francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
74 lines
2.2 KiB
Diff
74 lines
2.2 KiB
Diff
From 7abc2a59d5d65bb981be7cababb029d60c995719 Mon Sep 17 00:00:00 2001
|
|
From: Roman Arutyunyan <arut@nginx.com>
|
|
Date: Tue, 21 Apr 2026 14:51:41 +0400
|
|
Subject: [PATCH] OCSP: resolve cleanup on connection close
|
|
|
|
Previously, when a client SSL connection was terminated (typically due to a
|
|
timeout) while resolving an OCSP responder, the OCSP context was freed, but
|
|
the resolve context was not. This resulted in use-after-free on resolve
|
|
completion.
|
|
|
|
Reported by Leo Lin.
|
|
|
|
CVE: CVE-2026-40701
|
|
Upstream-Status: Backport [https://github.com/nginx/nginx/commit/d2b8d47741820c9fb134c6731ecb40b21f3085b1]
|
|
Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com>
|
|
---
|
|
src/event/ngx_event_openssl_stapling.c | 11 +++++++++++
|
|
1 file changed, 11 insertions(+)
|
|
|
|
diff --git a/src/event/ngx_event_openssl_stapling.c b/src/event/ngx_event_openssl_stapling.c
|
|
index e3fa8c4..2aaf99b 100644
|
|
--- a/src/event/ngx_event_openssl_stapling.c
|
|
+++ b/src/event/ngx_event_openssl_stapling.c
|
|
@@ -111,6 +111,7 @@ struct ngx_ssl_ocsp_ctx_s {
|
|
|
|
ngx_resolver_t *resolver;
|
|
ngx_msec_t resolver_timeout;
|
|
+ ngx_resolver_ctx_t *resolve;
|
|
|
|
ngx_msec_t timeout;
|
|
|
|
@@ -1303,6 +1304,10 @@ ngx_ssl_ocsp_done(ngx_ssl_ocsp_ctx_t *ctx)
|
|
ngx_log_debug0(NGX_LOG_DEBUG_EVENT, ctx->log, 0,
|
|
"ssl ocsp done");
|
|
|
|
+ if (ctx->resolve) {
|
|
+ ngx_resolve_name_done(ctx->resolve);
|
|
+ }
|
|
+
|
|
if (ctx->peer.connection) {
|
|
ngx_close_connection(ctx->peer.connection);
|
|
}
|
|
@@ -1395,7 +1400,10 @@ ngx_ssl_ocsp_request(ngx_ssl_ocsp_ctx_t *ctx)
|
|
resolve->data = ctx;
|
|
resolve->timeout = ctx->resolver_timeout;
|
|
|
|
+ ctx->resolve = resolve;
|
|
+
|
|
if (ngx_resolve_name(resolve) != NGX_OK) {
|
|
+ ctx->resolve = NULL;
|
|
ngx_ssl_ocsp_error(ctx);
|
|
return;
|
|
}
|
|
@@ -1484,6 +1492,7 @@ ngx_ssl_ocsp_resolve_handler(ngx_resolver_ctx_t *resolve)
|
|
}
|
|
|
|
ngx_resolve_name_done(resolve);
|
|
+ ctx->resolve = NULL;
|
|
|
|
ngx_ssl_ocsp_connect(ctx);
|
|
return;
|
|
@@ -1491,6 +1500,8 @@ ngx_ssl_ocsp_resolve_handler(ngx_resolver_ctx_t *resolve)
|
|
failed:
|
|
|
|
ngx_resolve_name_done(resolve);
|
|
+ ctx->resolve = NULL;
|
|
+
|
|
ngx_ssl_ocsp_error(ctx);
|
|
}
|
|
|
|
--
|
|
2.43.0
|
|
|