* [OE-core][scarthgap 0/4] Patch review
@ 2025-02-28 14:42 Steve Sakoman
2025-02-28 14:42 ` [OE-core][scarthgap 1/4] elfutils: Fix multiple CVEs Steve Sakoman
` (3 more replies)
0 siblings, 4 replies; 7+ messages in thread
From: Steve Sakoman @ 2025-02-28 14:42 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Tuesday, March 4
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1099
The following changes since commit 369eebad4f38c3641be73dbc0490c87636e0912d:
python3-setuptools-scm: respect GIT_CEILING_DIRECTORIES (2025-02-25 06:38:02 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Fabio Berton (1):
ccache.conf: Add include_file_ctime to sloppiness
Hitendra Prajapati (1):
elfutils: Fix multiple CVEs
Marek Vasut (1):
u-boot: kernel-fitimage: Restore FIT_SIGN_INDIVIDUAL="1" behavior
Moritz Haase (1):
meta: Enable '-o pipefail' for the SDK installer
meta/classes-recipe/uboot-sign.bbclass | 60 +++++--
meta/conf/ccache.conf | 6 +
meta/files/toolchain-shar-extract.sh | 5 +
.../elfutils/elfutils_0.191.bb | 3 +
.../elfutils/files/CVE-2025-1352.patch | 153 ++++++++++++++++++
.../elfutils/files/CVE-2025-1365.patch | 151 +++++++++++++++++
.../elfutils/files/CVE-2025-1372.patch | 50 ++++++
7 files changed, 419 insertions(+), 9 deletions(-)
create mode 100644 meta/recipes-devtools/elfutils/files/CVE-2025-1352.patch
create mode 100644 meta/recipes-devtools/elfutils/files/CVE-2025-1365.patch
create mode 100644 meta/recipes-devtools/elfutils/files/CVE-2025-1372.patch
--
2.43.0
^ permalink raw reply [flat|nested] 7+ messages in thread* [OE-core][scarthgap 1/4] elfutils: Fix multiple CVEs 2025-02-28 14:42 [OE-core][scarthgap 0/4] Patch review Steve Sakoman @ 2025-02-28 14:42 ` Steve Sakoman 2025-02-28 14:42 ` [OE-core][scarthgap 2/4] u-boot: kernel-fitimage: Restore FIT_SIGN_INDIVIDUAL="1" behavior Steve Sakoman ` (2 subsequent siblings) 3 siblings, 0 replies; 7+ messages in thread From: Steve Sakoman @ 2025-02-28 14:42 UTC (permalink / raw) To: openembedded-core From: Hitendra Prajapati <hprajapati@mvista.com> Backport fixes for: * CVE-2025-1352 - Upstream-Status: Backport from https://sourceware.org/git/?p=elfutils.git;a=commit;h=2636426a091bd6c6f7f02e49ab20d4cdc6bfc753 * CVE-2025-1365 - Upstream-Status: Backport from https://sourceware.org/git/?p=elfutils.git;a=commit;h=5e5c0394d82c53e97750fe7b18023e6f84157b81 * CVE-2025-1372 - Upstream-Status: Backport from https://sourceware.org/git/?p=elfutils.git;a=commit;h=73db9d2021cab9e23fd734b0a76a612d52a6f1db Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- .../elfutils/elfutils_0.191.bb | 3 + .../elfutils/files/CVE-2025-1352.patch | 153 ++++++++++++++++++ .../elfutils/files/CVE-2025-1365.patch | 151 +++++++++++++++++ .../elfutils/files/CVE-2025-1372.patch | 50 ++++++ 4 files changed, 357 insertions(+) create mode 100644 meta/recipes-devtools/elfutils/files/CVE-2025-1352.patch create mode 100644 meta/recipes-devtools/elfutils/files/CVE-2025-1365.patch create mode 100644 meta/recipes-devtools/elfutils/files/CVE-2025-1372.patch diff --git a/meta/recipes-devtools/elfutils/elfutils_0.191.bb b/meta/recipes-devtools/elfutils/elfutils_0.191.bb index c4d872430b..85e024179b 100644 --- a/meta/recipes-devtools/elfutils/elfutils_0.191.bb +++ b/meta/recipes-devtools/elfutils/elfutils_0.191.bb @@ -23,6 +23,9 @@ SRC_URI = "https://sourceware.org/elfutils/ftp/${PV}/${BP}.tar.bz2 \ file://0001-tests-Makefile.am-compile-test_nlist-with-standard-C.patch \ file://0001-debuginfod-Remove-unused-variable.patch \ file://0001-srcfiles-fix-unused-variable-BUFFER_SIZE.patch \ + file://CVE-2025-1352.patch \ + file://CVE-2025-1365.patch \ + file://CVE-2025-1372.patch \ " SRC_URI:append:libc-musl = " \ file://0003-musl-utils.patch \ diff --git a/meta/recipes-devtools/elfutils/files/CVE-2025-1352.patch b/meta/recipes-devtools/elfutils/files/CVE-2025-1352.patch new file mode 100644 index 0000000000..5710905449 --- /dev/null +++ b/meta/recipes-devtools/elfutils/files/CVE-2025-1352.patch @@ -0,0 +1,153 @@ +From 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753 Mon Sep 17 00:00:00 2001 +From: Mark Wielaard <mark@klomp.org> +Date: Sat, 8 Feb 2025 20:00:12 +0100 +Subject: [PATCH] libdw: Simplify __libdw_getabbrev and fix dwarf_offabbrev + issue + +__libdw_getabbrev could crash on reading a bad abbrev by trying to +deallocate memory it didn't allocate itself. This could happen because +dwarf_offabbrev would supply its own memory when calling +__libdw_getabbrev. No other caller did this. + +Simplify the __libdw_getabbrev common code by not taking external +memory to put the abbrev result in (this would also not work correctly +if the abbrev was already cached). And make dwarf_offabbrev explicitly +copy the result (if there was no error or end of abbrev). + + * libdw/dwarf_getabbrev.c (__libdw_getabbrev): Don't take + Dwarf_Abbrev result argument. Always just allocate abb when + abbrev not found in cache. + (dwarf_getabbrev): Don't pass NULL as last argument to + __libdw_getabbrev. + * libdw/dwarf_tag.c (__libdw_findabbrev): Likewise. + * libdw/dwarf_offabbrev.c (dwarf_offabbrev): Likewise. And copy + abbrev into abbrevp on success. + * libdw/libdw.h (dwarf_offabbrev): Document return values. + * libdw/libdwP.h (__libdw_getabbrev): Don't take Dwarf_Abbrev + result argument. + +https://sourceware.org/bugzilla/show_bug.cgi?id=32650 + +Signed-off-by: Mark Wielaard <mark@klomp.org> + +Upstream-Status: Backport [https://sourceware.org/git/?p=elfutils.git;a=commit;h=2636426a091bd6c6f7f02e49ab20d4cdc6bfc753] +CVE: CVE-2025-1352 +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + libdw/dwarf_getabbrev.c | 12 ++++-------- + libdw/dwarf_offabbrev.c | 10 +++++++--- + libdw/dwarf_tag.c | 3 +-- + libdw/libdw.h | 4 +++- + libdw/libdwP.h | 3 +-- + 5 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/libdw/dwarf_getabbrev.c b/libdw/dwarf_getabbrev.c +index 5b02333..d9a6c02 100644 +--- a/libdw/dwarf_getabbrev.c ++++ b/libdw/dwarf_getabbrev.c +@@ -1,5 +1,6 @@ + /* Get abbreviation at given offset. + Copyright (C) 2003, 2004, 2005, 2006, 2014, 2017 Red Hat, Inc. ++ Copyright (C) 2025 Mark J. Wielaard <mark@klomp.org> + This file is part of elfutils. + Written by Ulrich Drepper <drepper@redhat.com>, 2003. + +@@ -38,7 +39,7 @@ + Dwarf_Abbrev * + internal_function + __libdw_getabbrev (Dwarf *dbg, struct Dwarf_CU *cu, Dwarf_Off offset, +- size_t *lengthp, Dwarf_Abbrev *result) ++ size_t *lengthp) + { + /* Don't fail if there is not .debug_abbrev section. */ + if (dbg->sectiondata[IDX_debug_abbrev] == NULL) +@@ -85,12 +86,7 @@ __libdw_getabbrev (Dwarf *dbg, struct Dwarf_CU *cu, Dwarf_Off offset, + Dwarf_Abbrev *abb = NULL; + if (cu == NULL + || (abb = Dwarf_Abbrev_Hash_find (&cu->abbrev_hash, code)) == NULL) +- { +- if (result == NULL) +- abb = libdw_typed_alloc (dbg, Dwarf_Abbrev); +- else +- abb = result; +- } ++ abb = libdw_typed_alloc (dbg, Dwarf_Abbrev); + else + { + foundit = true; +@@ -183,5 +179,5 @@ dwarf_getabbrev (Dwarf_Die *die, Dwarf_Off offset, size_t *lengthp) + return NULL; + } + +- return __libdw_getabbrev (dbg, cu, abbrev_offset + offset, lengthp, NULL); ++ return __libdw_getabbrev (dbg, cu, abbrev_offset + offset, lengthp); + } +diff --git a/libdw/dwarf_offabbrev.c b/libdw/dwarf_offabbrev.c +index 27cdad6..41df69b 100644 +--- a/libdw/dwarf_offabbrev.c ++++ b/libdw/dwarf_offabbrev.c +@@ -41,11 +41,15 @@ dwarf_offabbrev (Dwarf *dbg, Dwarf_Off offset, size_t *lengthp, + if (dbg == NULL) + return -1; + +- Dwarf_Abbrev *abbrev = __libdw_getabbrev (dbg, NULL, offset, lengthp, +- abbrevp); ++ Dwarf_Abbrev *abbrev = __libdw_getabbrev (dbg, NULL, offset, lengthp); + + if (abbrev == NULL) + return -1; + +- return abbrev == DWARF_END_ABBREV ? 1 : 0; ++ if (abbrev == DWARF_END_ABBREV) ++ return 1; ++ ++ *abbrevp = *abbrev; ++ ++ return 0; + } +diff --git a/libdw/dwarf_tag.c b/libdw/dwarf_tag.c +index d784970..218382a 100644 +--- a/libdw/dwarf_tag.c ++++ b/libdw/dwarf_tag.c +@@ -53,8 +53,7 @@ __libdw_findabbrev (struct Dwarf_CU *cu, unsigned int code) + + /* Find the next entry. It gets automatically added to the + hash table. */ +- abb = __libdw_getabbrev (cu->dbg, cu, cu->last_abbrev_offset, &length, +- NULL); ++ abb = __libdw_getabbrev (cu->dbg, cu, cu->last_abbrev_offset, &length); + if (abb == NULL || abb == DWARF_END_ABBREV) + { + /* Make sure we do not try to search for it again. */ +diff --git a/libdw/libdw.h b/libdw/libdw.h +index d53dc78..ec4713a 100644 +--- a/libdw/libdw.h ++++ b/libdw/libdw.h +@@ -587,7 +587,9 @@ extern int dwarf_srclang (Dwarf_Die *die); + extern Dwarf_Abbrev *dwarf_getabbrev (Dwarf_Die *die, Dwarf_Off offset, + size_t *lengthp); + +-/* Get abbreviation at given offset in .debug_abbrev section. */ ++/* Get abbreviation at given offset in .debug_abbrev section. On ++ success return zero and fills in ABBREVP. When there is no (more) ++ abbrev at offset returns one. On error returns a negative value. */ + extern int dwarf_offabbrev (Dwarf *dbg, Dwarf_Off offset, size_t *lengthp, + Dwarf_Abbrev *abbrevp) + __nonnull_attribute__ (4); +diff --git a/libdw/libdwP.h b/libdw/libdwP.h +index 8b2f06f..f0f4b78 100644 +--- a/libdw/libdwP.h ++++ b/libdw/libdwP.h +@@ -783,8 +783,7 @@ extern Dwarf_Abbrev *__libdw_findabbrev (struct Dwarf_CU *cu, + + /* Get abbreviation at given offset. */ + extern Dwarf_Abbrev *__libdw_getabbrev (Dwarf *dbg, struct Dwarf_CU *cu, +- Dwarf_Off offset, size_t *lengthp, +- Dwarf_Abbrev *result) ++ Dwarf_Off offset, size_t *lengthp) + __nonnull_attribute__ (1) internal_function; + + /* Get abbreviation of given DIE, and optionally set *READP to the DIE memory +-- +2.25.1 + diff --git a/meta/recipes-devtools/elfutils/files/CVE-2025-1365.patch b/meta/recipes-devtools/elfutils/files/CVE-2025-1365.patch new file mode 100644 index 0000000000..002ce334a3 --- /dev/null +++ b/meta/recipes-devtools/elfutils/files/CVE-2025-1365.patch @@ -0,0 +1,151 @@ +From 5e5c0394d82c53e97750fe7b18023e6f84157b81 Mon Sep 17 00:00:00 2001 +From: Mark Wielaard <mark@klomp.org> +Date: Sat, 8 Feb 2025 21:44:56 +0100 +Subject: [PATCH] libelf, readelf: Use validate_str also to check dynamic + symstr data + +When dynsym/str was read through eu-readelf --dynamic by readelf +process_symtab the string data was not validated, possibly printing +unallocated memory past the end of the symstr data. Fix this by +turning the elf_strptr validate_str function into a generic +lib/system.h helper function and use it in readelf to validate the +strings before use. + + * libelf/elf_strptr.c (validate_str): Remove to... + * lib/system.h (validate_str): ... here. Make inline, simplify + check and document. + * src/readelf.c (process_symtab): Use validate_str on symstr_data. + +https://sourceware.org/bugzilla/show_bug.cgi?id=32654 + +Signed-off-by: Mark Wielaard <mark@klomp.org> + +Upstream-Status: Backport [https://sourceware.org/git/?p=elfutils.git;a=commit;h=5e5c0394d82c53e97750fe7b18023e6f84157b81] +CVE: CVE-2025-1365 +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + lib/system.h | 27 +++++++++++++++++++++++++++ + libelf/elf_strptr.c | 18 ------------------ + src/readelf.c | 18 +++++++++++++++--- + 3 files changed, 42 insertions(+), 21 deletions(-) + +diff --git a/lib/system.h b/lib/system.h +index 0db12d9..0698e5f 100644 +--- a/lib/system.h ++++ b/lib/system.h +@@ -34,6 +34,7 @@ + #include <config.h> + + #include <errno.h> ++#include <stdbool.h> + #include <stddef.h> + #include <stdint.h> + #include <string.h> +@@ -117,6 +118,32 @@ startswith (const char *str, const char *prefix) + return strncmp (str, prefix, strlen (prefix)) == 0; + } + ++/* Return TRUE if STR[FROM] is a valid string with a zero terminator ++ at or before STR[TO - 1]. Note FROM is an index into the STR ++ array, while TO is the maximum size of the STR array. This ++ function returns FALSE when TO is zero or FROM >= TO. */ ++static inline bool ++validate_str (const char *str, size_t from, size_t to) ++{ ++#if HAVE_DECL_MEMRCHR ++ // Check end first, which is likely a zero terminator, ++ // to prevent function call ++ return (to > 0 ++ && (str[to - 1] == '\0' ++ || (to > from ++ && memrchr (&str[from], '\0', to - from - 1) != NULL))); ++#else ++ do { ++ if (to <= from) ++ return false; ++ ++ to--; ++ } while (str[to]); ++ ++ return true; ++#endif ++} ++ + /* A special gettext function we use if the strings are too short. */ + #define sgettext(Str) \ + ({ const char *__res = strrchr (_(Str), '|'); \ +diff --git a/libelf/elf_strptr.c b/libelf/elf_strptr.c +index 79a24d2..c5a94f8 100644 +--- a/libelf/elf_strptr.c ++++ b/libelf/elf_strptr.c +@@ -53,24 +53,6 @@ get_zdata (Elf_Scn *strscn) + return zdata; + } + +-static bool validate_str (const char *str, size_t from, size_t to) +-{ +-#if HAVE_DECL_MEMRCHR +- // Check end first, which is likely a zero terminator, to prevent function call +- return ((to > 0 && str[to - 1] == '\0') +- || (to - from > 0 && memrchr (&str[from], '\0', to - from - 1) != NULL)); +-#else +- do { +- if (to <= from) +- return false; +- +- to--; +- } while (str[to]); +- +- return true; +-#endif +-} +- + char * + elf_strptr (Elf *elf, size_t idx, size_t offset) + { +diff --git a/src/readelf.c b/src/readelf.c +index 0e93118..63eb548 100644 +--- a/src/readelf.c ++++ b/src/readelf.c +@@ -2639,6 +2639,7 @@ process_symtab (Ebl *ebl, unsigned int nsyms, Elf64_Word idx, + char typebuf[64]; + char bindbuf[64]; + char scnbuf[64]; ++ const char *sym_name; + Elf32_Word xndx; + GElf_Sym sym_mem; + GElf_Sym *sym +@@ -2650,6 +2651,19 @@ process_symtab (Ebl *ebl, unsigned int nsyms, Elf64_Word idx, + /* Determine the real section index. */ + if (likely (sym->st_shndx != SHN_XINDEX)) + xndx = sym->st_shndx; ++ if (use_dynamic_segment == true) ++ { ++ if (validate_str (symstr_data->d_buf, sym->st_name, ++ symstr_data->d_size)) ++ sym_name = (char *)symstr_data->d_buf + sym->st_name; ++ else ++ sym_name = NULL; ++ } ++ else ++ sym_name = elf_strptr (ebl->elf, idx, sym->st_name); ++ ++ if (sym_name == NULL) ++ sym_name = "???"; + + printf (_ ("\ + %5u: %0*" PRIx64 " %6" PRId64 " %-7s %-6s %-9s %6s %s"), +@@ -2662,9 +2676,7 @@ process_symtab (Ebl *ebl, unsigned int nsyms, Elf64_Word idx, + get_visibility_type (GELF_ST_VISIBILITY (sym->st_other)), + ebl_section_name (ebl, sym->st_shndx, xndx, scnbuf, + sizeof (scnbuf), NULL, shnum), +- use_dynamic_segment == true +- ? (char *)symstr_data->d_buf + sym->st_name +- : elf_strptr (ebl->elf, idx, sym->st_name)); ++ sym_name); + + if (versym_data != NULL) + { +-- +2.25.1 + diff --git a/meta/recipes-devtools/elfutils/files/CVE-2025-1372.patch b/meta/recipes-devtools/elfutils/files/CVE-2025-1372.patch new file mode 100644 index 0000000000..812a098447 --- /dev/null +++ b/meta/recipes-devtools/elfutils/files/CVE-2025-1372.patch @@ -0,0 +1,50 @@ +From 73db9d2021cab9e23fd734b0a76a612d52a6f1db Mon Sep 17 00:00:00 2001 +From: Mark Wielaard <mark@klomp.org> +Date: Sun, 9 Feb 2025 00:07:39 +0100 +Subject: [PATCH] readelf: Skip trying to uncompress sections without a name + +When combining eu-readelf -z with -x or -p to dump the data or strings +in an (corrupted ELF) unnamed numbered section eu-readelf could crash +trying to check whether the section name starts with .zdebug. Fix this +by skipping sections without a name. + + * src/readelf.c (dump_data_section): Don't try to gnu decompress a + section without a name. + (print_string_section): Likewise. + +https://sourceware.org/bugzilla/show_bug.cgi?id=32656 + +Signed-off-by: Mark Wielaard <mark@klomp.org> + +Upstream-Status: Backport [https://sourceware.org/git/?p=elfutils.git;a=commit;h=73db9d2021cab9e23fd734b0a76a612d52a6f1db] +CVE: CVE-2025-1372 +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> +--- + src/readelf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/readelf.c b/src/readelf.c +index 63eb548..fc04556 100644 +--- a/src/readelf.c ++++ b/src/readelf.c +@@ -13327,7 +13327,7 @@ dump_data_section (Elf_Scn *scn, const GElf_Shdr *shdr, const char *name) + _("Couldn't uncompress section"), + elf_ndxscn (scn)); + } +- else if (startswith (name, ".zdebug")) ++ else if (name && startswith (name, ".zdebug")) + { + if (elf_compress_gnu (scn, 0, 0) < 0) + printf ("WARNING: %s [%zd]\n", +@@ -13378,7 +13378,7 @@ print_string_section (Elf_Scn *scn, const GElf_Shdr *shdr, const char *name) + _("Couldn't uncompress section"), + elf_ndxscn (scn)); + } +- else if (startswith (name, ".zdebug")) ++ else if (name && startswith (name, ".zdebug")) + { + if (elf_compress_gnu (scn, 0, 0) < 0) + printf ("WARNING: %s [%zd]\n", +-- +2.25.1 + -- 2.43.0 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* [OE-core][scarthgap 2/4] u-boot: kernel-fitimage: Restore FIT_SIGN_INDIVIDUAL="1" behavior 2025-02-28 14:42 [OE-core][scarthgap 0/4] Patch review Steve Sakoman 2025-02-28 14:42 ` [OE-core][scarthgap 1/4] elfutils: Fix multiple CVEs Steve Sakoman @ 2025-02-28 14:42 ` Steve Sakoman 2025-02-28 14:42 ` [OE-core][scarthgap 3/4] meta: Enable '-o pipefail' for the SDK installer Steve Sakoman 2025-02-28 14:43 ` [OE-core][scarthgap 4/4] ccache.conf: Add include_file_ctime to sloppiness Steve Sakoman 3 siblings, 0 replies; 7+ messages in thread From: Steve Sakoman @ 2025-02-28 14:42 UTC (permalink / raw) To: openembedded-core From: Marek Vasut <marex@denx.de> OE FIT_SIGN_INDIVIDUAL is implemented in an unusual manner, where the resulting signed fitImage contains both signed images and signed configurations, possibly using different keys. This kind of signing of images is redundant, but so is the behavior of FIT_SIGN_INDIVIDUAL="1" and that is here to stay. Adjust the process of public key insertion into u-boot.dtb such that if FIT_SIGN_INDIVIDUAL==1, the image signing key is inserted into u-boot.dtb first, and in any case the configuration signing key is inserted into u-boot.dtb last. The verification of the keys inserted into u-boot.dtb against unused.itb is performed only for FIT_SIGN_INDIVIDUAL!=1 due to mkimage limitation, which does not allow mkimage -f auto-conf to update the generated unused.itb, and instead rewrites it. Fixes: 259bfa86f384 ("u-boot: kernel-fitimage: Fix dependency loop if UBOOT_SIGN_ENABLE and UBOOT_ENV enabled") Signed-off-by: Marek Vasut <marex@denx.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0106e5efab99c8016836a2ab71e2327ce58a9a9d) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/classes-recipe/uboot-sign.bbclass | 60 ++++++++++++++++++++++---- 1 file changed, 51 insertions(+), 9 deletions(-) diff --git a/meta/classes-recipe/uboot-sign.bbclass b/meta/classes-recipe/uboot-sign.bbclass index 96c47ab016..5c579a9fb0 100644 --- a/meta/classes-recipe/uboot-sign.bbclass +++ b/meta/classes-recipe/uboot-sign.bbclass @@ -101,27 +101,69 @@ concat_dtb() { binary="$2" if [ -e "${UBOOT_DTB_BINARY}" ]; then - # Re-sign the kernel in order to add the keys to our dtb - UBOOT_MKIMAGE_MODE="auto-conf" # Signing individual images is not recommended as that # makes fitImage susceptible to mix-and-match attack. + # + # OE FIT_SIGN_INDIVIDUAL is implemented in an unusual manner, + # where the resulting signed fitImage contains both signed + # images and signed configurations. This is redundant. In + # order to prevent mix-and-match attack, it is sufficient + # to sign configurations. The FIT_SIGN_INDIVIDUAL = "1" + # support is kept to avoid breakage of existing layers, but + # it is highly recommended to avoid FIT_SIGN_INDIVIDUAL = "1", + # i.e. set FIT_SIGN_INDIVIDUAL = "0" . if [ "${FIT_SIGN_INDIVIDUAL}" = "1" ] ; then - UBOOT_MKIMAGE_MODE="auto" + # Sign dummy image images in order to + # add the image signing keys to our dtb + ${UBOOT_MKIMAGE_SIGN} \ + ${@'-D "${UBOOT_MKIMAGE_DTCOPTS}"' if len('${UBOOT_MKIMAGE_DTCOPTS}') else ''} \ + -f auto \ + -k "${UBOOT_SIGN_KEYDIR}" \ + -o "${FIT_HASH_ALG},${FIT_SIGN_ALG}" \ + -g "${UBOOT_SIGN_IMG_KEYNAME}" \ + -K "${UBOOT_DTB_BINARY}" \ + -d /dev/null \ + -r ${B}/unused.itb \ + ${UBOOT_MKIMAGE_SIGN_ARGS} fi + + # Sign dummy image configurations in order to + # add the configuration signing keys to our dtb ${UBOOT_MKIMAGE_SIGN} \ ${@'-D "${UBOOT_MKIMAGE_DTCOPTS}"' if len('${UBOOT_MKIMAGE_DTCOPTS}') else ''} \ - -f $UBOOT_MKIMAGE_MODE \ + -f auto-conf \ -k "${UBOOT_SIGN_KEYDIR}" \ -o "${FIT_HASH_ALG},${FIT_SIGN_ALG}" \ - -g "${UBOOT_SIGN_IMG_KEYNAME}" \ + -g "${UBOOT_SIGN_KEYNAME}" \ -K "${UBOOT_DTB_BINARY}" \ -d /dev/null \ -r ${B}/unused.itb \ ${UBOOT_MKIMAGE_SIGN_ARGS} - # Verify the kernel image and u-boot dtb - ${UBOOT_FIT_CHECK_SIGN} \ - -k "${UBOOT_DTB_BINARY}" \ - -f ${B}/unused.itb + + # Verify the dummy fitImage signature against u-boot.dtb + # augmented using public key material. + # + # This only works for FIT_SIGN_INDIVIDUAL = "0", because + # mkimage -f auto-conf does not support -F to extend the + # existing unused.itb , and instead rewrites unused.itb + # from scratch. + # + # Using two separate unused.itb for mkimage -f auto and + # mkimage -f auto-conf invocation above would not help, as + # the signature verification process below checks whether + # all keys inserted into u-boot.dtb /signature node pass + # the verification. Separate unused.itb would each miss one + # of the signatures. + # + # The FIT_SIGN_INDIVIDUAL = "1" support is kept to avoid + # breakage of existing layers, but it is highly recommended + # to not use FIT_SIGN_INDIVIDUAL = "1", i.e. set + # FIT_SIGN_INDIVIDUAL = "0" . + if [ "${FIT_SIGN_INDIVIDUAL}" != "1" ] ; then + ${UBOOT_FIT_CHECK_SIGN} \ + -k "${UBOOT_DTB_BINARY}" \ + -f ${B}/unused.itb + fi cp ${UBOOT_DTB_BINARY} ${UBOOT_DTB_SIGNED} fi -- 2.43.0 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* [OE-core][scarthgap 3/4] meta: Enable '-o pipefail' for the SDK installer 2025-02-28 14:42 [OE-core][scarthgap 0/4] Patch review Steve Sakoman 2025-02-28 14:42 ` [OE-core][scarthgap 1/4] elfutils: Fix multiple CVEs Steve Sakoman 2025-02-28 14:42 ` [OE-core][scarthgap 2/4] u-boot: kernel-fitimage: Restore FIT_SIGN_INDIVIDUAL="1" behavior Steve Sakoman @ 2025-02-28 14:42 ` Steve Sakoman 2025-02-28 14:43 ` [OE-core][scarthgap 4/4] ccache.conf: Add include_file_ctime to sloppiness Steve Sakoman 3 siblings, 0 replies; 7+ messages in thread From: Steve Sakoman @ 2025-02-28 14:42 UTC (permalink / raw) To: openembedded-core From: Moritz Haase <Moritz.Haase@bmw.de> When testing a Yocto SDK installer on Alpine 3.21, we recently ended up with a broken SDK. One of the commands the relocation script calls in a piped multi-command chain failed (see [0]), but the installer did not realize that - since it doesn't use 'set -o pipefail'. Thus, the error was never reported to the user and the installer claimed to have set up the SDK correctly - which wasn't the case. Given that the SDK installer is a POSIX-compliant shell script and that the 'pipefail' option used to be missing from the standard, it's not surprising that it isn't used. Thankfully however, in June of 2024, a new version of POSIX (POSIX.1-2024) was released - and that one finally includes the 'pipefail' option (see [1]). A number of shells already support it, so let's enable it if available to make the SDK installer more robust. The change has been tested locally using SDK installers for internal projects, based on both Kirkstone and Scarthgap. [0]: https://gitlab.alpinelinux.org/alpine/aports/-/issues/16797 [1]: https://pubs.opengroup.org/onlinepubs/9799919799.2024edition/utilities/V3_chap02.html#set (From OE-Core rev: 1cb4b41c7faf77fcc347b1276d86d4288968c926) Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 10dce263f0230f94a44a017b5614811e696c5ce9) Signed-off-by: Akash Hadke <akash.hadke27@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/files/toolchain-shar-extract.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/meta/files/toolchain-shar-extract.sh b/meta/files/toolchain-shar-extract.sh index 3b4647fca7..29c52e3b13 100644 --- a/meta/files/toolchain-shar-extract.sh +++ b/meta/files/toolchain-shar-extract.sh @@ -1,6 +1,11 @@ #!/bin/sh export LC_ALL=en_US.UTF-8 + +# The pipefail option is now part of POSIX (POSIX.1-2024) and available in more +# and more shells. Enable it if available to make the SDK installer more robust. +(set -o pipefail 2> /dev/null) && set -o pipefail + #Make sure at least one python is installed INIT_PYTHON=$(which python3 2>/dev/null ) [ -z "$INIT_PYTHON" ] && INIT_PYTHON=$(which python2 2>/dev/null) -- 2.43.0 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* [OE-core][scarthgap 4/4] ccache.conf: Add include_file_ctime to sloppiness 2025-02-28 14:42 [OE-core][scarthgap 0/4] Patch review Steve Sakoman ` (2 preceding siblings ...) 2025-02-28 14:42 ` [OE-core][scarthgap 3/4] meta: Enable '-o pipefail' for the SDK installer Steve Sakoman @ 2025-02-28 14:43 ` Steve Sakoman 3 siblings, 0 replies; 7+ messages in thread From: Steve Sakoman @ 2025-02-28 14:43 UTC (permalink / raw) To: openembedded-core From: Fabio Berton <fabio.berton@criticaltechworks.com> When multiple recipes are built in parallel, Ccache sometimes refuses to lookup some objects in cache, leading to undesired cache misses. The root cause of this is an interaction between the way how bitbake constructs a recipe sysroot and Ccache's `include_file_ctime` check. Whenever bitbake creates a recipe's sysroot it hardlinks the files provided by a recipes dependencies. Adding a hardlink to a file changes it's ctime which in turn leads Ccache to believe that the file was modified thus aborting the cache lookup. To avoid this situation, add `include_file_ctime` to the list of checks that should be ignored using the Ccache sloppiness configuration option [1]. Example of a log entry that Ccache ignores a file: / |recipe-sysroot/usr/include/bits/pthread_stack_min.h had status change |near or after invocation (ctime 1739822508.107677255, invocation time |1739822507.970071107) \ 1 - https://ccache.dev/manual/4.10.2.html#config_sloppiness Signed-off-by: Fabio Berton <fabio.berton@criticaltechworks.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4899698297c7783e02aba5388e0469cc83bd2f70) Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/conf/ccache.conf | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/meta/conf/ccache.conf b/meta/conf/ccache.conf index 4406ae561b..499e5327b8 100644 --- a/meta/conf/ccache.conf +++ b/meta/conf/ccache.conf @@ -1 +1,7 @@ max_size = 0 + +# Avoid spurious cache misses caused by recipe sysroot creation: Creating a +# recipe sysroot hardlinks all dependent files into place. Hardlinking updates +# the file's ctime which in turn interferes with ccache's include_file_ctime +# check. +sloppiness = include_file_ctime -- 2.43.0 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* [OE-core][scarthgap 0/4] Patch review
@ 2025-03-14 19:35 Steve Sakoman
0 siblings, 0 replies; 7+ messages in thread
From: Steve Sakoman @ 2025-03-14 19:35 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Tuesday, March 18
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1193
The following changes since commit b00b0d744a1768843386cfd529b73cc17c88bec9:
babeltrace2: extend to nativesdk (2025-03-12 07:14:12 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Oleksandr Hnatiuk (1):
gcc: remove paths to sysroot from configargs.h and checksum-options
for gcc-cross-canadian
Peter Marko (1):
libarchive: patch CVE-2025-1632 and CVE-2025-25724
Sana Kazi (1):
gcc-cross-canadian.inc: Fix buildpaths error for pthread.h
Zhang Peng (1):
mpg123: upgrade 1.32.6 -> 1.32.10
meta/recipes-devtools/gcc/gcc-common.inc | 22 +++++
.../gcc/gcc-configure-common.inc | 1 -
.../gcc/gcc-cross-canadian.inc | 8 ++
meta/recipes-devtools/gcc/gcc-cross.inc | 15 +---
meta/recipes-devtools/gcc/gcc-target.inc | 16 +---
.../CVE-2025-1632_CVE-2025-25724.patch | 83 +++++++++++++++++++
.../libarchive/libarchive_3.7.4.bb | 1 +
.../{mpg123_1.32.6.bb => mpg123_1.32.10.bb} | 2 +-
8 files changed, 119 insertions(+), 29 deletions(-)
create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2025-1632_CVE-2025-25724.patch
rename meta/recipes-multimedia/mpg123/{mpg123_1.32.6.bb => mpg123_1.32.10.bb} (96%)
--
2.43.0
^ permalink raw reply [flat|nested] 7+ messages in thread* [OE-core][scarthgap 0/4] Patch review
@ 2025-06-22 13:37 Steve Sakoman
0 siblings, 0 replies; 7+ messages in thread
From: Steve Sakoman @ 2025-06-22 13:37 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Tuesday, June 24
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1857
The following changes since commit db02a4cc542d0e7e563ec46c91bf9a7313a71d02:
systemd: Rename systemd_v255.21 to systemd_255.21 (2025-06-16 09:46:24 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Chen Qi (1):
coreutils: fix CVE-2025-5278
Moritz Haase (1):
cmake: Correctly handle cost data of tests with arbitrary chars in
name
Peter Marko (2):
go: set status of CVE-2024-3566
glibc: stable 2.39 branch updates
.../coreutils/coreutils/CVE-2025-5278.patch | 112 ++++++++++
meta/recipes-core/coreutils/coreutils_9.4.bb | 1 +
meta/recipes-core/glibc/glibc-version.inc | 2 +-
...y-the-header-between-arm-and-aarch64.patch | 1 +
...build-time-paths-in-the-output-binar.patch | 2 +-
.../glibc/glibc/0023-qemu-stale-process.patch | 8 +-
meta/recipes-core/glibc/glibc_2.39.bb | 3 +-
.../cmake/cmake-native_3.28.3.bb | 2 +-
...trary-characters-in-test-names-of-CT.patch | 205 ++++++++++++++++++
meta/recipes-devtools/cmake/cmake_3.28.3.bb | 1 +
.../go/go-binary-native_1.22.12.bb | 1 +
meta/recipes-devtools/go/go-common.inc | 1 +
12 files changed, 331 insertions(+), 8 deletions(-)
create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2025-5278.patch
create mode 100644 meta/recipes-devtools/cmake/cmake/0001-ctest-Allow-arbitrary-characters-in-test-names-of-CT.patch
--
2.43.0
^ permalink raw reply [flat|nested] 7+ messages in threadend of thread, other threads:[~2025-06-22 13:37 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2025-02-28 14:42 [OE-core][scarthgap 0/4] Patch review Steve Sakoman 2025-02-28 14:42 ` [OE-core][scarthgap 1/4] elfutils: Fix multiple CVEs Steve Sakoman 2025-02-28 14:42 ` [OE-core][scarthgap 2/4] u-boot: kernel-fitimage: Restore FIT_SIGN_INDIVIDUAL="1" behavior Steve Sakoman 2025-02-28 14:42 ` [OE-core][scarthgap 3/4] meta: Enable '-o pipefail' for the SDK installer Steve Sakoman 2025-02-28 14:43 ` [OE-core][scarthgap 4/4] ccache.conf: Add include_file_ctime to sloppiness Steve Sakoman -- strict thread matches above, loose matches on Subject: below -- 2025-03-14 19:35 [OE-core][scarthgap 0/4] Patch review Steve Sakoman 2025-06-22 13:37 Steve Sakoman
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.