* [OE-core][scarthgap 00/10] Patch review
@ 2024-06-11 13:07 Steve Sakoman
0 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2024-06-11 13:07 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Thursday, June 13.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7024
The following changes since commit a3f5ac9f9fee2c8e10fec7c3f758e49513fef724:
git: set --with-gitconfig=/etc/gitconfig for -native builds (2024-05-31 14:02:17 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Deepthi Hemraj (1):
gcc : upgrade to v13.3
Lei Maohui (1):
run-postinsts.service: Removed --no-reload to fix reload warning when
users execute systemctl in the first boot.
Mark Hatle (1):
binutils: Fix aarch64 disassembly abort
Martin Hundeb?ll (1):
classes: image_types: quote variable assignment needed by dash
Robert Joslyn (1):
libgloss: Do not apply non-existent patch
Ross Burton (1):
gdk-pixbuf: upgrade 2.42.11 -> 2.42.12
Siddharth (1):
openssl: Upgrade 3.2.1 -> 3.2.2
Soumya Sambu (2):
util-linux: Fix CVE-2024-28085
git: upgrade 2.44.0 -> 2.44.1
Wang Mingyu (1):
gdk-pixbuf: upgrade 2.42.10 -> 2.42.11
meta/classes-recipe/image_types.bbclass | 2 +-
meta/conf/distro/include/maintainers.inc | 2 +-
.../openssl/openssl/CVE-2024-2511.patch | 120 -
.../openssl/openssl/CVE-2024-4603.patch | 179 -
.../openssl/openssl/bti.patch | 58 -
.../{openssl_3.2.1.bb => openssl_3.2.2.bb} | 5 +-
meta/recipes-core/newlib/libgloss_git.bb | 1 -
meta/recipes-core/util-linux/util-linux.inc | 2 +
.../util-linux/CVE-2024-28085-0001.patch | 36 +
.../util-linux/CVE-2024-28085-0002.patch | 34 +
.../binutils/binutils-2.42.inc | 1 +
...sserts-from-operand-qualifier-decode.patch | 382 ++
.../gcc/{gcc-13.2.inc => gcc-13.3.inc} | 9 +-
...ian_13.2.bb => gcc-cross-canadian_13.3.bb} | 0
.../{gcc-cross_13.2.bb => gcc-cross_13.3.bb} | 0
...-crosssdk_13.2.bb => gcc-crosssdk_13.3.bb} | 0
...cc-runtime_13.2.bb => gcc-runtime_13.3.bb} | 0
...itizers_13.2.bb => gcc-sanitizers_13.3.bb} | 0
...{gcc-source_13.2.bb => gcc-source_13.3.bb} | 0
...AMIC_LINKER-and-UCLIBC_DYNAMIC_LINKE.patch | 9 +-
...ch64-Fix-loose-ldpstp-check-PR111411.patch | 117 -
.../gcc/gcc/CVE-2023-4039.patch | 3093 -----------------
.../gcc/gcc/CVE-2024-0151.patch | 315 --
.../gcc/{gcc_13.2.bb => gcc_13.3.bb} | 0
...initial_13.2.bb => libgcc-initial_13.3.bb} | 0
.../gcc/{libgcc_13.2.bb => libgcc_13.3.bb} | 0
...ibgfortran_13.2.bb => libgfortran_13.3.bb} | 0
.../git/{git_2.44.0.bb => git_2.44.1.bb} | 2 +-
.../run-postinsts/run-postinsts.service | 2 +-
...w-a-subset-of-tests-in-cross-compile.patch | 10 +-
.../gdk-pixbuf/gdk-pixbuf/fatal-loader.patch | 7 +-
...ixbuf_2.42.10.bb => gdk-pixbuf_2.42.12.bb} | 2 +-
32 files changed, 479 insertions(+), 3909 deletions(-)
delete mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2024-2511.patch
delete mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2024-4603.patch
delete mode 100644 meta/recipes-connectivity/openssl/openssl/bti.patch
rename meta/recipes-connectivity/openssl/{openssl_3.2.1.bb => openssl_3.2.2.bb} (97%)
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2024-28085-0001.patch
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2024-28085-0002.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0016-aarch64-Remove-asserts-from-operand-qualifier-decode.patch
rename meta/recipes-devtools/gcc/{gcc-13.2.inc => gcc-13.3.inc} (94%)
rename meta/recipes-devtools/gcc/{gcc-cross-canadian_13.2.bb => gcc-cross-canadian_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-cross_13.2.bb => gcc-cross_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-crosssdk_13.2.bb => gcc-crosssdk_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-runtime_13.2.bb => gcc-runtime_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-sanitizers_13.2.bb => gcc-sanitizers_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-source_13.2.bb => gcc-source_13.3.bb} (100%)
delete mode 100644 meta/recipes-devtools/gcc/gcc/0026-aarch64-Fix-loose-ldpstp-check-PR111411.patch
delete mode 100644 meta/recipes-devtools/gcc/gcc/CVE-2023-4039.patch
delete mode 100644 meta/recipes-devtools/gcc/gcc/CVE-2024-0151.patch
rename meta/recipes-devtools/gcc/{gcc_13.2.bb => gcc_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{libgcc-initial_13.2.bb => libgcc-initial_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{libgcc_13.2.bb => libgcc_13.3.bb} (100%)
rename meta/recipes-devtools/gcc/{libgfortran_13.2.bb => libgfortran_13.3.bb} (100%)
rename meta/recipes-devtools/git/{git_2.44.0.bb => git_2.44.1.bb} (98%)
rename meta/recipes-gnome/gdk-pixbuf/{gdk-pixbuf_2.42.10.bb => gdk-pixbuf_2.42.12.bb} (98%)
--
2.34.1
^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 00/10] Patch review
@ 2024-08-08 2:28 Steve Sakoman
0 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2024-08-08 2:28 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Friday, August 9
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7220
with the exception of a load related parsing failure on qemuarm64-armhost
which passed on subsequent re-test:
https://autobuilder.yoctoproject.org/typhoon/#/builders/97/builds/8717
The following changes since commit 136a25567499191b23a4d000a06bf83a473224ca:
rust: Add new varaible RUST_ENABLE_EXTRA_TOOLS (2024-08-03 11:45:57 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Archana Polampalli (1):
ffmpeg: fix CVE-2024-31582
Ashish Sharma (1):
bind: Upgrade 9.18.25 -> 9.18.28
Changqing Li (2):
curl: correct the PACKAGECONFIG for native/nativesdk
libpng: update SRC_URI
Peter Marko (4):
curl: Patch CVE-2024-6197
glibc: cleanup old cve status
qemu: set cve status for CVE-2023-6683
libmnl: explicitly disable doxygen
Richard Purdie (1):
nasm: Upgrade 2.16.01 -> 2.16.03
Wang Mingyu (1):
orc: upgrade 0.4.38 -> 0.4.39
.../bind/{bind_9.18.25.bb => bind_9.18.28.bb} | 2 +-
meta/recipes-core/glibc/glibc-version.inc | 2 --
.../nasm/{nasm_2.16.01.bb => nasm_2.16.03.bb} | 2 +-
.../orc/{orc_0.4.38.bb => orc_0.4.39.bb} | 2 +-
meta/recipes-devtools/qemu/qemu.inc | 2 ++
meta/recipes-extended/libmnl/libmnl_1.0.5.bb | 2 ++
.../ffmpeg/ffmpeg/CVE-2024-31582.patch | 34 +++++++++++++++++++
.../recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb | 1 +
.../libpng/libpng_1.6.42.bb | 2 +-
.../curl/curl/CVE-2024-6197.patch | 24 +++++++++++++
meta/recipes-support/curl/curl_8.7.1.bb | 5 +--
11 files changed, 70 insertions(+), 8 deletions(-)
rename meta/recipes-connectivity/bind/{bind_9.18.25.bb => bind_9.18.28.bb} (97%)
rename meta/recipes-devtools/nasm/{nasm_2.16.01.bb => nasm_2.16.03.bb} (88%)
rename meta/recipes-devtools/orc/{orc_0.4.38.bb => orc_0.4.39.bb} (92%)
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-31582.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2024-6197.patch
--
2.34.1
^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 00/10] Patch review
@ 2024-10-07 1:54 Steve Sakoman
2024-10-07 3:23 ` Khem Raj
0 siblings, 1 reply; 19+ messages in thread
From: Steve Sakoman @ 2024-10-07 1:54 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Tuesday, October 8
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7374
The following changes since commit 3d894863f442188bad446095bd7fdd82665bb54b:
makedevs: Fix issue when rootdir of / is given (2024-09-28 05:21:51 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Deepesh Varatharajan (1):
glibc: stable 2.39 branch updates.
Hitendra Prajapati (1):
webkitgtk: upgrade 2.44.1 -> 2.44.3
Khem Raj (2):
gnupg: Document CVE-2022-3219 and mark wontfix
openssh: Mark CVE-2023-51767 as wont-fix
Martin Jansa (2):
populate_sdk_base: inherit nopackages
meta-world-pkgdata: Inherit nopackages
Peter Marko (3):
wpa-supplicant: Ignore CVE-2024-5290
wpa-supplicant: Patch CVE-2024-3596
wpa-supplicant: Patch security advisory 2024-2
Wang Mingyu (1):
cryptodev: upgrade 1.13 -> 1.14
meta/classes-recipe/populate_sdk_base.bbclass | 2 +-
.../openssh/openssh_9.6p1.bb | 1 +
...valid-Rejected-Groups-element-length.patch | 52 ++++++
...valid-Rejected-Groups-element-length.patch | 50 ++++++
...id-Rejected-Groups-element-in-the-pa.patch | 38 ++++
.../wpa-supplicant/CVE-2024-3596_00.patch | 82 +++++++++
.../wpa-supplicant/CVE-2024-3596_01.patch | 165 ++++++++++++++++++
.../wpa-supplicant/CVE-2024-3596_02.patch | 62 +++++++
.../wpa-supplicant/CVE-2024-3596_03.patch | 37 ++++
.../wpa-supplicant/CVE-2024-3596_04.patch | 52 ++++++
.../wpa-supplicant/CVE-2024-3596_05.patch | 51 ++++++
.../wpa-supplicant/CVE-2024-3596_06.patch | 46 +++++
.../wpa-supplicant/CVE-2024-3596_07.patch | 67 +++++++
.../wpa-supplicant/CVE-2024-3596_08.patch | 47 +++++
.../wpa-supplicant/wpa-supplicant_2.10.bb | 14 ++
meta/recipes-core/glibc/glibc-version.inc | 2 +-
meta/recipes-core/meta/meta-world-pkgdata.bb | 1 +
...-linux_1.13.bb => cryptodev-linux_1.14.bb} | 0
...odule_1.13.bb => cryptodev-module_1.14.bb} | 3 -
...-tests_1.13.bb => cryptodev-tests_1.14.bb} | 4 -
meta/recipes-kernel/cryptodev/cryptodev.inc | 4 +-
...ng-header-file-provided-by-another-p.patch | 25 ---
...001-tests-Makefile-do-not-use-Werror.patch | 25 ---
...able-to-control-macro-__PAS_ALWAYS_I.patch | 6 +-
...spection.cmake-prefix-variables-obta.patch | 2 +-
...fic-declarations-in-FELighting.h-unn.patch | 44 -----
...icDowncast-adoption-in-platform-code.patch | 65 -------
...d5e22213fdaca2a29ec3400c927d710a37a8.patch | 2 +-
.../webkit/webkitgtk/no-musttail-arm.patch | 6 +-
.../webkit/webkitgtk/reproducibility.patch | 2 +-
.../webkit/webkitgtk/t6-not-declared.patch | 12 +-
...ebkitgtk_2.44.1.bb => webkitgtk_2.44.3.bb} | 6 +-
meta/recipes-support/gnupg/gnupg_2.4.4.bb | 1 +
33 files changed, 786 insertions(+), 190 deletions(-)
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-SAE-Reject-invalid-Rejected-Groups-element-in-the-pa.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_00.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_01.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_02.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_03.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_04.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_05.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_06.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_07.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_08.patch
rename meta/recipes-kernel/cryptodev/{cryptodev-linux_1.13.bb => cryptodev-linux_1.14.bb} (100%)
rename meta/recipes-kernel/cryptodev/{cryptodev-module_1.13.bb => cryptodev-module_1.14.bb} (74%)
rename meta/recipes-kernel/cryptodev/{cryptodev-tests_1.13.bb => cryptodev-tests_1.14.bb} (74%)
delete mode 100644 meta/recipes-kernel/cryptodev/files/0001-Disable-installing-header-file-provided-by-another-p.patch
delete mode 100644 meta/recipes-kernel/cryptodev/files/0001-tests-Makefile-do-not-use-Werror.patch
delete mode 100644 meta/recipes-sato/webkit/webkitgtk/0001-Remove-ARM-specific-declarations-in-FELighting.h-unn.patch
delete mode 100644 meta/recipes-sato/webkit/webkitgtk/0002-More-dynamicDowncast-adoption-in-platform-code.patch
rename meta/recipes-sato/webkit/{webkitgtk_2.44.1.bb => webkitgtk_2.44.3.bb} (96%)
--
2.34.1
^ permalink raw reply [flat|nested] 19+ messages in thread
* Re: [OE-core][scarthgap 00/10] Patch review
2024-10-07 1:54 Steve Sakoman
@ 2024-10-07 3:23 ` Khem Raj
0 siblings, 0 replies; 19+ messages in thread
From: Khem Raj @ 2024-10-07 3:23 UTC (permalink / raw)
To: steve; +Cc: openembedded-core
series looks ok to me.
On Sun, Oct 6, 2024 at 6:55 PM Steve Sakoman via
lists.openembedded.org <steve=sakoman.com@lists.openembedded.org>
wrote:
>
> Please review this set of changes for scarthgap and have comments back by
> end of day Tuesday, October 8
>
> Passed a-full on autobuilder:
>
> https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7374
>
> The following changes since commit 3d894863f442188bad446095bd7fdd82665bb54b:
>
> makedevs: Fix issue when rootdir of / is given (2024-09-28 05:21:51 -0700)
>
> are available in the Git repository at:
>
> https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
> https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
>
> Deepesh Varatharajan (1):
> glibc: stable 2.39 branch updates.
>
> Hitendra Prajapati (1):
> webkitgtk: upgrade 2.44.1 -> 2.44.3
>
> Khem Raj (2):
> gnupg: Document CVE-2022-3219 and mark wontfix
> openssh: Mark CVE-2023-51767 as wont-fix
>
> Martin Jansa (2):
> populate_sdk_base: inherit nopackages
> meta-world-pkgdata: Inherit nopackages
>
> Peter Marko (3):
> wpa-supplicant: Ignore CVE-2024-5290
> wpa-supplicant: Patch CVE-2024-3596
> wpa-supplicant: Patch security advisory 2024-2
>
> Wang Mingyu (1):
> cryptodev: upgrade 1.13 -> 1.14
>
> meta/classes-recipe/populate_sdk_base.bbclass | 2 +-
> .../openssh/openssh_9.6p1.bb | 1 +
> ...valid-Rejected-Groups-element-length.patch | 52 ++++++
> ...valid-Rejected-Groups-element-length.patch | 50 ++++++
> ...id-Rejected-Groups-element-in-the-pa.patch | 38 ++++
> .../wpa-supplicant/CVE-2024-3596_00.patch | 82 +++++++++
> .../wpa-supplicant/CVE-2024-3596_01.patch | 165 ++++++++++++++++++
> .../wpa-supplicant/CVE-2024-3596_02.patch | 62 +++++++
> .../wpa-supplicant/CVE-2024-3596_03.patch | 37 ++++
> .../wpa-supplicant/CVE-2024-3596_04.patch | 52 ++++++
> .../wpa-supplicant/CVE-2024-3596_05.patch | 51 ++++++
> .../wpa-supplicant/CVE-2024-3596_06.patch | 46 +++++
> .../wpa-supplicant/CVE-2024-3596_07.patch | 67 +++++++
> .../wpa-supplicant/CVE-2024-3596_08.patch | 47 +++++
> .../wpa-supplicant/wpa-supplicant_2.10.bb | 14 ++
> meta/recipes-core/glibc/glibc-version.inc | 2 +-
> meta/recipes-core/meta/meta-world-pkgdata.bb | 1 +
> ...-linux_1.13.bb => cryptodev-linux_1.14.bb} | 0
> ...odule_1.13.bb => cryptodev-module_1.14.bb} | 3 -
> ...-tests_1.13.bb => cryptodev-tests_1.14.bb} | 4 -
> meta/recipes-kernel/cryptodev/cryptodev.inc | 4 +-
> ...ng-header-file-provided-by-another-p.patch | 25 ---
> ...001-tests-Makefile-do-not-use-Werror.patch | 25 ---
> ...able-to-control-macro-__PAS_ALWAYS_I.patch | 6 +-
> ...spection.cmake-prefix-variables-obta.patch | 2 +-
> ...fic-declarations-in-FELighting.h-unn.patch | 44 -----
> ...icDowncast-adoption-in-platform-code.patch | 65 -------
> ...d5e22213fdaca2a29ec3400c927d710a37a8.patch | 2 +-
> .../webkit/webkitgtk/no-musttail-arm.patch | 6 +-
> .../webkit/webkitgtk/reproducibility.patch | 2 +-
> .../webkit/webkitgtk/t6-not-declared.patch | 12 +-
> ...ebkitgtk_2.44.1.bb => webkitgtk_2.44.3.bb} | 6 +-
> meta/recipes-support/gnupg/gnupg_2.4.4.bb | 1 +
> 33 files changed, 786 insertions(+), 190 deletions(-)
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-SAE-Reject-invalid-Rejected-Groups-element-in-the-pa.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_00.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_01.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_02.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_03.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_04.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_05.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_06.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_07.patch
> create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_08.patch
> rename meta/recipes-kernel/cryptodev/{cryptodev-linux_1.13.bb => cryptodev-linux_1.14.bb} (100%)
> rename meta/recipes-kernel/cryptodev/{cryptodev-module_1.13.bb => cryptodev-module_1.14.bb} (74%)
> rename meta/recipes-kernel/cryptodev/{cryptodev-tests_1.13.bb => cryptodev-tests_1.14.bb} (74%)
> delete mode 100644 meta/recipes-kernel/cryptodev/files/0001-Disable-installing-header-file-provided-by-another-p.patch
> delete mode 100644 meta/recipes-kernel/cryptodev/files/0001-tests-Makefile-do-not-use-Werror.patch
> delete mode 100644 meta/recipes-sato/webkit/webkitgtk/0001-Remove-ARM-specific-declarations-in-FELighting.h-unn.patch
> delete mode 100644 meta/recipes-sato/webkit/webkitgtk/0002-More-dynamicDowncast-adoption-in-platform-code.patch
> rename meta/recipes-sato/webkit/{webkitgtk_2.44.1.bb => webkitgtk_2.44.3.bb} (96%)
>
> --
> 2.34.1
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#205248): https://lists.openembedded.org/g/openembedded-core/message/205248
> Mute This Topic: https://lists.openembedded.org/mt/108861069/1997914
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [raj.khem@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 00/10] Patch review
@ 2024-11-07 3:37 Steve Sakoman
0 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2024-11-07 3:37 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for scarthgap and have comments back by
end of day Friday, November 8
Passed a-full on autobuilder:
https://valkyrie.yoctoproject.org/#/builders/29/builds/400
The following changes since commit bcd4e6d77dc7455a453e69b6d37769ec94cc02ad:
lsb-release: fix Distro Codename shell escaping (2024-10-24 06:09:29 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Aditya Tayade (1):
e2fsprogs: removed 'sed -u' option
Deepthi Hemraj (1):
rust-llvm: Fix CVE-2024-0151
Hiago De Franco (1):
weston: backport patch to allow neatvnc < v0.9.0
Martin Jansa (1):
python3-lxml=v5.0.2
Peter Marko (3):
cve-check: add support for cvss v4.0
go: upgrade 1.22.6 -> 1.22.7
go: upgrade 1.22.7 -> 1.22.8
Richard Purdie (1):
cve_check: Use a local copy of the database during builds
Vijay Anusuri (1):
xserver-xorg: upgrade 21.1.13 -> 21.1.14
Wang Mingyu (1):
orc: upgrade 0.4.39 -> 0.4.40
meta/classes/cve-check.bbclass | 16 +-
.../meta/cve-update-nvd2-native.bb | 32 +-
.../e2fsprogs/e2fsprogs/run-ptest | 3 +-
.../go/{go-1.22.6.inc => go-1.22.8.inc} | 2 +-
...e_1.22.6.bb => go-binary-native_1.22.8.bb} | 6 +-
..._1.22.6.bb => go-cross-canadian_1.22.8.bb} | 0
...{go-cross_1.22.6.bb => go-cross_1.22.8.bb} | 0
...osssdk_1.22.6.bb => go-crosssdk_1.22.8.bb} | 0
...runtime_1.22.6.bb => go-runtime_1.22.8.bb} | 0
.../go/{go_1.22.6.bb => go_1.22.8.bb} | 0
.../orc/{orc_0.4.39.bb => orc_0.4.40.bb} | 2 +-
...n3-lxml_5.0.0.bb => python3-lxml_5.0.2.bb} | 3 +-
.../0004-llvm-Fix-CVE-2024-0151.patch | 1086 +++++++++++++++++
.../recipes-devtools/rust/rust-llvm_1.75.0.bb | 3 +-
...1-vnc-Allow-neatvnc-in-version-0.8.0.patch | 27 +
.../recipes-graphics/wayland/weston_13.0.1.bb | 1 +
...org_21.1.13.bb => xserver-xorg_21.1.14.bb} | 2 +-
17 files changed, 1158 insertions(+), 25 deletions(-)
rename meta/recipes-devtools/go/{go-1.22.6.inc => go-1.22.8.inc} (89%)
rename meta/recipes-devtools/go/{go-binary-native_1.22.6.bb => go-binary-native_1.22.8.bb} (78%)
rename meta/recipes-devtools/go/{go-cross-canadian_1.22.6.bb => go-cross-canadian_1.22.8.bb} (100%)
rename meta/recipes-devtools/go/{go-cross_1.22.6.bb => go-cross_1.22.8.bb} (100%)
rename meta/recipes-devtools/go/{go-crosssdk_1.22.6.bb => go-crosssdk_1.22.8.bb} (100%)
rename meta/recipes-devtools/go/{go-runtime_1.22.6.bb => go-runtime_1.22.8.bb} (100%)
rename meta/recipes-devtools/go/{go_1.22.6.bb => go_1.22.8.bb} (100%)
rename meta/recipes-devtools/orc/{orc_0.4.39.bb => orc_0.4.40.bb} (92%)
rename meta/recipes-devtools/python/{python3-lxml_5.0.0.bb => python3-lxml_5.0.2.bb} (94%)
create mode 100644 meta/recipes-devtools/rust/rust-llvm/0004-llvm-Fix-CVE-2024-0151.patch
create mode 100644 meta/recipes-graphics/wayland/weston/0001-vnc-Allow-neatvnc-in-version-0.8.0.patch
rename meta/recipes-graphics/xorg-xserver/{xserver-xorg_21.1.13.bb => xserver-xorg_21.1.14.bb} (92%)
--
2.34.1
^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 00/10] Patch review
@ 2024-12-18 22:02 Steve Sakoman
0 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2024-12-18 22:02 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Friday, December 20
Passed a-full on autobuilder:
https://valkyrie.yoctoproject.org/#/builders/29/builds/674
The following changes since commit b19b1e905d966443c4e4d17dfaeb299ae2526575:
cve-update-nvd2-native: Tweak to work better with NFS DL_DIR (2024-12-18 06:41:14 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Alexander Kanavin (1):
rust: add reproducibility patch to eliminate host leakage
Archana Polampalli (3):
ffmpeg: fix CVE-2024-35366
ffmpeg: fix CVE-2024-35367
ffmpeg: fix CVE-2024-35368
Hongxu Jia (1):
kern-tools-native: fix SyntaxWarning for RegEx calls on Python 3.12
Jiaying Song (1):
subversion: fix CVE-2024-46901
Khem Raj (1):
python3: Drop empty patch
Ross Burton (1):
python3: add dependency on -compression to -core
Sunil Dora (1):
gcc: Fix c++: tweak for Wrange-loop-construct
Yash Shinde (1):
binutils: Fix CVE-2024-53589
.../binutils/binutils-2.42.inc | 1 +
.../binutils/0016-CVE-2024-53589.patch | 92 ++++++++++
meta/recipes-devtools/gcc/gcc-13.3.inc | 1 +
...ix-c-tweak-for-Wrange-loop-construct.patch | 113 ++++++++++++
...lize-struct-termios-before-calling-t.patch | 26 ---
.../python/python3/python3-manifest.json | 2 +-
.../recipes-devtools/python/python3_3.12.6.bb | 1 -
...te-host-information-into-compilation.patch | 51 ++++++
meta/recipes-devtools/rust/rust-source.inc | 1 +
.../subversion/CVE-2024-46901.patch | 161 ++++++++++++++++++
.../subversion/subversion_1.14.3.bb | 3 +-
...yntaxWarning-for-RegEx-calls-on-Pyth.patch | 60 +++++++
.../kern-tools/kern-tools-native_git.bb | 4 +-
.../ffmpeg/ffmpeg/CVE-2024-35366.patch | 35 ++++
.../ffmpeg/ffmpeg/CVE-2024-35367.patch | 47 +++++
.../ffmpeg/ffmpeg/CVE-2024-35368.patch | 41 +++++
.../recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb | 3 +
17 files changed, 612 insertions(+), 30 deletions(-)
create mode 100644 meta/recipes-devtools/binutils/binutils/0016-CVE-2024-53589.patch
create mode 100644 meta/recipes-devtools/gcc/gcc/0028-gcc-Fix-c-tweak-for-Wrange-loop-construct.patch
delete mode 100644 meta/recipes-devtools/python/python3/0001-gh-114492-Initialize-struct-termios-before-calling-t.patch
create mode 100644 meta/recipes-devtools/rust/files/0001-cargo-do-not-write-host-information-into-compilation.patch
create mode 100644 meta/recipes-devtools/subversion/subversion/CVE-2024-46901.patch
create mode 100644 meta/recipes-kernel/kern-tools/files/0001-symbol_why-fix-SyntaxWarning-for-RegEx-calls-on-Pyth.patch
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35366.patch
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35367.patch
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35368.patch
--
2.34.1
^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 00/10] Patch review
@ 2025-02-25 20:56 Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 01/10] u-boot: fix CVE-2024-57254 Steve Sakoman
` (9 more replies)
0 siblings, 10 replies; 19+ messages in thread
From: Steve Sakoman @ 2025-02-25 20:56 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Thursday, February 27
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1081
The following changes since commit fc46705cc629a151f85717a57f7d789de8fd9b64:
icu: remove host references in nativesdk to fix reproducibility (2025-02-19 06:28:10 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Etienne Cordonnier (1):
python3-setuptools-scm: respect GIT_CEILING_DIRECTORIES
Hitendra Prajapati (1):
libcap: fix CVE-2025-1390
Hongxu Jia (6):
u-boot: fix CVE-2024-57254
u-boot: fix CVE-2024-57255
u-boot: fix CVE-2024-57256
u-boot: fix CVE-2024-57257
u-boot: fix CVE-2024-57258
u-boot: fix CVE-2024-57259
Peter Marko (1):
libxml2: upgrade 2.12.9 -> 2.12.10
Vijay Anusuri (1):
bind: Upgrade 9.18.28 -> 9.18.33
.../u-boot/files/CVE-2024-57254.patch | 47 ++++
.../u-boot/files/CVE-2024-57255.patch | 53 ++++
.../u-boot/files/CVE-2024-57256.patch | 51 ++++
.../u-boot/files/CVE-2024-57257.patch | 227 ++++++++++++++++++
.../u-boot/files/CVE-2024-57258-1.patch | 47 ++++
.../u-boot/files/CVE-2024-57258-2.patch | 43 ++++
.../u-boot/files/CVE-2024-57258-3.patch | 40 +++
.../u-boot/files/CVE-2024-57259.patch | 41 ++++
meta/recipes-bsp/u-boot/u-boot-common.inc | 11 +-
.../bind/{bind_9.18.28.bb => bind_9.18.33.bb} | 2 +-
.../{libxml2_2.12.9.bb => libxml2_2.12.10.bb} | 2 +-
...0001-respect-GIT_CEILING_DIRECTORIES.patch | 36 +++
.../python/python3-setuptools-scm_8.0.4.bb | 1 +
.../libcap/files/CVE-2025-1390.patch | 36 +++
meta/recipes-support/libcap/libcap_2.69.bb | 1 +
15 files changed, 635 insertions(+), 3 deletions(-)
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57254.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57255.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57256.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57257.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57258-1.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57258-2.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57258-3.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57259.patch
rename meta/recipes-connectivity/bind/{bind_9.18.28.bb => bind_9.18.33.bb} (97%)
rename meta/recipes-core/libxml/{libxml2_2.12.9.bb => libxml2_2.12.10.bb} (97%)
create mode 100644 meta/recipes-devtools/python/python3-setuptools-scm/0001-respect-GIT_CEILING_DIRECTORIES.patch
create mode 100644 meta/recipes-support/libcap/files/CVE-2025-1390.patch
--
2.43.0
^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 01/10] u-boot: fix CVE-2024-57254
2025-02-25 20:56 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
@ 2025-02-25 20:56 ` Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 02/10] u-boot: fix CVE-2024-57255 Steve Sakoman
` (8 subsequent siblings)
9 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2025-02-25 20:56 UTC (permalink / raw)
To: openembedded-core
From: Hongxu Jia <hongxu.jia@windriver.com>
An integer overflow in sqfs_inode_size in Das U-Boot before
2025.01-rc1 occurs in the symlink size calculation via a
crafted squashfs filesystem.
https://nvd.nist.gov/vuln/detail/CVE-2024-57254
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../u-boot/files/CVE-2024-57254.patch | 47 +++++++++++++++++++
meta/recipes-bsp/u-boot/u-boot-common.inc | 4 +-
2 files changed, 50 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57254.patch
diff --git a/meta/recipes-bsp/u-boot/files/CVE-2024-57254.patch b/meta/recipes-bsp/u-boot/files/CVE-2024-57254.patch
new file mode 100644
index 0000000000..be00121224
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/CVE-2024-57254.patch
@@ -0,0 +1,47 @@
+From 3f9deb424ecd6ecd50f165b42f0b0290d83853f5 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Fri, 2 Aug 2024 18:36:45 +0200
+Subject: [PATCH 1/8] squashfs: Fix integer overflow in sqfs_inode_size()
+
+A carefully crafted squashfs filesystem can exhibit an extremly large
+inode size and overflow the calculation in sqfs_inode_size().
+As a consequence, the squashfs driver will read from wrong locations.
+
+Fix by using __builtin_add_overflow() to detect the overflow.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+
+CVE: CVE-2024-57254
+Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/c8e929e5758999933f9e905049ef2bf3fe6b140d]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ fs/squashfs/sqfs_inode.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/fs/squashfs/sqfs_inode.c b/fs/squashfs/sqfs_inode.c
+index d25cfb53..bb3ccd37 100644
+--- a/fs/squashfs/sqfs_inode.c
++++ b/fs/squashfs/sqfs_inode.c
+@@ -78,11 +78,16 @@ int sqfs_inode_size(struct squashfs_base_inode *inode, u32 blk_size)
+
+ case SQFS_SYMLINK_TYPE:
+ case SQFS_LSYMLINK_TYPE: {
++ int size;
++
+ struct squashfs_symlink_inode *symlink =
+ (struct squashfs_symlink_inode *)inode;
+
+- return sizeof(*symlink) +
+- get_unaligned_le32(&symlink->symlink_size);
++ if (__builtin_add_overflow(sizeof(*symlink),
++ get_unaligned_le32(&symlink->symlink_size), &size))
++ return -EINVAL;
++
++ return size;
+ }
+
+ case SQFS_BLKDEV_TYPE:
+--
+2.34.1
+
diff --git a/meta/recipes-bsp/u-boot/u-boot-common.inc b/meta/recipes-bsp/u-boot/u-boot-common.inc
index 1f17bd7d0a..9ce42e829f 100644
--- a/meta/recipes-bsp/u-boot/u-boot-common.inc
+++ b/meta/recipes-bsp/u-boot/u-boot-common.inc
@@ -14,7 +14,9 @@ PE = "1"
# repo during parse
SRCREV = "866ca972d6c3cabeaf6dbac431e8e08bb30b3c8e"
-SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master"
+SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master \
+ file://CVE-2024-57254.patch \
+"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build"
--
2.43.0
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 02/10] u-boot: fix CVE-2024-57255
2025-02-25 20:56 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 01/10] u-boot: fix CVE-2024-57254 Steve Sakoman
@ 2025-02-25 20:56 ` Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 03/10] u-boot: fix CVE-2024-57256 Steve Sakoman
` (7 subsequent siblings)
9 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2025-02-25 20:56 UTC (permalink / raw)
To: openembedded-core
From: Hongxu Jia <hongxu.jia@windriver.com>
An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1
occurs via a crafted squashfs filesystem with an inode size of 0xffffffff,
resulting in a malloc of zero and resultant memory overwrite.
https://nvd.nist.gov/vuln/detail/CVE-2024-57255
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../u-boot/files/CVE-2024-57255.patch | 53 +++++++++++++++++++
meta/recipes-bsp/u-boot/u-boot-common.inc | 1 +
2 files changed, 54 insertions(+)
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57255.patch
diff --git a/meta/recipes-bsp/u-boot/files/CVE-2024-57255.patch b/meta/recipes-bsp/u-boot/files/CVE-2024-57255.patch
new file mode 100644
index 0000000000..4ca72da554
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/CVE-2024-57255.patch
@@ -0,0 +1,53 @@
+From 5d7ca74388544bf8c95e104517a9120e94bfe40d Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Fri, 2 Aug 2024 18:36:44 +0200
+Subject: [PATCH 2/8] squashfs: Fix integer overflow in sqfs_resolve_symlink()
+
+A carefully crafted squashfs filesystem can exhibit an inode size of 0xffffffff,
+as a consequence malloc() will do a zero allocation.
+Later in the function the inode size is again used for copying data.
+So an attacker can overwrite memory.
+Avoid the overflow by using the __builtin_add_overflow() helper.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+
+CVE: CVE-2024-57255
+Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/233945eba63e24061dffeeaeb7cd6fe985278356]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ fs/squashfs/sqfs.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
+index 1430e671..16a07c06 100644
+--- a/fs/squashfs/sqfs.c
++++ b/fs/squashfs/sqfs.c
+@@ -422,8 +422,10 @@ static char *sqfs_resolve_symlink(struct squashfs_symlink_inode *sym,
+ char *resolved, *target;
+ u32 sz;
+
+- sz = get_unaligned_le32(&sym->symlink_size);
+- target = malloc(sz + 1);
++ if (__builtin_add_overflow(get_unaligned_le32(&sym->symlink_size), 1, &sz))
++ return NULL;
++
++ target = malloc(sz);
+ if (!target)
+ return NULL;
+
+@@ -431,9 +433,9 @@ static char *sqfs_resolve_symlink(struct squashfs_symlink_inode *sym,
+ * There is no trailling null byte in the symlink's target path, so a
+ * copy is made and a '\0' is added at its end.
+ */
+- target[sz] = '\0';
++ target[sz - 1] = '\0';
+ /* Get target name (relative path) */
+- strncpy(target, sym->symlink, sz);
++ strncpy(target, sym->symlink, sz - 1);
+
+ /* Relative -> absolute path conversion */
+ resolved = sqfs_get_abs_path(base_path, target);
+--
+2.34.1
+
diff --git a/meta/recipes-bsp/u-boot/u-boot-common.inc b/meta/recipes-bsp/u-boot/u-boot-common.inc
index 9ce42e829f..e907edd2eb 100644
--- a/meta/recipes-bsp/u-boot/u-boot-common.inc
+++ b/meta/recipes-bsp/u-boot/u-boot-common.inc
@@ -16,6 +16,7 @@ SRCREV = "866ca972d6c3cabeaf6dbac431e8e08bb30b3c8e"
SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master \
file://CVE-2024-57254.patch \
+ file://CVE-2024-57255.patch \
"
S = "${WORKDIR}/git"
--
2.43.0
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 03/10] u-boot: fix CVE-2024-57256
2025-02-25 20:56 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 01/10] u-boot: fix CVE-2024-57254 Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 02/10] u-boot: fix CVE-2024-57255 Steve Sakoman
@ 2025-02-25 20:56 ` Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 04/10] u-boot: fix CVE-2024-57257 Steve Sakoman
` (6 subsequent siblings)
9 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2025-02-25 20:56 UTC (permalink / raw)
To: openembedded-core
From: Hongxu Jia <hongxu.jia@windriver.com>
An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1
occurs for zalloc (adding one to an le32 variable) via a crafted ext4
filesystem with an inode size of 0xffffffff, resulting in a malloc of
zero and resultant memory overwrite.
https://nvd.nist.gov/vuln/detail/CVE-2024-57256
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../u-boot/files/CVE-2024-57256.patch | 51 +++++++++++++++++++
meta/recipes-bsp/u-boot/u-boot-common.inc | 1 +
2 files changed, 52 insertions(+)
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57256.patch
diff --git a/meta/recipes-bsp/u-boot/files/CVE-2024-57256.patch b/meta/recipes-bsp/u-boot/files/CVE-2024-57256.patch
new file mode 100644
index 0000000000..78cf4ac225
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/CVE-2024-57256.patch
@@ -0,0 +1,51 @@
+From 49cab731abe7a98db4ac16666e3b5ab3bc799282 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Fri, 9 Aug 2024 11:54:28 +0200
+Subject: [PATCH 3/8] ext4: Fix integer overflow in ext4fs_read_symlink()
+
+While zalloc() takes a size_t type, adding 1 to the le32 variable
+will overflow.
+A carefully crafted ext4 filesystem can exhibit an inode size of 0xffffffff
+and as consequence zalloc() will do a zero allocation.
+
+Later in the function the inode size is again used for copying data.
+So an attacker can overwrite memory.
+
+Avoid the overflow by using the __builtin_add_overflow() helper.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+
+CVE: CVE-2024-57256
+Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/35f75d2a46e5859138c83a75cd2f4141c5479ab9]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ fs/ext4/ext4_common.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/ext4_common.c b/fs/ext4/ext4_common.c
+index f50de7c0..a7798296 100644
+--- a/fs/ext4/ext4_common.c
++++ b/fs/ext4/ext4_common.c
+@@ -2188,13 +2188,18 @@ static char *ext4fs_read_symlink(struct ext2fs_node *node)
+ struct ext2fs_node *diro = node;
+ int status;
+ loff_t actread;
++ size_t alloc_size;
+
+ if (!diro->inode_read) {
+ status = ext4fs_read_inode(diro->data, diro->ino, &diro->inode);
+ if (status == 0)
+ return NULL;
+ }
+- symlink = zalloc(le32_to_cpu(diro->inode.size) + 1);
++
++ if (__builtin_add_overflow(le32_to_cpu(diro->inode.size), 1, &alloc_size))
++ return NULL;
++
++ symlink = zalloc(alloc_size);
+ if (!symlink)
+ return NULL;
+
+--
+2.34.1
+
diff --git a/meta/recipes-bsp/u-boot/u-boot-common.inc b/meta/recipes-bsp/u-boot/u-boot-common.inc
index e907edd2eb..097ef685e9 100644
--- a/meta/recipes-bsp/u-boot/u-boot-common.inc
+++ b/meta/recipes-bsp/u-boot/u-boot-common.inc
@@ -17,6 +17,7 @@ SRCREV = "866ca972d6c3cabeaf6dbac431e8e08bb30b3c8e"
SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master \
file://CVE-2024-57254.patch \
file://CVE-2024-57255.patch \
+ file://CVE-2024-57256.patch \
"
S = "${WORKDIR}/git"
--
2.43.0
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 04/10] u-boot: fix CVE-2024-57257
2025-02-25 20:56 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
` (2 preceding siblings ...)
2025-02-25 20:56 ` [OE-core][scarthgap 03/10] u-boot: fix CVE-2024-57256 Steve Sakoman
@ 2025-02-25 20:56 ` Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 05/10] u-boot: fix CVE-2024-57258 Steve Sakoman
` (5 subsequent siblings)
9 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2025-02-25 20:56 UTC (permalink / raw)
To: openembedded-core
From: Hongxu Jia <hongxu.jia@windriver.com>
A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1
occurs via a crafted squashfs filesystem with deep symlink nesting.
https://nvd.nist.gov/vuln/detail/CVE-2024-57257
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../u-boot/files/CVE-2024-57257.patch | 227 ++++++++++++++++++
meta/recipes-bsp/u-boot/u-boot-common.inc | 1 +
2 files changed, 228 insertions(+)
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57257.patch
diff --git a/meta/recipes-bsp/u-boot/files/CVE-2024-57257.patch b/meta/recipes-bsp/u-boot/files/CVE-2024-57257.patch
new file mode 100644
index 0000000000..bfffcafa43
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/CVE-2024-57257.patch
@@ -0,0 +1,227 @@
+From 4eb527c473068953f90ea65b33046a25140e0a89 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Fri, 2 Aug 2024 18:36:47 +0200
+Subject: [PATCH 4/8] squashfs: Fix stack overflow while symlink resolving
+
+The squashfs driver blindly follows symlinks, and calls sqfs_size()
+recursively. So an attacker can create a crafted filesystem and with
+a deep enough nesting level a stack overflow can be achieved.
+
+Fix by limiting the nesting level to 8.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+
+CVE: CVE-2024-57257
+Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/4f5cc096bfd0a591f8a11e86999e3d90a9484c34]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ fs/squashfs/sqfs.c | 76 +++++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 61 insertions(+), 15 deletions(-)
+
+diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
+index 16a07c06..a5b7890e 100644
+--- a/fs/squashfs/sqfs.c
++++ b/fs/squashfs/sqfs.c
+@@ -24,7 +24,12 @@
+ #include "sqfs_filesystem.h"
+ #include "sqfs_utils.h"
+
++#define MAX_SYMLINK_NEST 8
++
+ static struct squashfs_ctxt ctxt;
++static int symlinknest;
++
++static int sqfs_readdir_nest(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp);
+
+ static int sqfs_disk_read(__u32 block, __u32 nr_blocks, void *buf)
+ {
+@@ -508,7 +513,7 @@ static int sqfs_search_dir(struct squashfs_dir_stream *dirs, char **token_list,
+ goto out;
+ }
+
+- while (!sqfs_readdir(dirsp, &dent)) {
++ while (!sqfs_readdir_nest(dirsp, &dent)) {
+ ret = strcmp(dent->name, token_list[j]);
+ if (!ret)
+ break;
+@@ -533,6 +538,11 @@ static int sqfs_search_dir(struct squashfs_dir_stream *dirs, char **token_list,
+
+ /* Check for symbolic link and inode type sanity */
+ if (get_unaligned_le16(&dir->inode_type) == SQFS_SYMLINK_TYPE) {
++ if (++symlinknest == MAX_SYMLINK_NEST) {
++ ret = -ELOOP;
++ goto out;
++ }
++
+ sym = (struct squashfs_symlink_inode *)table;
+ /* Get first j + 1 tokens */
+ path = sqfs_concat_tokens(token_list, j + 1);
+@@ -880,7 +890,7 @@ out:
+ return metablks_count;
+ }
+
+-int sqfs_opendir(const char *filename, struct fs_dir_stream **dirsp)
++static int sqfs_opendir_nest(const char *filename, struct fs_dir_stream **dirsp)
+ {
+ unsigned char *inode_table = NULL, *dir_table = NULL;
+ int j, token_count = 0, ret = 0, metablks_count;
+@@ -975,7 +985,19 @@ out:
+ return ret;
+ }
+
++int sqfs_opendir(const char *filename, struct fs_dir_stream **dirsp)
++{
++ symlinknest = 0;
++ return sqfs_opendir_nest(filename, dirsp);
++}
++
+ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp)
++{
++ symlinknest = 0;
++ return sqfs_readdir_nest(fs_dirs, dentp);
++}
++
++static int sqfs_readdir_nest(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp)
+ {
+ struct squashfs_super_block *sblk = ctxt.sblk;
+ struct squashfs_dir_stream *dirs;
+@@ -1319,8 +1341,8 @@ static int sqfs_get_lregfile_info(struct squashfs_lreg_inode *lreg,
+ return datablk_count;
+ }
+
+-int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len,
+- loff_t *actread)
++static int sqfs_read_nest(const char *filename, void *buf, loff_t offset,
++ loff_t len, loff_t *actread)
+ {
+ char *dir = NULL, *fragment_block, *datablock = NULL;
+ char *fragment = NULL, *file = NULL, *resolved, *data;
+@@ -1350,11 +1372,11 @@ int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len,
+ }
+
+ /*
+- * sqfs_opendir will uncompress inode and directory tables, and will
++ * sqfs_opendir_nest will uncompress inode and directory tables, and will
+ * return a pointer to the directory that contains the requested file.
+ */
+ sqfs_split_path(&file, &dir, filename);
+- ret = sqfs_opendir(dir, &dirsp);
++ ret = sqfs_opendir_nest(dir, &dirsp);
+ if (ret) {
+ goto out;
+ }
+@@ -1362,7 +1384,7 @@ int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len,
+ dirs = (struct squashfs_dir_stream *)dirsp;
+
+ /* For now, only regular files are able to be loaded */
+- while (!sqfs_readdir(dirsp, &dent)) {
++ while (!sqfs_readdir_nest(dirsp, &dent)) {
+ ret = strcmp(dent->name, file);
+ if (!ret)
+ break;
+@@ -1411,9 +1433,14 @@ int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len,
+ break;
+ case SQFS_SYMLINK_TYPE:
+ case SQFS_LSYMLINK_TYPE:
++ if (++symlinknest == MAX_SYMLINK_NEST) {
++ ret = -ELOOP;
++ goto out;
++ }
++
+ symlink = (struct squashfs_symlink_inode *)ipos;
+ resolved = sqfs_resolve_symlink(symlink, filename);
+- ret = sqfs_read(resolved, buf, offset, len, actread);
++ ret = sqfs_read_nest(resolved, buf, offset, len, actread);
+ free(resolved);
+ goto out;
+ case SQFS_BLKDEV_TYPE:
+@@ -1584,7 +1611,14 @@ out:
+ return ret;
+ }
+
+-int sqfs_size(const char *filename, loff_t *size)
++int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len,
++ loff_t *actread)
++{
++ symlinknest = 0;
++ return sqfs_read_nest(filename, buf, offset, len, actread);
++}
++
++static int sqfs_size_nest(const char *filename, loff_t *size)
+ {
+ struct squashfs_super_block *sblk = ctxt.sblk;
+ struct squashfs_symlink_inode *symlink;
+@@ -1600,10 +1634,10 @@ int sqfs_size(const char *filename, loff_t *size)
+
+ sqfs_split_path(&file, &dir, filename);
+ /*
+- * sqfs_opendir will uncompress inode and directory tables, and will
++ * sqfs_opendir_nest will uncompress inode and directory tables, and will
+ * return a pointer to the directory that contains the requested file.
+ */
+- ret = sqfs_opendir(dir, &dirsp);
++ ret = sqfs_opendir_nest(dir, &dirsp);
+ if (ret) {
+ ret = -EINVAL;
+ goto free_strings;
+@@ -1611,7 +1645,7 @@ int sqfs_size(const char *filename, loff_t *size)
+
+ dirs = (struct squashfs_dir_stream *)dirsp;
+
+- while (!sqfs_readdir(dirsp, &dent)) {
++ while (!sqfs_readdir_nest(dirsp, &dent)) {
+ ret = strcmp(dent->name, file);
+ if (!ret)
+ break;
+@@ -1644,6 +1678,11 @@ int sqfs_size(const char *filename, loff_t *size)
+ break;
+ case SQFS_SYMLINK_TYPE:
+ case SQFS_LSYMLINK_TYPE:
++ if (++symlinknest == MAX_SYMLINK_NEST) {
++ *size = 0;
++ return -ELOOP;
++ }
++
+ symlink = (struct squashfs_symlink_inode *)ipos;
+ resolved = sqfs_resolve_symlink(symlink, filename);
+ ret = sqfs_size(resolved, size);
+@@ -1683,10 +1722,11 @@ int sqfs_exists(const char *filename)
+
+ sqfs_split_path(&file, &dir, filename);
+ /*
+- * sqfs_opendir will uncompress inode and directory tables, and will
++ * sqfs_opendir_nest will uncompress inode and directory tables, and will
+ * return a pointer to the directory that contains the requested file.
+ */
+- ret = sqfs_opendir(dir, &dirsp);
++ symlinknest = 0;
++ ret = sqfs_opendir_nest(dir, &dirsp);
+ if (ret) {
+ ret = -EINVAL;
+ goto free_strings;
+@@ -1694,7 +1734,7 @@ int sqfs_exists(const char *filename)
+
+ dirs = (struct squashfs_dir_stream *)dirsp;
+
+- while (!sqfs_readdir(dirsp, &dent)) {
++ while (!sqfs_readdir_nest(dirsp, &dent)) {
+ ret = strcmp(dent->name, file);
+ if (!ret)
+ break;
+@@ -1711,6 +1751,12 @@ free_strings:
+ return ret == 0;
+ }
+
++int sqfs_size(const char *filename, loff_t *size)
++{
++ symlinknest = 0;
++ return sqfs_size_nest(filename, size);
++}
++
+ void sqfs_close(void)
+ {
+ sqfs_decompressor_cleanup(&ctxt);
+--
+2.34.1
+
diff --git a/meta/recipes-bsp/u-boot/u-boot-common.inc b/meta/recipes-bsp/u-boot/u-boot-common.inc
index 097ef685e9..ec3b4d8fdf 100644
--- a/meta/recipes-bsp/u-boot/u-boot-common.inc
+++ b/meta/recipes-bsp/u-boot/u-boot-common.inc
@@ -18,6 +18,7 @@ SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master \
file://CVE-2024-57254.patch \
file://CVE-2024-57255.patch \
file://CVE-2024-57256.patch \
+ file://CVE-2024-57257.patch \
"
S = "${WORKDIR}/git"
--
2.43.0
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 05/10] u-boot: fix CVE-2024-57258
2025-02-25 20:56 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
` (3 preceding siblings ...)
2025-02-25 20:56 ` [OE-core][scarthgap 04/10] u-boot: fix CVE-2024-57257 Steve Sakoman
@ 2025-02-25 20:56 ` Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 06/10] u-boot: fix CVE-2024-57259 Steve Sakoman
` (4 subsequent siblings)
9 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2025-02-25 20:56 UTC (permalink / raw)
To: openembedded-core
From: Hongxu Jia <hongxu.jia@windriver.com>
Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1
occur for a crafted squashfs filesystem via sbrk, via request2size,
or because ptrdiff_t is mishandled on x86_64.
https://nvd.nist.gov/vuln/detail/CVE-2024-57258
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../u-boot/files/CVE-2024-57258-1.patch | 47 +++++++++++++++++++
.../u-boot/files/CVE-2024-57258-2.patch | 43 +++++++++++++++++
.../u-boot/files/CVE-2024-57258-3.patch | 40 ++++++++++++++++
meta/recipes-bsp/u-boot/u-boot-common.inc | 3 ++
4 files changed, 133 insertions(+)
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57258-1.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57258-2.patch
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57258-3.patch
diff --git a/meta/recipes-bsp/u-boot/files/CVE-2024-57258-1.patch b/meta/recipes-bsp/u-boot/files/CVE-2024-57258-1.patch
new file mode 100644
index 0000000000..d33a4260ba
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/CVE-2024-57258-1.patch
@@ -0,0 +1,47 @@
+From 50ab41c3628dedeca1a331dd86dd203b73faea74 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Fri, 2 Aug 2024 12:08:45 +0200
+Subject: [PATCH 5/8] dlmalloc: Fix integer overflow in sbrk()
+
+Make sure that the new break is within mem_malloc_start
+and mem_malloc_end before making progress.
+ulong new = old + increment; can overflow for extremely large
+increment values and memset() can get wrongly called.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Reviewed-by: Simon Glass <sjg@chromium.org>
+
+CVE: CVE-2024-57258
+Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/0a10b49206a29b4aa2f80233a3e53ca0466bb0b3]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ common/dlmalloc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/common/dlmalloc.c b/common/dlmalloc.c
+index de3f0422..bae2a27c 100644
+--- a/common/dlmalloc.c
++++ b/common/dlmalloc.c
+@@ -591,6 +591,9 @@ void *sbrk(ptrdiff_t increment)
+ ulong old = mem_malloc_brk;
+ ulong new = old + increment;
+
++ if ((new < mem_malloc_start) || (new > mem_malloc_end))
++ return (void *)MORECORE_FAILURE;
++
+ /*
+ * if we are giving memory back make sure we clear it out since
+ * we set MORECORE_CLEARS to 1
+@@ -598,9 +601,6 @@ void *sbrk(ptrdiff_t increment)
+ if (increment < 0)
+ memset((void *)new, 0, -increment);
+
+- if ((new < mem_malloc_start) || (new > mem_malloc_end))
+- return (void *)MORECORE_FAILURE;
+-
+ mem_malloc_brk = new;
+
+ return (void *)old;
+--
+2.34.1
+
diff --git a/meta/recipes-bsp/u-boot/files/CVE-2024-57258-2.patch b/meta/recipes-bsp/u-boot/files/CVE-2024-57258-2.patch
new file mode 100644
index 0000000000..688e2c64d8
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/CVE-2024-57258-2.patch
@@ -0,0 +1,43 @@
+From db7c626204f488a802a2e58b7a788b11fde6be7d Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Fri, 2 Aug 2024 12:08:44 +0200
+Subject: [PATCH 6/8] dlmalloc: Fix integer overflow in request2size()
+
+req is of type size_t, casting it to long opens the door
+for an integer overflow.
+Values between LONG_MAX - (SIZE_SZ + MALLOC_ALIGN_MASK) - 1 and LONG_MAX
+cause and overflow such that request2size() returns MINSIZE.
+
+Fix by removing the cast.
+The origin of the cast is unclear, it's in u-boot and ppcboot since ever
+and predates the CVS history.
+Doug Lea's original dlmalloc implementation also doesn't have it.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Reviewed-by: Simon Glass <sjg@chromium.org>
+
+CVE: CVE-2024-57258
+Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/8642b2178d2c4002c99a0b69a845a48f2ae2706f]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ common/dlmalloc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/common/dlmalloc.c b/common/dlmalloc.c
+index bae2a27c..1ac4ee9f 100644
+--- a/common/dlmalloc.c
++++ b/common/dlmalloc.c
+@@ -379,8 +379,8 @@ nextchunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ /* pad request bytes into a usable size */
+
+ #define request2size(req) \
+- (((long)((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) < \
+- (long)(MINSIZE + MALLOC_ALIGN_MASK)) ? MINSIZE : \
++ ((((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) < \
++ (MINSIZE + MALLOC_ALIGN_MASK)) ? MINSIZE : \
+ (((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) & ~(MALLOC_ALIGN_MASK)))
+
+ /* Check if m has acceptable alignment */
+--
+2.34.1
+
diff --git a/meta/recipes-bsp/u-boot/files/CVE-2024-57258-3.patch b/meta/recipes-bsp/u-boot/files/CVE-2024-57258-3.patch
new file mode 100644
index 0000000000..2c8a7c9d91
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/CVE-2024-57258-3.patch
@@ -0,0 +1,40 @@
+From 37095a204127b60b5e00c4c5d435d6e48a6a1c51 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Fri, 2 Aug 2024 12:08:43 +0200
+Subject: [PATCH 7/8] x86: Fix ptrdiff_t for x86_64
+
+sbrk() assumes ptrdiff_t is large enough to enlarge/shrink the heap
+by LONG_MIN/LONG_MAX.
+So, use the long type, also to match the rest of the Linux ecosystem.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Reviewed-by: Simon Glass <sjg@chromium.org>
+
+CVE: CVE-2024-57258
+Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/c17b2a05dd50a3ba437e6373093a0d6a359cdee0]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ arch/x86/include/asm/posix_types.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/include/asm/posix_types.h b/arch/x86/include/asm/posix_types.h
+index dbcea7f4..e1ed9bca 100644
+--- a/arch/x86/include/asm/posix_types.h
++++ b/arch/x86/include/asm/posix_types.h
+@@ -20,11 +20,12 @@ typedef unsigned short __kernel_gid_t;
+ #if defined(__x86_64__)
+ typedef unsigned long __kernel_size_t;
+ typedef long __kernel_ssize_t;
++typedef long __kernel_ptrdiff_t;
+ #else
+ typedef unsigned int __kernel_size_t;
+ typedef int __kernel_ssize_t;
+-#endif
+ typedef int __kernel_ptrdiff_t;
++#endif
+ typedef long __kernel_time_t;
+ typedef long __kernel_suseconds_t;
+ typedef long __kernel_clock_t;
+--
+2.34.1
+
diff --git a/meta/recipes-bsp/u-boot/u-boot-common.inc b/meta/recipes-bsp/u-boot/u-boot-common.inc
index ec3b4d8fdf..d3af17f82b 100644
--- a/meta/recipes-bsp/u-boot/u-boot-common.inc
+++ b/meta/recipes-bsp/u-boot/u-boot-common.inc
@@ -19,6 +19,9 @@ SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master \
file://CVE-2024-57255.patch \
file://CVE-2024-57256.patch \
file://CVE-2024-57257.patch \
+ file://CVE-2024-57258-1.patch \
+ file://CVE-2024-57258-2.patch \
+ file://CVE-2024-57258-3.patch \
"
S = "${WORKDIR}/git"
--
2.43.0
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 06/10] u-boot: fix CVE-2024-57259
2025-02-25 20:56 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
` (4 preceding siblings ...)
2025-02-25 20:56 ` [OE-core][scarthgap 05/10] u-boot: fix CVE-2024-57258 Steve Sakoman
@ 2025-02-25 20:56 ` Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 07/10] libcap: fix CVE-2025-1390 Steve Sakoman
` (3 subsequent siblings)
9 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2025-02-25 20:56 UTC (permalink / raw)
To: openembedded-core
From: Hongxu Jia <hongxu.jia@windriver.com>
sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error
and resultant heap memory corruption for squashfs directory listing because the
path separator is not considered in a size calculation.
https://nvd.nist.gov/vuln/detail/CVE-2024-57259
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../u-boot/files/CVE-2024-57259.patch | 41 +++++++++++++++++++
meta/recipes-bsp/u-boot/u-boot-common.inc | 1 +
2 files changed, 42 insertions(+)
create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2024-57259.patch
diff --git a/meta/recipes-bsp/u-boot/files/CVE-2024-57259.patch b/meta/recipes-bsp/u-boot/files/CVE-2024-57259.patch
new file mode 100644
index 0000000000..fdf5fdfce4
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/CVE-2024-57259.patch
@@ -0,0 +1,41 @@
+From 2c08fe306c6cbc60ec4beb434c71e56bb7abb678 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Fri, 2 Aug 2024 22:05:09 +0200
+Subject: [PATCH 8/8] squashfs: Fix heap corruption in sqfs_search_dir()
+
+res needs to be large enough to store both strings rem and target,
+plus the path separator and the terminator.
+Currently the space for the path separator is not accounted, so
+the heap is corrupted by one byte.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+
+CVE: CVE-2024-57259
+Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/048d795bb5b3d9c5701b4855f5e74bcf6849bf5e]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ fs/squashfs/sqfs.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
+index a5b7890e..1bd9b2a4 100644
+--- a/fs/squashfs/sqfs.c
++++ b/fs/squashfs/sqfs.c
+@@ -563,8 +563,11 @@ static int sqfs_search_dir(struct squashfs_dir_stream *dirs, char **token_list,
+ ret = -ENOMEM;
+ goto out;
+ }
+- /* Concatenate remaining tokens and symlink's target */
+- res = malloc(strlen(rem) + strlen(target) + 1);
++ /*
++ * Concatenate remaining tokens and symlink's target.
++ * Allocate enough space for rem, target, '/' and '\0'.
++ */
++ res = malloc(strlen(rem) + strlen(target) + 2);
+ if (!res) {
+ ret = -ENOMEM;
+ goto out;
+--
+2.34.1
+
diff --git a/meta/recipes-bsp/u-boot/u-boot-common.inc b/meta/recipes-bsp/u-boot/u-boot-common.inc
index d3af17f82b..3a48b63c42 100644
--- a/meta/recipes-bsp/u-boot/u-boot-common.inc
+++ b/meta/recipes-bsp/u-boot/u-boot-common.inc
@@ -22,6 +22,7 @@ SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master \
file://CVE-2024-57258-1.patch \
file://CVE-2024-57258-2.patch \
file://CVE-2024-57258-3.patch \
+ file://CVE-2024-57259.patch \
"
S = "${WORKDIR}/git"
--
2.43.0
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 07/10] libcap: fix CVE-2025-1390
2025-02-25 20:56 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
` (5 preceding siblings ...)
2025-02-25 20:56 ` [OE-core][scarthgap 06/10] u-boot: fix CVE-2024-57259 Steve Sakoman
@ 2025-02-25 20:56 ` Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 08/10] libxml2: upgrade 2.12.9 -> 2.12.10 Steve Sakoman
` (2 subsequent siblings)
9 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2025-02-25 20:56 UTC (permalink / raw)
To: openembedded-core
From: Hitendra Prajapati <hprajapati@mvista.com>
Upstream-Status: Backport from https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=1ad42b66c3567481cc5fa22fc1ba1556a316d878
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libcap/files/CVE-2025-1390.patch | 36 +++++++++++++++++++
meta/recipes-support/libcap/libcap_2.69.bb | 1 +
2 files changed, 37 insertions(+)
create mode 100644 meta/recipes-support/libcap/files/CVE-2025-1390.patch
diff --git a/meta/recipes-support/libcap/files/CVE-2025-1390.patch b/meta/recipes-support/libcap/files/CVE-2025-1390.patch
new file mode 100644
index 0000000000..a0f7dda503
--- /dev/null
+++ b/meta/recipes-support/libcap/files/CVE-2025-1390.patch
@@ -0,0 +1,36 @@
+From 1ad42b66c3567481cc5fa22fc1ba1556a316d878 Mon Sep 17 00:00:00 2001
+From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+Date: Mon, 17 Feb 2025 10:31:55 +0800
+Subject: pam_cap: Fix potential configuration parsing error
+
+The current configuration parsing does not actually skip user names
+that do not start with @, but instead treats the name as a group
+name for further parsing, which can result in matching unexpected
+capability sets and may trigger potential security issues. Only
+names starting with @ should be parsed as group names.
+
+Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
+
+Upstream-Status: Backport [https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=1ad42b66c3567481cc5fa22fc1ba1556a316d878]
+CVE: CVE-2025-1390
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ pam_cap/pam_cap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/pam_cap/pam_cap.c b/pam_cap/pam_cap.c
+index b9419cb..18647a1 100644
+--- a/pam_cap/pam_cap.c
++++ b/pam_cap/pam_cap.c
+@@ -166,6 +166,7 @@ static char *read_capabilities_for_user(const char *user, const char *source)
+
+ if (line[0] != '@') {
+ D(("user [%s] is not [%s] - skipping", user, line));
++ continue;
+ }
+
+ int i;
+--
+2.25.1
+
diff --git a/meta/recipes-support/libcap/libcap_2.69.bb b/meta/recipes-support/libcap/libcap_2.69.bb
index 92fa766d37..03975b44a0 100644
--- a/meta/recipes-support/libcap/libcap_2.69.bb
+++ b/meta/recipes-support/libcap/libcap_2.69.bb
@@ -15,6 +15,7 @@ DEPENDS = "hostperl-runtime-native gperf-native"
SRC_URI = "${KERNELORG_MIRROR}/linux/libs/security/linux-privs/${BPN}2/${BPN}-${PV}.tar.xz \
file://0001-ensure-the-XATTR_NAME_CAPS-is-defined-when-it-is-use.patch \
file://0002-tests-do-not-run-target-executables.patch \
+ file://CVE-2025-1390.patch \
"
SRC_URI:append:class-nativesdk = " \
file://0001-nativesdk-libcap-Raise-the-size-of-arrays-containing.patch \
--
2.43.0
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 08/10] libxml2: upgrade 2.12.9 -> 2.12.10
2025-02-25 20:56 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
` (6 preceding siblings ...)
2025-02-25 20:56 ` [OE-core][scarthgap 07/10] libcap: fix CVE-2025-1390 Steve Sakoman
@ 2025-02-25 20:56 ` Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 09/10] bind: Upgrade 9.18.28 -> 9.18.33 Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 10/10] python3-setuptools-scm: respect GIT_CEILING_DIRECTORIES Steve Sakoman
9 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2025-02-25 20:56 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.10
Security
* [CVE-2025-24928] Fix stack-buffer-overflow in xmlSnprintfElements
* [CVE-2024-56171] Fix use-after-free after xmlSchemaItemListAdd
* pattern: Fix compilation of explicit child axis
Regressions
* parser: Fix detection of duplicate attributes
Bug fixes
* xpath: Fix parsing of non-ASCII names
Portability
* python: Declare init func with PyMODINIT_FUNC
* tests: Fix sanitizer version check on old Apple clang
Build
* autotools: Set AC_CONFIG_AUX_DIR
* cmake: Always build Python module as shared library
* cmake: Fix compatibility in package version file
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libxml/{libxml2_2.12.9.bb => libxml2_2.12.10.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-core/libxml/{libxml2_2.12.9.bb => libxml2_2.12.10.bb} (97%)
diff --git a/meta/recipes-core/libxml/libxml2_2.12.9.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb
similarity index 97%
rename from meta/recipes-core/libxml/libxml2_2.12.9.bb
rename to meta/recipes-core/libxml/libxml2_2.12.10.bb
index 7777c9f181..c4f76c281d 100644
--- a/meta/recipes-core/libxml/libxml2_2.12.9.bb
+++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb
@@ -20,7 +20,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
file://install-tests.patch \
"
-SRC_URI[archive.sha256sum] = "59912db536ab56a3996489ea0299768c7bcffe57169f0235e7f962a91f483590"
+SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995"
SRC_URI[testtar.sha256sum] = "c6b2d42ee50b8b236e711a97d68e6c4b5c8d83e69a2be4722379f08702ea7273"
# Disputed as a security issue, but fixed in d39f780
--
2.43.0
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 09/10] bind: Upgrade 9.18.28 -> 9.18.33
2025-02-25 20:56 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
` (7 preceding siblings ...)
2025-02-25 20:56 ` [OE-core][scarthgap 08/10] libxml2: upgrade 2.12.9 -> 2.12.10 Steve Sakoman
@ 2025-02-25 20:56 ` Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 10/10] python3-setuptools-scm: respect GIT_CEILING_DIRECTORIES Steve Sakoman
9 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2025-02-25 20:56 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Includes security fixes for CVE-2024-12705 CVE-2024-11187 and other bug
fixes
Release Notes:
https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-33
https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-32
https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-31
https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-30
https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-29
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../bind/{bind_9.18.28.bb => bind_9.18.33.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-connectivity/bind/{bind_9.18.28.bb => bind_9.18.33.bb} (97%)
diff --git a/meta/recipes-connectivity/bind/bind_9.18.28.bb b/meta/recipes-connectivity/bind/bind_9.18.33.bb
similarity index 97%
rename from meta/recipes-connectivity/bind/bind_9.18.28.bb
rename to meta/recipes-connectivity/bind/bind_9.18.33.bb
index 4b0948298e..2554a7bb5f 100644
--- a/meta/recipes-connectivity/bind/bind_9.18.28.bb
+++ b/meta/recipes-connectivity/bind/bind_9.18.33.bb
@@ -20,7 +20,7 @@ SRC_URI = "https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.xz \
file://0001-avoid-start-failure-with-bind-user.patch \
"
-SRC_URI[sha256sum] = "e7cce9a165f7b619eefc4832f0a8dc16b005d29e3890aed6008c506ea286a5e7"
+SRC_URI[sha256sum] = "fb373fac5ebbc41c645160afd5a9fb451918f6c0e69ab1d9474154e2b515de40"
UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/"
# follow the ESV versions divisible by 2
--
2.43.0
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 10/10] python3-setuptools-scm: respect GIT_CEILING_DIRECTORIES
2025-02-25 20:56 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
` (8 preceding siblings ...)
2025-02-25 20:56 ` [OE-core][scarthgap 09/10] bind: Upgrade 9.18.28 -> 9.18.33 Steve Sakoman
@ 2025-02-25 20:56 ` Steve Sakoman
9 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2025-02-25 20:56 UTC (permalink / raw)
To: openembedded-core
From: Etienne Cordonnier <ecordonnier@snap.com>
Fixes https://bugzilla.yoctoproject.org/show_bug.cgi?id=15740
python3-setuptools-scm was ignoring GIT_CEILING_DIRECTORIES which is set by poky,
and it was thus finding a wrong value of "toplevel" in ./src/setuptools_scm/_file_finders/git.py
The code is supposed to generate the list of files contained in python3-setuptools-scm, but it was
instead running "git archive" on whatever git repository was above the build directory, because the
tarball containing the sources of python3-setuptools-scm does not contain a .git directory.
This is barely noticeable when building as a subdirectory of poky which is only 48MB, but this was
causing serious slowdowns of python3-setuptools-scm:do_compile when building
inside a big git repository with files tracked using git-lfs (50 minutes in my use-case).
Reported upstream as https://github.com/pypa/setuptools-scm/issues/1103
(From OE-Core rev: 4ebe72477484cf68165b6f736ce10373e97d0e6d)
Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...0001-respect-GIT_CEILING_DIRECTORIES.patch | 36 +++++++++++++++++++
.../python/python3-setuptools-scm_8.0.4.bb | 1 +
2 files changed, 37 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3-setuptools-scm/0001-respect-GIT_CEILING_DIRECTORIES.patch
diff --git a/meta/recipes-devtools/python/python3-setuptools-scm/0001-respect-GIT_CEILING_DIRECTORIES.patch b/meta/recipes-devtools/python/python3-setuptools-scm/0001-respect-GIT_CEILING_DIRECTORIES.patch
new file mode 100644
index 0000000000..7d2808cc0c
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-setuptools-scm/0001-respect-GIT_CEILING_DIRECTORIES.patch
@@ -0,0 +1,36 @@
+From a1cc419a118560d63e1ab8838c256a3622185750 Mon Sep 17 00:00:00 2001
+From: Etienne Cordonnier <ecordonnier@snap.com>
+Date: Thu, 13 Feb 2025 15:44:40 +0100
+Subject: [PATCH] respect GIT_CEILING_DIRECTORIES
+
+Fix for https://github.com/pypa/setuptools-scm/issues/1103
+
+When searching for the root-directory of the git repository e.g. with git rev-parse --show-toplevel,
+git stops the search when reaching $GIT_CEILING_DIRECTORIES. By ignoring this variable, the function
+_git_toplevel can go above the real git repository (e.g. when packaging a tarball without .git repository),
+and then runs "git archive" on an unrelated git repository.
+
+Upstream-Status: Pending
+
+Signed-off-by: Ross Burton <ross.burton@arm.com>
+Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
+---
+ src/setuptools_scm/_run_cmd.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/setuptools_scm/_run_cmd.py b/src/setuptools_scm/_run_cmd.py
+index f2a8285..7e13d9f 100644
+--- a/src/setuptools_scm/_run_cmd.py
++++ b/src/setuptools_scm/_run_cmd.py
+@@ -98,7 +98,7 @@ def no_git_env(env: Mapping[str, str]) -> dict[str, str]:
+ k: v
+ for k, v in env.items()
+ if not k.startswith("GIT_")
+- or k in ("GIT_EXEC_PATH", "GIT_SSH", "GIT_SSH_COMMAND")
++ or k in ("GIT_CEILING_DIRECTORIES", "GIT_EXEC_PATH", "GIT_SSH", "GIT_SSH_COMMAND")
+ }
+
+
+--
+2.43.0
+
diff --git a/meta/recipes-devtools/python/python3-setuptools-scm_8.0.4.bb b/meta/recipes-devtools/python/python3-setuptools-scm_8.0.4.bb
index 64b5050c3b..d5f8358a61 100644
--- a/meta/recipes-devtools/python/python3-setuptools-scm_8.0.4.bb
+++ b/meta/recipes-devtools/python/python3-setuptools-scm_8.0.4.bb
@@ -6,6 +6,7 @@ argument or in a SCM managed file."
LICENSE = "MIT"
LIC_FILES_CHKSUM = "file://LICENSE;md5=838c366f69b72c5df05c96dff79b35f2"
+SRC_URI += "file://0001-respect-GIT_CEILING_DIRECTORIES.patch"
SRC_URI[sha256sum] = "b5f43ff6800669595193fd09891564ee9d1d7dcb196cab4b2506d53a2e1c95c7"
inherit pypi python_setuptools_build_meta
--
2.43.0
^ permalink raw reply related [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 00/10] Patch review
@ 2025-03-27 19:44 Steve Sakoman
0 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2025-03-27 19:44 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Monday, March 31
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1283
The following changes since commit a720df7ad77af1f8b1c00a211c88537e5f23edbc:
nativesdk-libtool: sanitize the script, remove buildpaths (2025-03-20 12:51:41 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Bruce Ashfield (6):
linux-yocto/6.6: update to v6.6.77
linux-yocto/6.6: update to v6.6.78
linux-yocto/6.6: update to v6.6.80
linux-yocto/6.6: update to v6.6.82
linux-yocto/6.6: update to v6.6.83
linux-yocto/6.6: update to v6.6.84
Divya Chellam (1):
ruby: fix CVE-2025-27220
Madhu Marri (1):
qemu 8.2.7: ignore CVE-2023-1386
Stefan Mueller-Klieser (1):
kernel-arch: add macro-prefix-map in KERNEL_CC
Vijay Anusuri (1):
vim: Upgrade 9.1.1115 -> 9.1.1198
meta/classes-recipe/kernel-arch.bbclass | 8 +-
meta/recipes-devtools/qemu/qemu.inc | 2 +
.../ruby/ruby/CVE-2025-27220.patch | 78 +++++++++++++++++++
meta/recipes-devtools/ruby/ruby_3.3.5.bb | 1 +
.../linux/linux-yocto-rt_6.6.bb | 6 +-
.../linux/linux-yocto-tiny_6.6.bb | 6 +-
meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++----
meta/recipes-support/vim/vim.inc | 4 +-
8 files changed, 110 insertions(+), 23 deletions(-)
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2025-27220.patch
--
2.43.0
^ permalink raw reply [flat|nested] 19+ messages in thread
* [OE-core][scarthgap 00/10] Patch review
@ 2025-08-19 20:07 Steve Sakoman
0 siblings, 0 replies; 19+ messages in thread
From: Steve Sakoman @ 2025-08-19 20:07 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Thursday, August 21
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/2234
The following changes since commit fa45d6d5bec8fe503ff6b9166a3b4af31ea95369:
go-helloworld: fix license (2025-08-14 07:34:07 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Daniel Turull (2):
xz: ignore CVE-2024-47611
libxml2: ignore CVE-2025-8732
Khem Raj (3):
e2fsprogs: Fix build failure with gcc 15
parted: Fix build with GCC 15
bash: Stick to C17 std
Martin Jansa (2):
cairo: fix build with gcc-15 on host
bash: use -std=gnu17 also for native CFLAGS
Peter Marko (2):
dropbear: patch CVE-2025-47203
glib-2.0: ignore CVE-2025-4056
Philip Lorenz (1):
cve-check: Add missing call to exit_if_errors
meta/classes/cve-check.bbclass | 1 +
...iable-with-DROPBEAR_CLI_PUBKEY_AUTH-.patch | 27 ++
...-length-paths-and-commands-in-multih.patch | 63 +++
...and-also-forward-this-when-multihop-.patch | 81 ++++
...add-missing-DROPBEAR_CLI_PUBKEY_AUTH.patch | 29 ++
.../dropbear/dropbear/CVE-2025-47203.patch | 367 ++++++++++++++++++
.../recipes-core/dropbear/dropbear_2022.83.bb | 5 +
meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb | 2 +
meta/recipes-core/libxml/libxml2_2.12.10.bb | 4 +
...-libext2fs-fix-std-c23-build-failure.patch | 42 ++
.../e2fsprogs/e2fsprogs_1.47.0.bb | 1 +
meta/recipes-extended/bash/bash_5.2.21.bb | 5 +
...CH-parted-fix-do_version-declaration.patch | 40 ++
meta/recipes-extended/parted/parted_3.6.bb | 1 +
meta/recipes-extended/xz/xz_5.4.7.bb | 2 +
.../cairo/cairo/0001-Require-C11.patch | 25 ++
.../cairo/cairo/0002-Meson-Require-C-11.patch | 22 ++
meta/recipes-graphics/cairo/cairo_1.18.0.bb | 2 +
18 files changed, 719 insertions(+)
create mode 100644 meta/recipes-core/dropbear/dropbear/0001-Avoid-unused-variable-with-DROPBEAR_CLI_PUBKEY_AUTH-.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/0001-Handle-arbitrary-length-paths-and-commands-in-multih.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/0001-add-o-BatchMode-and-also-forward-this-when-multihop-.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/0001-cli-runopts.c-add-missing-DROPBEAR_CLI_PUBKEY_AUTH.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2025-47203.patch
create mode 100644 meta/recipes-devtools/e2fsprogs/e2fsprogs/0001-libext2fs-fix-std-c23-build-failure.patch
create mode 100644 meta/recipes-extended/parted/files/0001-bug-74444-PATCH-parted-fix-do_version-declaration.patch
create mode 100644 meta/recipes-graphics/cairo/cairo/0001-Require-C11.patch
create mode 100644 meta/recipes-graphics/cairo/cairo/0002-Meson-Require-C-11.patch
--
2.43.0
^ permalink raw reply [flat|nested] 19+ messages in thread
end of thread, other threads:[~2025-08-19 20:08 UTC | newest]
Thread overview: 19+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-02-25 20:56 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 01/10] u-boot: fix CVE-2024-57254 Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 02/10] u-boot: fix CVE-2024-57255 Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 03/10] u-boot: fix CVE-2024-57256 Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 04/10] u-boot: fix CVE-2024-57257 Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 05/10] u-boot: fix CVE-2024-57258 Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 06/10] u-boot: fix CVE-2024-57259 Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 07/10] libcap: fix CVE-2025-1390 Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 08/10] libxml2: upgrade 2.12.9 -> 2.12.10 Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 09/10] bind: Upgrade 9.18.28 -> 9.18.33 Steve Sakoman
2025-02-25 20:56 ` [OE-core][scarthgap 10/10] python3-setuptools-scm: respect GIT_CEILING_DIRECTORIES Steve Sakoman
-- strict thread matches above, loose matches on Subject: below --
2025-08-19 20:07 [OE-core][scarthgap 00/10] Patch review Steve Sakoman
2025-03-27 19:44 Steve Sakoman
2024-12-18 22:02 Steve Sakoman
2024-11-07 3:37 Steve Sakoman
2024-10-07 1:54 Steve Sakoman
2024-10-07 3:23 ` Khem Raj
2024-08-08 2:28 Steve Sakoman
2024-06-11 13:07 Steve Sakoman
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.