diff -Nru softhsm2-2.6.1/debian/changelog softhsm2-2.6.1/debian/changelog --- softhsm2-2.6.1/debian/changelog 2024-03-26 15:42:43.000000000 +0000 +++ softhsm2-2.6.1/debian/changelog 2024-04-01 04:47:06.000000000 +0000 @@ -1,3 +1,16 @@ +softhsm2 (2.6.1-2.2ubuntu3) noble; urgency=medium + + * No-change rebuild for CVE-2024-3094 + + -- William Grant Mon, 01 Apr 2024 15:47:06 +1100 + +softhsm2 (2.6.1-2.2ubuntu2) noble; urgency=medium + + * debian/patches/0004-fix-uaf-in-softhsm-dtor.patch: Fix an use-after- + free issue in SoftHSM class. Closes LP: #2059340. + + -- Zixing Liu Wed, 27 Mar 2024 18:30:39 -0600 + softhsm2 (2.6.1-2.2ubuntu1) noble; urgency=medium * debian/patches/64-bit-time-t-compat.patch: long != time_t. diff -Nru softhsm2-2.6.1/debian/patches/0004-fix-uaf-in-softhsm-dtor.patch softhsm2-2.6.1/debian/patches/0004-fix-uaf-in-softhsm-dtor.patch --- softhsm2-2.6.1/debian/patches/0004-fix-uaf-in-softhsm-dtor.patch 1970-01-01 00:00:00.000000000 +0000 +++ softhsm2-2.6.1/debian/patches/0004-fix-uaf-in-softhsm-dtor.patch 2024-03-28 00:30:39.000000000 +0000 @@ -0,0 +1,20 @@ +Description: Fix an use-after-free issue in SoftHSM class + This causes a crash on armhf due to unwind behavior is slightly different + than other architectures +Author: Zixing Liu +Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/softhsm2/+bug/2059340 +Forwarded: no +Last-Update: 2024-03-28 + +--- softhsm2-2.6.1.orig/src/lib/SoftHSM.cpp ++++ softhsm2-2.6.1/src/lib/SoftHSM.cpp +@@ -407,6 +407,9 @@ SoftHSM::~SoftHSM() + isInitialised = false; + + resetMutexFactoryCallbacks(); ++ // dis-own and leak the object, since we are currently ++ // in the dtor of the containing object ++ static_cast(SoftHSM::instance.release()); + } + + /***************************************************************************** diff -Nru softhsm2-2.6.1/debian/patches/series softhsm2-2.6.1/debian/patches/series --- softhsm2-2.6.1/debian/patches/series 2024-03-26 15:41:43.000000000 +0000 +++ softhsm2-2.6.1/debian/patches/series 2024-03-28 00:30:39.000000000 +0000 @@ -2,3 +2,4 @@ 0002-Fix-OPENSSL_cleanup-detection-without-using-our-own-.patch 0003-fix-ftbfs-with-opensslv3.patch 64-bit-time-t-compat.patch +0004-fix-uaf-in-softhsm-dtor.patch