[OE-core][wrynose][PATCH 1/4] u-boot-tools: Ignore CVE-2026-29007

[OE-core][wrynose][PATCH 1/4] u-boot-tools: Ignore CVE-2026-29007

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- NVD identifies the vulnerable code as net/tcp.c when
  CONFIG_PROT_TCP is enabled [1].
- tools-only_defconfig disables networking, so this code is not built
  into u-boot-tools [2].
- Hence ignoring the CVE for this recipe.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-29007
[2] https://github.com/u-boot/u-boot/blob/v2026.01/configs/tools-only_defconfig

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb
index 7eaf721ca83..0e57bb88849 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb
@@ -1,2 +1,4 @@
 require u-boot-common.inc
 require u-boot-tools.inc
+
+CVE_STATUS[CVE-2026-29007] = "not-applicable-config: tools-only_defconfig disables networking; net/tcp.c is not compiled into u-boot-tools."
-- 
2.35.6

[OE-core][wrynose][PATCH 2/4] u-boot-tools: Ignore CVE-2026-29008

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- NVD identifies the vulnerable code as net/tcp.c when
  CONFIG_PROT_TCP is enabled [1].
- tools-only_defconfig disables networking, so this code is not built
  into u-boot-tools [2].
- Hence ignoring the CVE for this recipe.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-29008
[2] https://github.com/u-boot/u-boot/blob/v2026.01/configs/tools-only_defconfig

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb
index 0e57bb88849..6b28718c54a 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb
@@ -2,3 +2,4 @@ require u-boot-common.inc
 require u-boot-tools.inc
 
 CVE_STATUS[CVE-2026-29007] = "not-applicable-config: tools-only_defconfig disables networking; net/tcp.c is not compiled into u-boot-tools."
+CVE_STATUS[CVE-2026-29008] = "not-applicable-config: tools-only_defconfig disables networking; net/tcp.c is not compiled into u-boot-tools."
-- 
2.35.6

[OE-core][wrynose][PATCH 3/4] u-boot-tools: Ignore CVE-2026-29009

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- NVD identifies the vulnerable code as the NFS client implementation
  enabled by CONFIG_CMD_NFS [1].
- tools-only_defconfig disables networking, so net/nfs.c is not built
  into u-boot-tools [2].
- Hence ignoring the CVE for this recipe.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-29009
[2] https://github.com/u-boot/u-boot/blob/v2026.01/configs/tools-only_defconfig

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb
index 6b28718c54a..5e2ed063868 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb
@@ -3,3 +3,4 @@ require u-boot-tools.inc
 
 CVE_STATUS[CVE-2026-29007] = "not-applicable-config: tools-only_defconfig disables networking; net/tcp.c is not compiled into u-boot-tools."
 CVE_STATUS[CVE-2026-29008] = "not-applicable-config: tools-only_defconfig disables networking; net/tcp.c is not compiled into u-boot-tools."
+CVE_STATUS[CVE-2026-29009] = "not-applicable-config: tools-only_defconfig disables networking; net/nfs.c is not compiled into u-boot-tools."
-- 
2.35.6

[OE-core][wrynose][PATCH 4/4] u-boot, u-boot-tools: Correct CVE-2026-46728 attribution for FIT fix

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

CVE-2026-33243 is assigned to barebox, but NVD currently also maps it
to denx:u-boot. That U-Boot mapping is incorrect because the U-Boot-side
FIT hashed-nodes verification issue is tracked separately as
CVE-2026-46728. A correction request has been sent to NVD to remove the
incorrect denx:u-boot mapping. The existing patch backports U-Boot commit
2092322b31cc8b1f8c9e2e238d1043ae0637b241 [3], which is the U-Boot fix
referenced by CVE-2026-46728 [2].

Rename the patch and update its CVE tag so the filename and metadata
identify the affected U-Boot vendor correctly.

Apply the same patch to u-boot-tools because that recipe builds
fit_check_sign, which uses the affected FIT signature-verification path.
The bootloader recipe already carried the backport, but u-boot-tools did
not.

[1] https://github.com/barebox/barebox/security/advisories/GHSA-3fvj-q26p-j6h4
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-46728
[3] https://github.com/u-boot/u-boot/commit/2092322b31cc8b1f8c9e2e238d1043ae0637b241

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 .../{CVE-2026-33243.patch => CVE-2026-46728.patch}    | 11 ++++++++---
 meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb       |  4 ++++
 meta/recipes-bsp/u-boot/u-boot_2026.01.bb             |  4 +++-
 3 files changed, 15 insertions(+), 4 deletions(-)
 rename meta/recipes-bsp/u-boot/files/{CVE-2026-33243.patch => CVE-2026-46728.patch} (98%)

diff --git a/meta/recipes-bsp/u-boot/files/CVE-2026-33243.patch b/meta/recipes-bsp/u-boot/files/CVE-2026-46728.patch
similarity index 98%
rename from meta/recipes-bsp/u-boot/files/CVE-2026-33243.patch
rename to meta/recipes-bsp/u-boot/files/CVE-2026-46728.patch
index c7086e183fb..4e582d529ea 100644
--- a/meta/recipes-bsp/u-boot/files/CVE-2026-33243.patch
+++ b/meta/recipes-bsp/u-boot/files/CVE-2026-46728.patch
@@ -28,11 +28,16 @@ Closes: https://lore.kernel.org/u-boot/20260302220937.3682128-1-trini@konsulko.c
 Reported-by: Apple Security Engineering and Architecture (SEAR)
 Tested-by: Tom Rini <trini@konsulko.com>
 
-[YB: Removed a skippable condition in fit_config_get_hash_list.
-	This flag is not available in this version]
-CVE: CVE-2026-33243
+CVE: CVE-2026-46728
 Upstream-Status: Backport [https://github.com/u-boot/u-boot/commit/2092322b31cc8b1f8c9e2e238d1043ae0637b241]
+
+Backport Changes:
+Dropped the FIT_COMPAT_PROP condition because this macro is not
+available in U-Boot v2026.01.
+
+(cherry picked from commit 2092322b31cc8b1f8c9e2e238d1043ae0637b241)
 Signed-off-by: Yanis Binard <yanis.binard@smile.fr>
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
 ---
  boot/image-fit-sig.c        | 226 +++++++++++++++++++++++++++++-------
  doc/usage/fit/signature.rst |  19 ++-
diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb
index 5e2ed063868..77e086815c1 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb
@@ -1,6 +1,10 @@
 require u-boot-common.inc
 require u-boot-tools.inc
 
+SRC_URI += "file://CVE-2026-46728.patch"
+
+CVE_STATUS[CVE-2026-33243] = "cpe-incorrect: NVD currently maps this CVE to denx:u-boot, but that mapping is incorrect for U-Boot; the U-Boot-side FIT issue is tracked separately as CVE-2026-46728 and is fixed by the included U-Boot backport."
+
 CVE_STATUS[CVE-2026-29007] = "not-applicable-config: tools-only_defconfig disables networking; net/tcp.c is not compiled into u-boot-tools."
 CVE_STATUS[CVE-2026-29008] = "not-applicable-config: tools-only_defconfig disables networking; net/tcp.c is not compiled into u-boot-tools."
 CVE_STATUS[CVE-2026-29009] = "not-applicable-config: tools-only_defconfig disables networking; net/nfs.c is not compiled into u-boot-tools."
diff --git a/meta/recipes-bsp/u-boot/u-boot_2026.01.bb b/meta/recipes-bsp/u-boot/u-boot_2026.01.bb
index 6d9bc126a16..9610d9e8fe0 100644
--- a/meta/recipes-bsp/u-boot/u-boot_2026.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot_2026.01.bb
@@ -3,7 +3,9 @@ require u-boot.inc
 
 DEPENDS += "bc-native dtc-native gnutls-native python3-pyelftools-native"
 
-SRC_URI += "file://CVE-2026-33243.patch"
+SRC_URI += "file://CVE-2026-46728.patch"
+
+CVE_STATUS[CVE-2026-33243] = "cpe-incorrect: NVD currently maps this CVE to denx:u-boot, but that mapping is incorrect for U-Boot; the U-Boot-side FIT issue is tracked separately as CVE-2026-46728 and is fixed by the included U-Boot backport."
 
 # workarounds for aarch64 kvm qemu boot regressions
 SRC_URI:append:qemuarm64 = " file://disable-CONFIG_BLOBLIST.cfg"
-- 
2.35.6