From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BF69BC9830E for ; Thu, 24 Sep 2026 10:57:08 +0000 (UTC) Subject: Re: [scarthgap][Patch 02/11] u-boot-tools: Ignore CVE-2024-42040 To: openembedded-core@lists.openembedded.org From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Originating-Location: Mumbai, Maharashtra, IN (151.186.177.83) X-Originating-Platform: Windows Edge 153 User-Agent: GROUPS.IO Web Poster MIME-Version: 1.0 Date: Thu, 24 Sep 2026 03:56:52 -0700 References: <240b02378283bcfe760e1902a29fad5361fda380.1787731424.git.hthakar@cisco.com> In-Reply-To: Message-ID: <967518.1790247412147100715@lists.openembedded.org> Content-Type: multipart/alternative; boundary="Ryn05ZHLk9fTc0NuII3f" List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 24 Sep 2026 10:57:08 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246577 --Ryn05ZHLk9fTc0NuII3f Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable On Fri, Sep 11, 2026 at 06:19 PM, Yoann Congal wrote: >=20 > On Fri Sep 11, 2026 at 2:46 PM CEST, Yoann Congal wrote: >=20 >> On Wed Aug 26, 2026 at 10:12 AM CEST, Hetvi Thakar -X (hthakar - E >> INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote: >>=20 >>> From: Hetvi Thakar >>>=20 >>> Analysis: >>> - CVE-2024-42040 affects the U-Boot DHCP client in net/bootp.c [1]. >>> - u-boot-tools uses tools-only_defconfig, where CONFIG_NET is disabled >>> [2]. >>> - Hence ignore this CVE for u-boot-tools; the exclusion is >>> configuration-based. >>>=20 >>> Reference: >>> [1] https://nvd.nist.gov/vuln/detail/CVE-2024-42040 >>> [2] https://github.com/u-boot/u-boot/blob/866ca972d6c3/configs/tools-on= ly_defconfig >>>=20 >>>=20 >>> Signed-off-by: Hetvi Thakar >>> --- >>> meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb | 2 ++ >>> 1 file changed, 2 insertions(+) >>>=20 >>> diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb >>> b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb >>> index 4b6d89ed4e..b5711e1f97 100644 >>> --- a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb >>> +++ b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb >>> @@ -2,3 +2,5 @@ require u-boot-common.inc >>> require u-boot-tools.inc >>>=20 >>> SRC_URI +=3D "file://CVE-2026-46728.patch" >>> + >>> +CVE_STATUS[CVE-2024-42040] =3D "not-applicable-config: DHCP client cod= e in >>> net/bootp.c is not built by tools-only_defconfig, which disables >>> CONFIG_NET." >>=20 >> Hello, >>=20 >> I don't think we need this because, even if the code is not compiled, it >> has been fixed earlier in scarthgap: >> See 5c086db3f44 (u-boot: fix CVE-2024-42040, 2025-10-29) >> Same reasonning apply to other patches in this series. Can you check if >> we really need those? >>=20 >> Thanks! >=20 > In the meantime, I took 1/11 in my branch and held the rest (2-11/11). > Be aware of this if you send a new series. Hi Yoann, Thanks for pointing this out. The referenced fix was initially added in u-boot-common.inc, where it applied to both u-boot and u-boot-tools. It was later moved to u-boot.inc [1], so it now applies only to the u-boot recipe and not to u-boot-tools. u-boot-tools does not inherit u-boot.inc; it uses u-boot-common.inc and u-boot-tools.inc. Therefore, the existing CVE status is no longer applied to u-boot-tools. The CVE is still reported against u-boot-tools because its CVE_PRODUCT [2] maps to the U-Boot product. However, u-boot-tools uses tools-only_defconfig, where CONFIG_NET is disabled, so the vulnerable DHCP client code in net/bootp.c is not compiled. Therefore, the proposed change only adds a recipe-specific CVE status for u-boot-tools; it does not duplicate the source fix. I also noticed Peter's proposed change [3], which moves these CVE patches from u-boot.inc to u-boot-common.inc. Since u-boot-common.inc is inherited by both u-boot and u-boot-tools, this would cause all of those patches to be applied to u-boot-tools as well. I don't think this move is necessary, since not all of the affected code is built by u-boot-tools. The actual source fixes should remain with u-boot, where they are required. For u-boot-tools, the CVEs whose vulnerable code is not compiled can instead be handled with the appropriate CVE_STATUS entries. References: [1] https://git.openembedded.org/openembedded-core/commit/?h=3Dscarthgap&id= =3Df4ced8ff03147dd532a88cf3ce08d61fab057522 [2] https://git.openembedded.org/openembedded-core/commit/?h=3Dscarthgap&id= =3D9170fe393c379b9161a8843506420269f5b53e40 [3] https://patchwork.yoctoproject.org/project/oe-core/patch/20260923173850= .21338-1-peter.marko@siemens.com/ Regards, Hetvi >=20 >=20 > Thanks! > -- > Yoann Congal > Smile ECS --Ryn05ZHLk9fTc0NuII3f Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable
On Fri, Sep 11, 2026 at 06:19 PM, Yoann Congal wrote:
On Fri Sep 11, 2026 at 2:46 PM CEST, Yoann Congal wrote:
On Wed Aug 26, 2026 at 10:12 AM CEST, Hetvi Thakar -X (hthakar = - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
From: Hetvi Thakar <hthakar@cisco.com>

Analysi= s:
- CVE-2024-42040 affects the U-Boot DHCP client in net/bootp.c [1].=
- u-boot-tools uses tools-only_defconfig, where CONFIG_NET is disable= d
[2].
- Hence ignore this CVE for u-boot-tools; the exclusion is=
configuration-based.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2024-42040
[2] https://github.com/u-boot/u-boot/b= lob/866ca972d6c3/configs/tools-only_defconfig

Signed-off-by:= Hetvi Thakar <hthakar@cisco.com>
---
meta/recipes-bsp/u-bo= ot/u-boot-tools_2024.01.bb | 2 ++
1 file changed, 2 insertions(+)

diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb b/meta/= recipes-bsp/u-boot/u-boot-tools_2024.01.bb
index 4b6d89ed4e..b5711e1f9= 7 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
++= + b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
@@ -2,3 +2,5 @@ re= quire u-boot-common.inc
require u-boot-tools.inc

SRC_URI += =3D "file://CVE-2026-46728.patch"
+
+CVE_STATUS[CVE-2024-42040] = =3D "not-applicable-config: DHCP client code in net/bootp.c is not built by= tools-only_defconfig, which disables CONFIG_NET."
Hello,

I don't think we need this because, even if the code is n= ot compiled, it
has been fixed earlier in scarthgap:
See 5c086db3= f44 (u-boot: fix CVE-2024-42040, 2025-10-29)
Same reasonning apply to = other patches in this series. Can you check if
we really need those?
Thanks!
In the meantime, I took 1/11 in my branch and held the rest (2-11/11).
Be aware of this if you send a new series.

Hi Yoann,

Thanks for pointing this out.

The ref= erenced fix was initially added in u-boot-common.inc, where
it applied= to both u-boot and u-boot-tools. It was later moved to
u-boot.inc [1]= , so it now applies only to the u-boot recipe and
not to u-boot-tools.=

u-boot-tools does not inherit u-boot.inc; it uses
u-boot-c= ommon.inc and u-boot-tools.inc. Therefore, the existing
CVE status is = no longer applied to u-boot-tools.

The CVE is still reported aga= inst u-boot-tools because its
CVE_PRODUCT [2] maps to the U-Boot produ= ct. However, u-boot-tools
uses tools-only_defconfig, where CONFIG_NET = is disabled, so the
vulnerable DHCP client code in net/bootp.c is not = compiled.

Therefore, the proposed change only adds a recipe-spec= ific CVE status
for u-boot-tools; it does not duplicate the source fix= .

I also noticed Peter's proposed change [3], which moves these = CVE
patches from u-boot.inc to u-boot-common.inc. Since
u-boot-co= mmon.inc is inherited by both u-boot and u-boot-tools,
this would caus= e all of those patches to be applied to u-boot-tools
as well.
I don't think this move is necessary, since not all of the affected
code is built by u-boot-tools. The actual source fixes should remain
= with u-boot, where they are required. For u-boot-tools, the CVEs
whose= vulnerable code is not compiled can instead be handled with the
appro= priate CVE_STATUS entries.

References:
[1] https://git.open= embedded.org/openembedded-core/commit/?h=3Dscarthgap&id=3Df4ced8ff03147= dd532a88cf3ce08d61fab057522
[2] https://git.openembedded.org/openembed= ded-core/commit/?h=3Dscarthgap&id=3D9170fe393c379b9161a8843506420269f5b= 53e40
[3] https://patchwork.yoctoproject.org/project/oe-core/patch/202= 60923173850.21338-1-peter.marko@siemens.com/

Regards,
Hetvi=

Thanks!
--
Yoann Congal
Smile ECS
--Ryn05ZHLk9fTc0NuII3f--