_URI = "https://github.com/warmcat/${BPN}/releases"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-20 19:24:28 +0000