mirror of
https://git.yoctoproject.org/git/poky
synced 2026-01-01 13:58:04 +00:00
openssl: upgrade 3.2.4 -> 3.2.6
3.2.6 has fixed 3.2.5 regression which broke python3 ptests so we can upgrade now. We can also drop CVE-2025-27587 patch which was taken instead of 3.2.5 upgrade under: https://github.com/openssl/openssl/pull/28198 Release information: https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-3017-and-openssl-3018-30-sep-2025 OpenSSL 3.2.6 is a security patch release. The most severe CVE fixed in this release is Moderate. This release incorporates the following bug fixes and mitigations: * Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap. (CVE-2025-9230) * Fix Timing side-channel in SM2 algorithm on 64 bit ARM. (CVE-2025-9231) * Fix Out-of-bounds read in HTTP client no_proxy handling. (CVE-2025-9232) Release information: https://github.com/openssl/openssl/blob/openssl-3.2/NEWS.md#major-changes-between-openssl-324-and-openssl-325-1-jul-2025 OpenSSL 3.2.5 is a bug fix release. This release incorporates the following bug fixes and mitigations: * Miscellaneous minor bug fixes. (From OE-Core rev: ef6bbf39c10ff7bd8ad36d5d2f59ddd0756e0141) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Peter Marko
Steve Sakoman
parent
9dafc77bd8
commit
2f0df0334a
File diff suppressed because it is too large
Load Diff
|
|
@ -1,129 +0,0 @@
|
|||
From 6b1646e472c9e8c08bb14066ba2a7c3eed45f84a Mon Sep 17 00:00:00 2001
|
||||
From: "A. Wilcox" <AWilcox@Wilcox-Tech.com>
|
||||
Date: Thu, 17 Apr 2025 08:51:53 -0500
|
||||
Subject: [PATCH] Fix P-384 curve on lower-than-P9 PPC64 targets
|
||||
|
||||
The change adding an asm implementation of p384_felem_reduce incorrectly
|
||||
uses the accelerated version on both targets that support the intrinsics
|
||||
*and* targets that don't, instead of falling back to the generics on older
|
||||
targets. This results in crashes when trying to use P-384 on < Power9.
|
||||
|
||||
Signed-off-by: Anna Wilcox <AWilcox@Wilcox-Tech.com>
|
||||
Closes: #27350
|
||||
Fixes: 85cabd94 ("Fix Minerva timing side-channel signal for P-384 curve on PPC")
|
||||
|
||||
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
|
||||
Reviewed-by: Tomas Mraz <tomas@openssl.org>
|
||||
(Merged from https://github.com/openssl/openssl/pull/27429)
|
||||
|
||||
(cherry picked from commit 29864f2b0f1046177e8048a5b17440893d3f9425)
|
||||
|
||||
CVE: CVE-2025-27587
|
||||
Upstream-Status: Backport [https://github.com/openssl/openssl/commit/6b1646e472c9e8c08bb14066ba2a7c3eed45f84a]
|
||||
Signed-off-by: Peter Marko <peter.marko@siemens.com>
|
||||
---
|
||||
crypto/ec/ecp_nistp384.c | 54 ++++++++++++++++++++++++----------------
|
||||
1 file changed, 33 insertions(+), 21 deletions(-)
|
||||
|
||||
diff --git a/crypto/ec/ecp_nistp384.c b/crypto/ec/ecp_nistp384.c
|
||||
index e0b5786bc1..439b4d03a3 100644
|
||||
--- a/crypto/ec/ecp_nistp384.c
|
||||
+++ b/crypto/ec/ecp_nistp384.c
|
||||
@@ -684,6 +684,22 @@ static void felem_reduce_ref(felem out, const widefelem in)
|
||||
out[i] = acc[i];
|
||||
}
|
||||
|
||||
+static ossl_inline void felem_square_reduce_ref(felem out, const felem in)
|
||||
+{
|
||||
+ widefelem tmp;
|
||||
+
|
||||
+ felem_square_ref(tmp, in);
|
||||
+ felem_reduce_ref(out, tmp);
|
||||
+}
|
||||
+
|
||||
+static ossl_inline void felem_mul_reduce_ref(felem out, const felem in1, const felem in2)
|
||||
+{
|
||||
+ widefelem tmp;
|
||||
+
|
||||
+ felem_mul_ref(tmp, in1, in2);
|
||||
+ felem_reduce_ref(out, tmp);
|
||||
+}
|
||||
+
|
||||
#if defined(ECP_NISTP384_ASM)
|
||||
static void felem_square_wrapper(widefelem out, const felem in);
|
||||
static void felem_mul_wrapper(widefelem out, const felem in1, const felem in2);
|
||||
@@ -695,10 +711,18 @@ static void (*felem_mul_p)(widefelem out, const felem in1, const felem in2) =
|
||||
|
||||
static void (*felem_reduce_p)(felem out, const widefelem in) = felem_reduce_ref;
|
||||
|
||||
+static void (*felem_square_reduce_p)(felem out, const felem in) =
|
||||
+ felem_square_reduce_ref;
|
||||
+static void (*felem_mul_reduce_p)(felem out, const felem in1, const felem in2) =
|
||||
+ felem_mul_reduce_ref;
|
||||
+
|
||||
void p384_felem_square(widefelem out, const felem in);
|
||||
void p384_felem_mul(widefelem out, const felem in1, const felem in2);
|
||||
void p384_felem_reduce(felem out, const widefelem in);
|
||||
|
||||
+void p384_felem_square_reduce(felem out, const felem in);
|
||||
+void p384_felem_mul_reduce(felem out, const felem in1, const felem in2);
|
||||
+
|
||||
# if defined(_ARCH_PPC64)
|
||||
# include "crypto/ppc_arch.h"
|
||||
# endif
|
||||
@@ -710,6 +734,8 @@ static void felem_select(void)
|
||||
felem_square_p = p384_felem_square;
|
||||
felem_mul_p = p384_felem_mul;
|
||||
felem_reduce_p = p384_felem_reduce;
|
||||
+ felem_square_reduce_p = p384_felem_square_reduce;
|
||||
+ felem_mul_reduce_p = p384_felem_mul_reduce;
|
||||
|
||||
return;
|
||||
}
|
||||
@@ -718,7 +744,9 @@ static void felem_select(void)
|
||||
/* Default */
|
||||
felem_square_p = felem_square_ref;
|
||||
felem_mul_p = felem_mul_ref;
|
||||
- felem_reduce_p = p384_felem_reduce;
|
||||
+ felem_reduce_p = felem_reduce_ref;
|
||||
+ felem_square_reduce_p = felem_square_reduce_ref;
|
||||
+ felem_mul_reduce_p = felem_mul_reduce_ref;
|
||||
}
|
||||
|
||||
static void felem_square_wrapper(widefelem out, const felem in)
|
||||
@@ -737,31 +765,15 @@ static void felem_mul_wrapper(widefelem out, const felem in1, const felem in2)
|
||||
# define felem_mul felem_mul_p
|
||||
# define felem_reduce felem_reduce_p
|
||||
|
||||
-void p384_felem_square_reduce(felem out, const felem in);
|
||||
-void p384_felem_mul_reduce(felem out, const felem in1, const felem in2);
|
||||
-
|
||||
-# define felem_square_reduce p384_felem_square_reduce
|
||||
-# define felem_mul_reduce p384_felem_mul_reduce
|
||||
+# define felem_square_reduce felem_square_reduce_p
|
||||
+# define felem_mul_reduce felem_mul_reduce_p
|
||||
#else
|
||||
# define felem_square felem_square_ref
|
||||
# define felem_mul felem_mul_ref
|
||||
# define felem_reduce felem_reduce_ref
|
||||
|
||||
-static ossl_inline void felem_square_reduce(felem out, const felem in)
|
||||
-{
|
||||
- widefelem tmp;
|
||||
-
|
||||
- felem_square(tmp, in);
|
||||
- felem_reduce(out, tmp);
|
||||
-}
|
||||
-
|
||||
-static ossl_inline void felem_mul_reduce(felem out, const felem in1, const felem in2)
|
||||
-{
|
||||
- widefelem tmp;
|
||||
-
|
||||
- felem_mul(tmp, in1, in2);
|
||||
- felem_reduce(out, tmp);
|
||||
-}
|
||||
+# define felem_square_reduce felem_square_reduce_ref
|
||||
+# define felem_mul_reduce felem_mul_reduce_ref
|
||||
#endif
|
||||
|
||||
/*-
|
||||
|
|
@ -13,15 +13,13 @@ SRC_URI = "https://github.com/openssl/openssl/releases/download/openssl-${PV}/op
|
|||
file://0001-Configure-do-not-tweak-mips-cflags.patch \
|
||||
file://0001-Added-handshake-history-reporting-when-test-fails.patch \
|
||||
file://CVE-2024-41996.patch \
|
||||
file://CVE-2025-27587-1.patch \
|
||||
file://CVE-2025-27587-2.patch \
|
||||
"
|
||||
|
||||
SRC_URI:append:class-nativesdk = " \
|
||||
file://environment.d-openssl.sh \
|
||||
"
|
||||
|
||||
SRC_URI[sha256sum] = "b23ad7fd9f73e43ad1767e636040e88ba7c9e5775bfa5618436a0dd2c17c3716"
|
||||
SRC_URI[sha256sum] = "89681a9ddaa9ed7cf25ea8ef61338db805200bae47d00510490623547380c148"
|
||||
|
||||
inherit lib_package multilib_header multilib_script ptest perlnative manpages
|
||||
MULTILIB_SCRIPTS = "${PN}-bin:${bindir}/c_rehash"
|
||||
Loading…
Reference in New Issue
Block a user