From 0e0bb32811791cd92bdda0635e218d99e1049116 Mon Sep 17 00:00:00 2001 From: Priya_Dharshini Date: Mon, 4 May 2026 20:53:47 +0530 Subject: [PATCH 1/4] =?UTF-8?q?RDKEMW-15199:[SECVULN]=20Command=20injectio?= =?UTF-8?q?n=20via=20/opt/.telemetry/dca=5Ftemp=E2=80=A6=20(#355)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * RDKEMW-15199:[SECVULN] Command injection via /opt/.telemetry/dca_temp_file.conf Signed-off-by: PriyaDharshini_Kathiravan * Apply suggestion from @Copilot Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Add sanitize_string function to t2parser * Add sanitize string support for reportprofiles --------- Signed-off-by: PriyaDharshini_Kathiravan Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Shibu Kakkoth Vayalambron --- source/t2parser/t2parser.c | 11 ++++++++++- source/t2parser/t2parserxconf.c | 11 +++++++++++ source/utils/t2common.c | 16 ++++++++++++++++ source/utils/t2common.h | 2 ++ 4 files changed, 39 insertions(+), 1 deletion(-) diff --git a/source/t2parser/t2parser.c b/source/t2parser/t2parser.c index 808cc3993..fbf9b82a2 100644 --- a/source/t2parser/t2parser.c +++ b/source/t2parser/t2parser.c @@ -311,9 +311,18 @@ static T2ERROR addParameter(Profile *profile, const char* name, const char* ref, { // T2Debug("Adding Grep Marker :: Param/Marker Name : %s ref/pattern/Comp : %s fileName : %s skipFreq : %d\n", name, ref, fileName, skipFreq); - if(fileName != NULL && strncmp("top_log.txt", fileName, sizeof("top_log.txt")) == 0) { + if(ref == NULL) + { + T2Error("Search string can't be null for top markers\n"); + return T2ERROR_FAILURE; + } + if(sanitize_string(ref) != 0) + { + T2Error("Parameter %s can't be added as invalid search string encountered\n", ref); + return T2ERROR_FAILURE; + } T2Debug("This is a TopMarker name :%s and value: %s add it to topmarker list \n", name, ref); TopMarker *tMarker = (TopMarker *) malloc(sizeof(TopMarker)); if(tMarker == NULL) diff --git a/source/t2parser/t2parserxconf.c b/source/t2parser/t2parserxconf.c index afa19f1a6..8e39cbe56 100644 --- a/source/t2parser/t2parserxconf.c +++ b/source/t2parser/t2parserxconf.c @@ -21,6 +21,7 @@ #include #include #include +#include #include "t2parserxconf.h" #include "xconfclient.h" @@ -129,6 +130,16 @@ static T2ERROR addParameter(ProfileXConf *profile, const char* name, const char* char *splitSuffix = NULL; char *accumulateSuffix = NULL; // T2Debug("Adding Grep Marker :: Param/Marker Name : %s ref/pattern/Comp : %s fileName : %s skipFreq : %d\n", name, ref, fileName, skipFreq); + if(ref == NULL) + { + T2Error("Search string can't be null for top markers\n"); + return T2ERROR_FAILURE; + } + if(sanitize_string(ref) != 0) + { + T2Error("Parameter %s can't be added as invalid search string encountered\n", ref); + return T2ERROR_FAILURE; + } TopMarker *tMarker = (TopMarker *)malloc(sizeof(TopMarker)); memset(tMarker, 0, sizeof(TopMarker)); tMarker->markerName = strdup(name); diff --git a/source/utils/t2common.c b/source/utils/t2common.c index b125d0f74..85f146ad4 100644 --- a/source/utils/t2common.c +++ b/source/utils/t2common.c @@ -301,3 +301,19 @@ bool isWhoAmiEnabled(void) { return whoami_support; } + +int sanitize_string(const char *str) +{ + const char *src = str; + + while (*src) + { + if (!(isalnum((unsigned char)*src) || *src == '.' || *src == '-' || *src == '_')) + { + T2Error("Invalid search string configuration. Rejecting parameter due to invalid characters\n"); + return -1; + } + src++; + } + return 0; +} diff --git a/source/utils/t2common.h b/source/utils/t2common.h index 9ef9be737..d1412aca6 100644 --- a/source/utils/t2common.h +++ b/source/utils/t2common.h @@ -167,4 +167,6 @@ void initWhoamiSupport(void); bool isWhoAmiEnabled(void); +int sanitize_string(const char *str); + #endif /* _T2COMMON_H_ */ From 4788834470fe1cd8cedc606e945f22be9c89dd0e Mon Sep 17 00:00:00 2001 From: tabbas651 <74683978+tabbas651@users.noreply.github.com> Date: Mon, 4 May 2026 12:37:21 -0400 Subject: [PATCH 2/4] RDKB-64644: Potential Fix for SE051 ENGINE memory leak in telemetry HTTP pool (#360) Reason for change: On HROT platforms using the SE051 secure element (XB10/XER10/SXB10), the e4sss OpenSSL ENGINE accumulates per-session hardware state (APDU session objects, secure channel buffers) across mTLS operations. Unlike SE050 (XB8), the SE051 ENGINE allocates larger per-session state that is not released by curl's connection cache management, OPENSSL_thread_stop, or ERR_clear_error() alone. This causes a progressive memory leak (~5MB baseline increase + ~5MB growth over 10+ days) in the telemetry process. 1) set CURLOPT_FORBID_REUSE=1 so curl closes the TCP+TLS connection after each request. This triggers the natural OpenSSL cleanup path: SSL_CTX_free -> EC_KEY_free -> ENGINE_finish, releasing the hardware session state. 2)Add ERR_clear_error() in both GET and POST xPKI retry loops to drain the OpenSSL error queue between retries, preventing ENGINE-internal error state accumulation. Test Procedure: please refered from the ticket Risks: High Signed-off-by: Thamim Razith --- source/protocol/http/multicurlinterface.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/source/protocol/http/multicurlinterface.c b/source/protocol/http/multicurlinterface.c index 5e273a083..fe49ecffd 100644 --- a/source/protocol/http/multicurlinterface.c +++ b/source/protocol/http/multicurlinterface.c @@ -268,7 +268,11 @@ T2ERROR init_connection_pool() #endif // Connection reuse settings - CURL_SETOPT_CHECK(pool_entries[i].easy_handle, CURLOPT_FORBID_REUSE, 0L); + //Disable connection reuse (FORBID_REUSE=1) so that + // curl tears down the TLS session after each request. This causes + // OpenSSL to call SSL_CTX_free → EC_KEY_free → ENGINE_finish through + // its own reference counting, releasing the SE051 hardware session state. + CURL_SETOPT_CHECK(pool_entries[i].easy_handle, CURLOPT_FORBID_REUSE, 1L); CURL_SETOPT_CHECK(pool_entries[i].easy_handle, CURLOPT_FRESH_CONNECT, 0L); // Socket options @@ -620,6 +624,9 @@ T2ERROR http_pool_get(const char *url, char **response_data, bool enable_file_ou if(curl_code != CURLE_OK || http_code != 200) { T2Error("%s: Failed to establish connection using xPKI certificate: %s, Curl failed : %d\n", __func__, pCertFile, curl_code); + // Drain OpenSSL error queue between retries to prevent + // ENGINE-internal error state accumulation (HROT/SE051). + ERR_clear_error(); } else { @@ -815,9 +822,6 @@ T2ERROR http_pool_get(const char *url, char **response_data, bool enable_file_ou } #endif - // Important Note: When using LIBRDKCERTSEL_BUILD, pCertURI and pCertPC are owned by the - // cert selector object and are freed when rdkcertselector_free() is called - // Clear OpenSSL per-thread error queue. // Every curl_easy_perform() may push records onto the per-thread ERR_STATE // list on any TLS error (cert verify failure, connection reset, timeout). @@ -825,6 +829,8 @@ T2ERROR http_pool_get(const char *url, char **response_data, bool enable_file_ou // ERR_clear_error() is thread-safe since OpenSSL 1.1.0. ERR_clear_error(); + // Important Note: When using LIBRDKCERTSEL_BUILD, pCertURI and pCertPC are owned by the + // cert selector object and are freed when rdkcertselector_free() is called release_pool_handle(idx); T2Debug("%s ++out\n", __FUNCTION__); @@ -1013,6 +1019,9 @@ T2ERROR http_pool_post(const char *url, const char *payload) if(curl_code != CURLE_OK || http_code != 200) { T2Error("%s: Failed to establish connection using xPKI certificate: %s, curl failed: %d (entry %d)\n", __func__, pCertFile, curl_code, idx); + // Drain OpenSSL error queue between retries to prevent + // ENGINE-internal error state accumulation (HROT/SE051). + ERR_clear_error(); } else { From 247ae0464ce45a63c53705f3cc91bb2e16ffa92c Mon Sep 17 00:00:00 2001 From: shibu-kv Date: Mon, 4 May 2026 09:40:31 -0700 Subject: [PATCH 3/4] Changelog updates for release 1.9.2 --- CHANGELOG.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 394e45223..187c80d5e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,15 +4,22 @@ All notable changes to this project will be documented in this file. Dates are d Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog). +#### [1.9.2](https://github.com/rdkcentral/telemetry/compare/1.9.1...1.9.2) + +- RDKB-64644: Potential Fix for SE051 ENGINE memory leak in telemetry HTTP pool [`#360`](https://github.com/rdkcentral/telemetry/pull/360) +- RDKEMW-15199:[SECVULN] Command injection via /opt/.telemetry/dca_temp… [`#355`](https://github.com/rdkcentral/telemetry/pull/355) + #### [1.9.1](https://github.com/rdkcentral/telemetry/compare/1.9.0...1.9.1) -> 29 April 2026 +> 28 April 2026 - RDKB-64487: TSAN fixes for various issues [`#350`](https://github.com/rdkcentral/telemetry/pull/350) - RDKB-64487: Code changes for thread hardening and safety under concurrent load [`#345`](https://github.com/rdkcentral/telemetry/pull/345) - RDKB-64487: Code changes for Mutex locking and deadlock prevention [`#338`](https://github.com/rdkcentral/telemetry/pull/338) - RDKEMW-16851: Fix for top log markers and the polling frequency [`#341`](https://github.com/rdkcentral/telemetry/pull/341) - Adding agentic skills for code reviews [`#323`](https://github.com/rdkcentral/telemetry/pull/323) +- Changelog updates for 1.9.1 release [`1861d67`](https://github.com/rdkcentral/telemetry/commit/1861d67be43018e5dcc10f61bebd3d31d08244ec) +- Changelog updates for 1.9.1 release [`4675135`](https://github.com/rdkcentral/telemetry/commit/467513553c6fac2d63cf730ca4980c595ff355db) #### [1.9.0](https://github.com/rdkcentral/telemetry/compare/1.8.8...1.9.0) From 5b6e0656dc612c571c5715bffb636565df3ed0f2 Mon Sep 17 00:00:00 2001 From: shibu-kv Date: Mon, 4 May 2026 09:42:16 -0700 Subject: [PATCH 4/4] Changelog updates for release 1.9.2 --- CHANGELOG.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 187c80d5e..50effa64d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,8 @@ Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog). #### [1.9.2](https://github.com/rdkcentral/telemetry/compare/1.9.1...1.9.2) +> 4 May 2026 + - RDKB-64644: Potential Fix for SE051 ENGINE memory leak in telemetry HTTP pool [`#360`](https://github.com/rdkcentral/telemetry/pull/360) - RDKEMW-15199:[SECVULN] Command injection via /opt/.telemetry/dca_temp… [`#355`](https://github.com/rdkcentral/telemetry/pull/355)