[Buildroot] [PATCH 2025.02.x] package/libgcrypt: upstream patch for CVE-2026-41989

This commit patches the following vulnerability:

- CVE-2026-41989:
    Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow
    and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.
    https://www.cve.org/CVERecord?id=CVE-2026-41989

This has already been addressed on the master branch by the package bump
[1].

[1] 93f486ac56 package/libgcrypt: bump version to 1.12.2

Signed-off-by: Thomas Perale <[email protected]>
---
 package/libgcrypt/0002-CVE-2026-41989.patch | 40 +++++++++++++++++++++
 package/libgcrypt/libgcrypt.mk              |  3 ++
 2 files changed, 43 insertions(+)
 create mode 100644 package/libgcrypt/0002-CVE-2026-41989.patch

diff --git a/package/libgcrypt/0002-CVE-2026-41989.patch b/package/libgcrypt/0002-CVE-2026-41989.patch
new file mode 100644
index 0000000000..b93247ecdb
--- /dev/null
+++ b/package/libgcrypt/0002-CVE-2026-41989.patch
@@ -0,0 +1,40 @@
+From 2d3d732c9bf87cc10729f69678dd9e6862f99fa3 Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <[email protected]>
+Date: Fri, 10 Apr 2026 16:58:57 +0900
+Subject: [PATCH] cipher:ecc: Fix decoding a point on Montgomery curve.
+
+* cipher/ecc-misc.c (_gcry_ecc_mont_decodepoint): Fix the padding
+mistake and add updating RAWMPILEN.
+
+CVE: CVE-2026-41989
+Upstream: https://github.com/gpg/libgcrypt/commit/2d3d732c9bf87cc10729f69678dd9e6862f99fa3
+Signed-off-by: Thomas Perale <[email protected]>
+--
+
+Reported by Calif.io in collaboration with Claude and Anthropic
+Research.
+
+GnuPG-bug-id: 8211
+Fixes-commit: bbe15758c893dbf546416c1a6bccdad1ab000ad7
+Suggested-by: Bronson Yen <[email protected]>
+Signed-off-by: NIIBE Yutaka <[email protected]>
+---
+ cipher/ecc-misc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/cipher/ecc-misc.c b/cipher/ecc-misc.c
+index 615b0df2d..ab3799dcb 100644
+--- a/cipher/ecc-misc.c
++++ b/cipher/ecc-misc.c
+@@ -438,7 +438,10 @@ _gcry_ecc_mont_decodepoint (gcry_mpi_t pk, mpi_ec_t ec, mpi_point_t result)
+         *--p = *buf++;
+ 
+       if (rawmpilen < nbytes)
+-        memset (rawmpi + nbytes - rawmpilen, 0, nbytes - rawmpilen);
++        {
++          memset (rawmpi + rawmpilen, 0, nbytes - rawmpilen);
++          rawmpilen = nbytes;
++        }
+     }
+   else
+     {
diff --git a/package/libgcrypt/libgcrypt.mk b/package/libgcrypt/libgcrypt.mk
index 5f56e40ac2..babce3c264 100644
--- a/package/libgcrypt/libgcrypt.mk
+++ b/package/libgcrypt/libgcrypt.mk
@@ -14,6 +14,9 @@ LIBGCRYPT_DEPENDENCIES = libgpg-error
 LIBGCRYPT_CONFIG_SCRIPTS = libgcrypt-config
 LIBGCRYPT_CPE_ID_VENDOR = gnupg
 
+# 0002-CVE-2026-41989.patch
+LIBGCRYPT_IGNORE_CVES += CVE-2026-41989
+
 # Patching configure.ac and Makefile.am in 0001
 LIBGCRYPT_AUTORECONF = YES
 LIBGCRYPT_CONF_ENV += GPGRT_CONFIG=$(STAGING_DIR)/usr/bin/gpgrt-config
-- 
2.55.0

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot