* [OE-core][walnascar 1/8] ncurses: patch CVE-2025-6141
2025-07-30 21:08 [OE-core][walnascar 0/8] Patch review Steve Sakoman
@ 2025-07-30 21:08 ` Steve Sakoman
2025-07-30 21:08 ` [OE-core][walnascar 2/8] coreutils: fix CVE-2025-5278 Steve Sakoman
` (6 subsequent siblings)
7 siblings, 0 replies; 10+ messages in thread
From: Steve Sakoman @ 2025-07-30 21:08 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick relevant part of snapshot commit 20250329, see [1].
That has:
add a buffer-limit check in postprocess_termcap (report/testcase by
Yifan Zhang).
[1] https://invisible-island.net/ncurses/NEWS.html#index-t20250329
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../ncurses/files/CVE-2025-6141.patch | 25 +++++++++++++++++++
meta/recipes-core/ncurses/ncurses_6.5.bb | 1 +
2 files changed, 26 insertions(+)
create mode 100644 meta/recipes-core/ncurses/files/CVE-2025-6141.patch
diff --git a/meta/recipes-core/ncurses/files/CVE-2025-6141.patch b/meta/recipes-core/ncurses/files/CVE-2025-6141.patch
new file mode 100644
index 0000000000..ec7e8a94e4
--- /dev/null
+++ b/meta/recipes-core/ncurses/files/CVE-2025-6141.patch
@@ -0,0 +1,25 @@
+From 27d1493340d714e7be6e08c0a8f43e48276149c4 Mon Sep 17 00:00:00 2001
+From: "Thomas E. Dickey" <dickey@invisible-island.net>
+Date: Sat, 29 Mar 2025 22:52:37 +0000
+Subject: [PATCH] snapshot of project "ncurses", label v6_5_20250329
+
+CVE: CVE-2025-6141
+Upstream-Status: Backport [https://github.com/ThomasDickey/ncurses-snapshots/commit/27d1493340d714e7be6e08c0a8f43e48276149c4]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ ncurses/tinfo/parse_entry.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/ncurses/tinfo/parse_entry.c b/ncurses/tinfo/parse_entry.c
+index a2278c07..c551c780 100644
+--- a/ncurses/tinfo/parse_entry.c
++++ b/ncurses/tinfo/parse_entry.c
+@@ -985,6 +985,8 @@ postprocess_termcap(TERMTYPE2 *tp, bool has_base)
+ bp = tp->Strings[from_ptr->nte_index];
+ if (VALID_STRING(bp)) {
+ for (dp = buf2; *bp; bp++) {
++ if ((size_t) (dp - buf2) >= (sizeof(buf2) - sizeof(TERMTYPE2)))
++ break;
+ if (bp[0] == '$' && bp[1] == '<') {
+ while (*bp && *bp != '>') {
+ ++bp;
diff --git a/meta/recipes-core/ncurses/ncurses_6.5.bb b/meta/recipes-core/ncurses/ncurses_6.5.bb
index 2e3ee337ea..83de792d89 100644
--- a/meta/recipes-core/ncurses/ncurses_6.5.bb
+++ b/meta/recipes-core/ncurses/ncurses_6.5.bb
@@ -4,6 +4,7 @@ SRC_URI += "file://0001-tic-hang.patch \
file://0002-configure-reproducible.patch \
file://0003-gen-pkgconfig.in-Do-not-include-LDFLAGS-in-generated.patch \
file://exit_prototype.patch \
+ file://CVE-2025-6141.patch \
"
# commit id corresponds to the revision in package version
SRCREV = "1c55d64d9d3e00399a21f04e9cac1e472ab5f70a"
--
2.43.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [OE-core][walnascar 2/8] coreutils: fix CVE-2025-5278
2025-07-30 21:08 [OE-core][walnascar 0/8] Patch review Steve Sakoman
2025-07-30 21:08 ` [OE-core][walnascar 1/8] ncurses: patch CVE-2025-6141 Steve Sakoman
@ 2025-07-30 21:08 ` Steve Sakoman
2025-07-30 21:08 ` [OE-core][walnascar 3/8] libxml2: patch CVE-2025-6170 Steve Sakoman
` (5 subsequent siblings)
7 siblings, 0 replies; 10+ messages in thread
From: Steve Sakoman @ 2025-07-30 21:08 UTC (permalink / raw)
To: openembedded-core
From: Chen Qi <Qi.Chen@windriver.com>
Backport patch to fix CVE-2025-5278.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../coreutils/coreutils/CVE-2025-5278.patch | 112 ++++++++++++++++++
meta/recipes-core/coreutils/coreutils_9.6.bb | 1 +
2 files changed, 113 insertions(+)
create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2025-5278.patch
diff --git a/meta/recipes-core/coreutils/coreutils/CVE-2025-5278.patch b/meta/recipes-core/coreutils/coreutils/CVE-2025-5278.patch
new file mode 100644
index 0000000000..41be1635b5
--- /dev/null
+++ b/meta/recipes-core/coreutils/coreutils/CVE-2025-5278.patch
@@ -0,0 +1,112 @@
+From 8763c305c29d0abb7e2be4695212b42917d054b2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?P=C3=A1draig=20Brady?= <P@draigBrady.com>
+Date: Tue, 20 May 2025 16:03:44 +0100
+Subject: [PATCH] sort: fix buffer under-read (CWE-127)
+
+* src/sort.c (begfield): Check pointer adjustment
+to avoid Out-of-range pointer offset (CWE-823).
+(limfield): Likewise.
+* tests/sort/sort-field-limit.sh: Add a new test,
+which triggers with ASAN or Valgrind.
+* tests/local.mk: Reference the new test.
+* NEWS: Mention bug fix introduced in v7.2 (2009).
+Fixes https://bugs.gnu.org/78507
+
+CVE: CVE-2025-5278
+
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633]
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+---
+ src/sort.c | 12 ++++++++++--
+ tests/local.mk | 1 +
+ tests/sort/sort-field-limit.sh | 35 ++++++++++++++++++++++++++++++++++
+ 3 files changed, 46 insertions(+), 2 deletions(-)
+ create mode 100755 tests/sort/sort-field-limit.sh
+
+diff --git a/src/sort.c b/src/sort.c
+index b10183b6f..7af1a2512 100644
+--- a/src/sort.c
++++ b/src/sort.c
+@@ -1644,7 +1644,11 @@ begfield (struct line const *line, struct keyfield const *key)
+ ++ptr;
+
+ /* Advance PTR by SCHAR (if possible), but no further than LIM. */
+- ptr = MIN (lim, ptr + schar);
++ size_t remaining_bytes = lim - ptr;
++ if (schar < remaining_bytes)
++ ptr += schar;
++ else
++ ptr = lim;
+
+ return ptr;
+ }
+@@ -1746,7 +1750,11 @@ limfield (struct line const *line, struct keyfield const *key)
+ ++ptr;
+
+ /* Advance PTR by ECHAR (if possible), but no further than LIM. */
+- ptr = MIN (lim, ptr + echar);
++ size_t remaining_bytes = lim - ptr;
++ if (echar < remaining_bytes)
++ ptr += echar;
++ else
++ ptr = lim;
+ }
+
+ return ptr;
+diff --git a/tests/local.mk b/tests/local.mk
+index 4da6756ac..642d225fa 100644
+--- a/tests/local.mk
++++ b/tests/local.mk
+@@ -388,6 +388,7 @@ all_tests = \
+ tests/sort/sort-debug-keys.sh \
+ tests/sort/sort-debug-warn.sh \
+ tests/sort/sort-discrim.sh \
++ tests/sort/sort-field-limit.sh \
+ tests/sort/sort-files0-from.pl \
+ tests/sort/sort-float.sh \
+ tests/sort/sort-h-thousands-sep.sh \
+diff --git a/tests/sort/sort-field-limit.sh b/tests/sort/sort-field-limit.sh
+new file mode 100755
+index 000000000..52d8e1d17
+--- /dev/null
++++ b/tests/sort/sort-field-limit.sh
+@@ -0,0 +1,35 @@
++#!/bin/sh
++# From 7.2-9.7, this would trigger an out of bounds mem read
++
++# Copyright (C) 2025 Free Software Foundation, Inc.
++
++# This program is free software: you can redistribute it and/or modify
++# it under the terms of the GNU General Public License as published by
++# the Free Software Foundation, either version 3 of the License, or
++# (at your option) any later version.
++
++# This program is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++# GNU General Public License for more details.
++
++# You should have received a copy of the GNU General Public License
++# along with this program. If not, see <https://www.gnu.org/licenses/>.
++
++. "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
++print_ver_ sort
++getlimits_
++
++# This issue triggers with valgrind or ASAN
++valgrind --error-exitcode=1 sort --version 2>/dev/null &&
++ VALGRIND='valgrind --error-exitcode=1'
++
++{ printf '%s\n' aa bb; } > in || framework_failure_
++
++_POSIX2_VERSION=200809 $VALGRIND sort +0.${SIZE_MAX}R in > out || fail=1
++compare in out || fail=1
++
++_POSIX2_VERSION=200809 $VALGRIND sort +1 -1.${SIZE_MAX}R in > out || fail=1
++compare in out || fail=1
++
++Exit $fail
+--
+2.34.1
+
diff --git a/meta/recipes-core/coreutils/coreutils_9.6.bb b/meta/recipes-core/coreutils/coreutils_9.6.bb
index b876a8fdd0..34c6246ed3 100644
--- a/meta/recipes-core/coreutils/coreutils_9.6.bb
+++ b/meta/recipes-core/coreutils/coreutils_9.6.bb
@@ -19,6 +19,7 @@ SRC_URI = "${GNU_MIRROR}/coreutils/${BP}.tar.xz \
file://intermittent-testfailure.patch \
file://0001-ls-fix-crash-with-context.patch \
file://0001-cksum-port-to-32-bit-uint_fast32_t.patch \
+ file://CVE-2025-5278.patch \
file://run-ptest \
"
SRC_URI[sha256sum] = "7a0124327b398fd9eb1a6abde583389821422c744ffa10734b24f557610d3283"
--
2.43.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [OE-core][walnascar 3/8] libxml2: patch CVE-2025-6170
2025-07-30 21:08 [OE-core][walnascar 0/8] Patch review Steve Sakoman
2025-07-30 21:08 ` [OE-core][walnascar 1/8] ncurses: patch CVE-2025-6141 Steve Sakoman
2025-07-30 21:08 ` [OE-core][walnascar 2/8] coreutils: fix CVE-2025-5278 Steve Sakoman
@ 2025-07-30 21:08 ` Steve Sakoman
2025-07-30 21:08 ` [OE-core][walnascar 4/8] dpkg: fix CVE-2025-6297 Steve Sakoman
` (4 subsequent siblings)
7 siblings, 0 replies; 10+ messages in thread
From: Steve Sakoman @ 2025-07-30 21:08 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick commit referencing this CVE from 2.13 branch.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libxml/libxml2/CVE-2025-6170.patch | 103 ++++++++++++++++++
meta/recipes-core/libxml/libxml2_2.13.8.bb | 1 +
2 files changed, 104 insertions(+)
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2025-6170.patch
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2025-6170.patch b/meta/recipes-core/libxml/libxml2/CVE-2025-6170.patch
new file mode 100644
index 0000000000..29c82f8baf
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2025-6170.patch
@@ -0,0 +1,103 @@
+From 5e9ec5c107d3f5b5179c3dbc19df43df041cd55b Mon Sep 17 00:00:00 2001
+From: Michael Mann <mmann78@netscape.net>
+Date: Fri, 20 Jun 2025 23:05:00 -0400
+Subject: [PATCH] [CVE-2025-6170] Fix potential buffer overflows of interactive
+ shell
+
+Fixes #941
+
+CVE: CVE-2025-6170
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/5e9ec5c107d3f5b5179c3dbc19df43df041cd55b]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ debugXML.c | 15 ++++++++++-----
+ result/scripts/long_command | 8 ++++++++
+ test/scripts/long_command.script | 6 ++++++
+ test/scripts/long_command.xml | 1 +
+ 4 files changed, 25 insertions(+), 5 deletions(-)
+ create mode 100644 result/scripts/long_command
+ create mode 100644 test/scripts/long_command.script
+ create mode 100644 test/scripts/long_command.xml
+
+diff --git a/debugXML.c b/debugXML.c
+index ed56b0f8..452b9573 100644
+--- a/debugXML.c
++++ b/debugXML.c
+@@ -1033,6 +1033,10 @@ xmlCtxtDumpOneNode(xmlDebugCtxtPtr ctxt, xmlNodePtr node)
+ xmlCtxtGenericNodeCheck(ctxt, node);
+ }
+
++#define MAX_PROMPT_SIZE 500
++#define MAX_ARG_SIZE 400
++#define MAX_COMMAND_SIZE 100
++
+ /**
+ * xmlCtxtDumpNode:
+ * @output: the FILE * for the output
+@@ -2795,10 +2799,10 @@ void
+ xmlShell(xmlDocPtr doc, const char *filename, xmlShellReadlineFunc input,
+ FILE * output)
+ {
+- char prompt[500] = "/ > ";
++ char prompt[MAX_PROMPT_SIZE] = "/ > ";
+ char *cmdline = NULL, *cur;
+- char command[100];
+- char arg[400];
++ char command[MAX_COMMAND_SIZE];
++ char arg[MAX_ARG_SIZE];
+ int i;
+ xmlShellCtxtPtr ctxt;
+ xmlXPathObjectPtr list;
+@@ -2856,7 +2860,8 @@ xmlShell(xmlDocPtr doc, const char *filename, xmlShellReadlineFunc input,
+ cur++;
+ i = 0;
+ while ((*cur != ' ') && (*cur != '\t') &&
+- (*cur != '\n') && (*cur != '\r')) {
++ (*cur != '\n') && (*cur != '\r') &&
++ (i < (MAX_COMMAND_SIZE - 1))) {
+ if (*cur == 0)
+ break;
+ command[i++] = *cur++;
+@@ -2871,7 +2876,7 @@ xmlShell(xmlDocPtr doc, const char *filename, xmlShellReadlineFunc input,
+ while ((*cur == ' ') || (*cur == '\t'))
+ cur++;
+ i = 0;
+- while ((*cur != '\n') && (*cur != '\r') && (*cur != 0)) {
++ while ((*cur != '\n') && (*cur != '\r') && (*cur != 0) && (i < (MAX_ARG_SIZE-1))) {
+ if (*cur == 0)
+ break;
+ arg[i++] = *cur++;
+diff --git a/result/scripts/long_command b/result/scripts/long_command
+new file mode 100644
+index 00000000..e6f00708
+--- /dev/null
++++ b/result/scripts/long_command
+@@ -0,0 +1,8 @@
++/ > b > b > Object is a Node Set :
++Set contains 1 nodes:
++1 ELEMENT a:c
++b > Unknown command This_is_a_really_long_command_string_designed_to_test_the_limits_of_the_memory_that_stores_the_comm
++b > b > Unknown command ess_currents_of_time_and_existence
++b > <?xml version="1.0"?>
++<a xmlns:a="bar"><b xmlns:a="foo">Navigating_the_labyrinthine_corridors_of_human_cognition_one_often_encounters_the_perplexing_paradox_that_the_more_we_delve_into_the_intricate_dance_of_neural_pathways_and_synaptic_firings_the_further_we_seem_to_stray_from_a_truly_holistic_understanding_of_consciousness_a_phenomenon_that_remains_as_elusive_as_a_moonbeam_caught_in_a_spiderweb_yet_undeniably_shapes_every_fleeting_thought_every_prof</b></a>
++b >
+\ No newline at end of file
+diff --git a/test/scripts/long_command.script b/test/scripts/long_command.script
+new file mode 100644
+index 00000000..00f6df09
+--- /dev/null
++++ b/test/scripts/long_command.script
+@@ -0,0 +1,6 @@
++cd a/b
++set <a:c/>
++xpath //*[namespace-uri()="foo"]
++This_is_a_really_long_command_string_designed_to_test_the_limits_of_the_memory_that_stores_the_command_please_dont_crash foo
++set Navigating_the_labyrinthine_corridors_of_human_cognition_one_often_encounters_the_perplexing_paradox_that_the_more_we_delve_into_the_intricate_dance_of_neural_pathways_and_synaptic_firings_the_further_we_seem_to_stray_from_a_truly_holistic_understanding_of_consciousness_a_phenomenon_that_remains_as_elusive_as_a_moonbeam_caught_in_a_spiderweb_yet_undeniably_shapes_every_fleeting_thought_every_profound_emotion_and_every_grand_aspiration_that_propels_our_species_ever_onward_through_the_relentless_currents_of_time_and_existence
++save -
+diff --git a/test/scripts/long_command.xml b/test/scripts/long_command.xml
+new file mode 100644
+index 00000000..1ba44016
+--- /dev/null
++++ b/test/scripts/long_command.xml
+@@ -0,0 +1 @@
++<a xmlns:a="bar"><b xmlns:a="foo"/></a>
diff --git a/meta/recipes-core/libxml/libxml2_2.13.8.bb b/meta/recipes-core/libxml/libxml2_2.13.8.bb
index fd042c311d..4bd2a0d38f 100644
--- a/meta/recipes-core/libxml/libxml2_2.13.8.bb
+++ b/meta/recipes-core/libxml/libxml2_2.13.8.bb
@@ -20,6 +20,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
file://CVE-2025-6021.patch \
file://CVE-2025-49794_CVE-2025-49796.patch \
file://CVE-2025-49795.patch \
+ file://CVE-2025-6170.patch \
"
SRC_URI[archive.sha256sum] = "277294cb33119ab71b2bc81f2f445e9bc9435b893ad15bb2cd2b0e859a0ee84a"
--
2.43.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [OE-core][walnascar 4/8] dpkg: fix CVE-2025-6297
2025-07-30 21:08 [OE-core][walnascar 0/8] Patch review Steve Sakoman
` (2 preceding siblings ...)
2025-07-30 21:08 ` [OE-core][walnascar 3/8] libxml2: patch CVE-2025-6170 Steve Sakoman
@ 2025-07-30 21:08 ` Steve Sakoman
2025-07-30 21:08 ` [OE-core][walnascar 5/8] scripts/install-buildtools: Update to 5.2.2 Steve Sakoman
` (3 subsequent siblings)
7 siblings, 0 replies; 10+ messages in thread
From: Steve Sakoman @ 2025-07-30 21:08 UTC (permalink / raw)
To: openembedded-core
From: Hongxu Jia <hongxu.jia@windriver.com>
Backport a patch from upstream to fix CVE-2025-6297 [1]
[1] https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=98c623c8d6814ae46a3b30ca22e584c77d47d86b
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../dpkg/dpkg/CVE-2025-6297.patch | 130 ++++++++++++++++++
meta/recipes-devtools/dpkg/dpkg_1.22.11.bb | 1 +
2 files changed, 131 insertions(+)
create mode 100644 meta/recipes-devtools/dpkg/dpkg/CVE-2025-6297.patch
diff --git a/meta/recipes-devtools/dpkg/dpkg/CVE-2025-6297.patch b/meta/recipes-devtools/dpkg/dpkg/CVE-2025-6297.patch
new file mode 100644
index 0000000000..69f65d8077
--- /dev/null
+++ b/meta/recipes-devtools/dpkg/dpkg/CVE-2025-6297.patch
@@ -0,0 +1,130 @@
+From 04cde8cbda7044d950488dd47321eebef4edd99f Mon Sep 17 00:00:00 2001
+From: Guillem Jover <guillem@debian.org>
+Date: Sat, 7 Jun 2025 14:17:07 +0200
+Subject: [PATCH] dpkg-deb: Fix cleanup for control member with restricted
+ directories
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When extracting a control member into a temporary directory, which is
+documented as being a safe operation even on untrusted data, the code
+in charge of the temporary directory cleanup does not sanitize the
+directory permissions, which is then unable to perform the «rm -rf»
+when running as a non-root user, leaving temporary files behind.
+
+Given automated and repeated execution of dpkg-deb commands on
+adversarial .deb packages or with well compressible files, placed
+inside a directory with permissions not allowing removal by a non-root
+user, this can end up with a DoS scenario due to causing disk quota
+exhaustion or disk full conditions.
+
+This is considered a minor issue, given the required conditions to
+trigger a problem with it, but an issue non the less given the
+documented security guarantees of the command. This has been an
+issue since the initial commit introducing dpkg-deb in C.
+
+We use an existing string for the error message to avoid new strings
+needing translation for stable branches, which make the error message
+less descriptive than what would be ideal. This will be improved in
+git HEAD.
+
+Reported-by: zhutyra on HackerOne
+Fixes: CVE-2025-6297
+Stable-Candidate: 1.20.x 1.21.x 1.22.x
+(cherry picked from commit ed6bbd445dd8800308c67236ba35d08004c98e82)
+(cherry picked from commit 02ad0532bd490cbc95b344f670e622a38eecfbf6)
+(cherry picked from commit d8a76551e22abe76eefd7fef5c7f51f4118eb40e)
+
+Signed-off-by: Guillem Jover <guillem@debian.org>
+
+CVE: CVE-2025-6297
+Upstream-Status: Backport [https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=98c623c8d6814ae46a3b30ca22e584c77d47d86b]
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ src/at/deb-content.at | 32 ++++++++++++++++++++++++++++++++
+ src/deb/info.c | 20 ++++++++++++++++++++
+ 2 files changed, 52 insertions(+)
+
+diff --git a/src/at/deb-content.at b/src/at/deb-content.at
+index f475603f9..aa5582992 100644
+--- a/src/at/deb-content.at
++++ b/src/at/deb-content.at
+@@ -127,3 +127,35 @@ newline'
+ ])
+
+ AT_CLEANUP
++
++AT_SETUP([dpkg-deb .deb extraction cleanup])
++AT_KEYWORDS([dpkg-deb deb extraction])
++
++DPKG_GEN_CONTROL([pkg-ctrl-dir-perms])
++AT_CHECK([
++dpkg-deb --root-owner-group -Znone -b pkg-ctrl-dir-perms
++DPKG_AR_EXTRACT([pkg-ctrl-dir-perms.deb])
++dpkg-deb -R pkg-ctrl-dir-perms.deb pkg-ctrl-dir-perms-bad
++mkdir -p pkg-ctrl-dir-perms-bad/DEBIAN/rx-subdir/inner
++touch pkg-ctrl-dir-perms-bad/DEBIAN/rx-subdir/inner/file
++chmod 0555 pkg-ctrl-dir-perms-bad/DEBIAN
++chmod 0555 pkg-ctrl-dir-perms-bad/DEBIAN/rx-subdir
++chmod 0555 pkg-ctrl-dir-perms-bad/DEBIAN/rx-subdir/inner
++$TAR cf control.tar --format=gnu --sort=name --mtime @0 --clamp-mtime --owner root:0 --group root:0 -C pkg-ctrl-dir-perms-bad/DEBIAN .
++DPKG_AR_GEN([pkg-ctrl-dir-perms.deb], [debian-binary control.tar data.tar])
++], [0], [dpkg-deb: building package 'pkg-ctrl-dir-perms' in 'pkg-ctrl-dir-perms.deb'.
++])
++AT_CHECK([
++dpkg-deb --ctrl-tarfile pkg-ctrl-dir-perms.deb | $TAR tvf -
++], [0], [dr-xr-xr-x root/root 0 1970-01-01 00:00 ./
++-rw-r--r-- root/root 176 1970-01-01 00:00 ./control
++dr-xr-xr-x root/root 0 1970-01-01 00:00 ./rx-subdir/
++dr-xr-xr-x root/root 0 1970-01-01 00:00 ./rx-subdir/inner/
++-rw-r--r-- root/root 0 1970-01-01 00:00 ./rx-subdir/inner/file
++])
++# Check that we can cleanup the temporarily extracted control.tar member.
++AT_CHECK([
++dpkg-deb -I pkg-ctrl-dir-perms.deb
++], [0], [ignore])
++
++AT_CLEANUP
+diff --git a/src/deb/info.c b/src/deb/info.c
+index afe79011f..a3d566379 100644
+--- a/src/deb/info.c
++++ b/src/deb/info.c
+@@ -45,14 +45,34 @@
+ #include <dpkg/pkg-format.h>
+ #include <dpkg/buffer.h>
+ #include <dpkg/path.h>
++#include <dpkg/treewalk.h>
+ #include <dpkg/options.h>
+
+ #include "dpkg-deb.h"
+
++static int
++cu_info_treewalk_fixup_dir(struct treenode *node)
++{
++ const char *nodename;
++
++ if (!S_ISDIR(treenode_get_mode(node)))
++ return 0;
++
++ nodename = treenode_get_pathname(node);
++ if (chmod(nodename, 0755) < 0)
++ ohshite(_("error setting permissions of '%.255s'"), nodename);
++
++ return 0;
++}
++
+ static void cu_info_prepare(int argc, void **argv) {
+ char *dir;
++ struct treewalk_funcs cu_info_treewalk_funcs = {
++ .visit = cu_info_treewalk_fixup_dir,
++ };
+
+ dir = argv[0];
++ treewalk(dir, TREEWALK_NONE, &cu_info_treewalk_funcs);
+ path_remove_tree(dir);
+ free(dir);
+ }
+--
+2.49.0
+
diff --git a/meta/recipes-devtools/dpkg/dpkg_1.22.11.bb b/meta/recipes-devtools/dpkg/dpkg_1.22.11.bb
index 47a8d5d5ea..4992c14074 100644
--- a/meta/recipes-devtools/dpkg/dpkg_1.22.11.bb
+++ b/meta/recipes-devtools/dpkg/dpkg_1.22.11.bb
@@ -13,6 +13,7 @@ SRC_URI = "git://salsa.debian.org/dpkg-team/dpkg.git;protocol=https;branch=main
file://0007-dpkg-deb-build.c-Remove-usage-of-clamp-mtime-in-tar.patch \
file://0001-dpkg-Support-muslx32-build.patch \
file://0001-Add-support-for-riscv32-CPU.patch \
+ file://CVE-2025-6297.patch \
"
SRC_URI:append:class-native = " file://0001-build.c-ignore-return-of-1-from-tar-cf.patch"
--
2.43.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [OE-core][walnascar 5/8] scripts/install-buildtools: Update to 5.2.2
2025-07-30 21:08 [OE-core][walnascar 0/8] Patch review Steve Sakoman
` (3 preceding siblings ...)
2025-07-30 21:08 ` [OE-core][walnascar 4/8] dpkg: fix CVE-2025-6297 Steve Sakoman
@ 2025-07-30 21:08 ` Steve Sakoman
2025-07-30 21:08 ` [OE-core][walnascar 6/8] git: upgrade 2.49.0 -> 2.49.1 Steve Sakoman
` (2 subsequent siblings)
7 siblings, 0 replies; 10+ messages in thread
From: Steve Sakoman @ 2025-07-30 21:08 UTC (permalink / raw)
To: openembedded-core
From: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com>
Update to the 5.2.2 release of the 5.2 series for buildtools
Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
scripts/install-buildtools | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/scripts/install-buildtools b/scripts/install-buildtools
index aa23942858..50b5487eb8 100755
--- a/scripts/install-buildtools
+++ b/scripts/install-buildtools
@@ -57,8 +57,8 @@ logger = scriptutils.logger_create(PROGNAME, stream=sys.stdout)
DEFAULT_INSTALL_DIR = os.path.join(os.path.split(scripts_path)[0],'buildtools')
DEFAULT_BASE_URL = 'https://downloads.yoctoproject.org/releases/yocto'
-DEFAULT_RELEASE = 'yocto-5.2.1'
-DEFAULT_INSTALLER_VERSION = '5.2.1'
+DEFAULT_RELEASE = 'yocto-5.2.2'
+DEFAULT_INSTALLER_VERSION = '5.2.2'
DEFAULT_BUILDDATE = '202110XX'
# Python version sanity check
--
2.43.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [OE-core][walnascar 6/8] git: upgrade 2.49.0 -> 2.49.1
2025-07-30 21:08 [OE-core][walnascar 0/8] Patch review Steve Sakoman
` (4 preceding siblings ...)
2025-07-30 21:08 ` [OE-core][walnascar 5/8] scripts/install-buildtools: Update to 5.2.2 Steve Sakoman
@ 2025-07-30 21:08 ` Steve Sakoman
2025-07-30 21:08 ` [OE-core][walnascar 7/8] bind: upgrade 9.20.9 -> 9.20.11 Steve Sakoman
2025-07-30 21:08 ` [OE-core][walnascar 8/8] ltp: Skip semctl08 when __USE_TIME64_REDIRECTS is defined Steve Sakoman
7 siblings, 0 replies; 10+ messages in thread
From: Steve Sakoman @ 2025-07-30 21:08 UTC (permalink / raw)
To: openembedded-core
From: Praveen Kumar <praveen.kumar@windriver.com>
Git v2.49.1 Release Notes
=========================
This release merges up the fixes that appear in v2.43.7, v2.44.4,
v2.45.4, v2.46.4, v2.47.3, and v2.48.2 to address the following CVEs:
CVE-2025-27613, CVE-2025-27614, CVE-2025-46334, CVE-2025-46835,
CVE-2025-48384, CVE-2025-48385, and CVE-2025-48386. See the release
notes for v2.43.7 for details.
It also contains some updates to various CI bits to work around and/or
to adjust to the deprecation of use of Ubuntu 20.04 GitHub Actions CI,
updates to to Fedora base image.
Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/git/{git_2.49.0.bb => git_2.49.1.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-devtools/git/{git_2.49.0.bb => git_2.49.1.bb} (98%)
diff --git a/meta/recipes-devtools/git/git_2.49.0.bb b/meta/recipes-devtools/git/git_2.49.1.bb
similarity index 98%
rename from meta/recipes-devtools/git/git_2.49.0.bb
rename to meta/recipes-devtools/git/git_2.49.1.bb
index 3538170d08..2b310ded7a 100644
--- a/meta/recipes-devtools/git/git_2.49.0.bb
+++ b/meta/recipes-devtools/git/git_2.49.1.bb
@@ -170,4 +170,4 @@ EXTRA_OECONF += "ac_cv_snprintf_returns_bogus=no \
"
EXTRA_OEMAKE += "NO_GETTEXT=1"
-SRC_URI[tarball.sha256sum] = "f8047f572f665bebeb637fd5f14678f31b3ca5d2ff9a18f20bd925bd48f75d3c"
+SRC_URI[tarball.sha256sum] = "84a8383ffc77146133bc128a544450cf8ce5166cbea5056c98033d2f0c454794"
--
2.43.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [OE-core][walnascar 7/8] bind: upgrade 9.20.9 -> 9.20.11
2025-07-30 21:08 [OE-core][walnascar 0/8] Patch review Steve Sakoman
` (5 preceding siblings ...)
2025-07-30 21:08 ` [OE-core][walnascar 6/8] git: upgrade 2.49.0 -> 2.49.1 Steve Sakoman
@ 2025-07-30 21:08 ` Steve Sakoman
2025-07-30 21:08 ` [OE-core][walnascar 8/8] ltp: Skip semctl08 when __USE_TIME64_REDIRECTS is defined Steve Sakoman
7 siblings, 0 replies; 10+ messages in thread
From: Steve Sakoman @ 2025-07-30 21:08 UTC (permalink / raw)
To: openembedded-core
From: Praveen Kumar <praveen.kumar@windriver.com>
Overview of changes in bind 9.20.11
==================================
Security Fixes:
1. Fix a possible assertion failure when stale-answer-client-timeout is set to 0.
2. In specific circumstances the named resolver process could exit with an
assertion failure when stale answers were enabled and the stale-answer-client-timeout
configuration option was set to 0. This has been fixed. (CVE-2025-40777) [GL #5372]
For additional feature changes and bug fixes, please see:
https://downloads.isc.org/isc/bind9/9.20.11/doc/arm/html/notes.html#notes-for-bind-9-20-11
Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../bind/{bind_9.20.9.bb => bind_9.20.11.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-connectivity/bind/{bind_9.20.9.bb => bind_9.20.11.bb} (97%)
diff --git a/meta/recipes-connectivity/bind/bind_9.20.9.bb b/meta/recipes-connectivity/bind/bind_9.20.11.bb
similarity index 97%
rename from meta/recipes-connectivity/bind/bind_9.20.9.bb
rename to meta/recipes-connectivity/bind/bind_9.20.11.bb
index 93ff957fc5..8d230f6e95 100644
--- a/meta/recipes-connectivity/bind/bind_9.20.9.bb
+++ b/meta/recipes-connectivity/bind/bind_9.20.11.bb
@@ -20,7 +20,7 @@ SRC_URI = "https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.xz \
file://0001-avoid-start-failure-with-bind-user.patch \
"
-SRC_URI[sha256sum] = "3d26900ed9c9a859073ffea9b97e292c1248dad18279b17b05fcb23c3091f86d"
+SRC_URI[sha256sum] = "4da2d532e668bc21e883f6e6d9d3d81794d9ec60b181530385649a56f46ee17a"
UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/"
# follow the ESV versions divisible by 2
--
2.43.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [OE-core][walnascar 8/8] ltp: Skip semctl08 when __USE_TIME64_REDIRECTS is defined
2025-07-30 21:08 [OE-core][walnascar 0/8] Patch review Steve Sakoman
` (6 preceding siblings ...)
2025-07-30 21:08 ` [OE-core][walnascar 7/8] bind: upgrade 9.20.9 -> 9.20.11 Steve Sakoman
@ 2025-07-30 21:08 ` Steve Sakoman
7 siblings, 0 replies; 10+ messages in thread
From: Steve Sakoman @ 2025-07-30 21:08 UTC (permalink / raw)
To: openembedded-core
From: Jiaying Song <jiaying.song.cn@windriver.com>
When __USE_TIME64_REDIRECTS is defined, glibc redirects struct semid_ds
to a 64-bit time-safe version that omits the sem_otime_high and
sem_ctime_high fields. As a result, the case becomes invalid, leading to
incorrect behavior.
This patch adds a check to skip the test when __USE_TIME64_REDIRECTS is
defined, ensuring the test only runs when the semid_ds structurally
matches semid64_ds and the *_high fields are accessible.
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...8-Skip-semctl08-when-__USE_TIME64_RE.patch | 48 +++++++++++++++++++
meta/recipes-extended/ltp/ltp_20250130.bb | 3 +-
2 files changed, 50 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-extended/ltp/ltp/0001-syscalls-semctl08-Skip-semctl08-when-__USE_TIME64_RE.patch
diff --git a/meta/recipes-extended/ltp/ltp/0001-syscalls-semctl08-Skip-semctl08-when-__USE_TIME64_RE.patch b/meta/recipes-extended/ltp/ltp/0001-syscalls-semctl08-Skip-semctl08-when-__USE_TIME64_RE.patch
new file mode 100644
index 0000000000..b4859a6f0a
--- /dev/null
+++ b/meta/recipes-extended/ltp/ltp/0001-syscalls-semctl08-Skip-semctl08-when-__USE_TIME64_RE.patch
@@ -0,0 +1,48 @@
+From 55b48d66857a43c2609fc351293b5601e2eb955d Mon Sep 17 00:00:00 2001
+From: Jiaying Song <jiaying.song.cn@windriver.com>
+Date: Fri, 23 May 2025 15:17:49 +0800
+Subject: [PATCH] syscalls/semctl08: Skip semctl08 when __USE_TIME64_REDIRECTS
+ is defined
+
+When __USE_TIME64_REDIRECTS is defined, glibc redirects struct semid_ds to a
+64-bit time-safe version that omits the sem_otime_high and sem_ctime_high
+fields. As a result, the case becomes invalid and leads to incorrect behavior.
+
+This patch adds a check to skip the test when __USE_TIME64_REDIRECTS is
+defined, ensuring the test only runs when semid_ds structurally matches
+semid64_ds and the *_high fields are accessible.
+
+Upstream-Status: Submitted [https://lists.linux.it/pipermail/ltp/2025-May/043647.html]
+
+Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
+---
+ testcases/kernel/syscalls/ipc/semctl/semctl08.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/testcases/kernel/syscalls/ipc/semctl/semctl08.c b/testcases/kernel/syscalls/ipc/semctl/semctl08.c
+index 1878bd4..3b799fa 100644
+--- a/testcases/kernel/syscalls/ipc/semctl/semctl08.c
++++ b/testcases/kernel/syscalls/ipc/semctl/semctl08.c
+@@ -10,7 +10,11 @@
+ #include "tst_test.h"
+ #include "libnewipc.h"
+
+-#ifdef HAVE_SEMID64_DS_TIME_HIGH
++#if !defined(HAVE_SEMID64_DS_TIME_HIGH)
++TST_TEST_TCONF("test requires struct semid64_ds to have the time_high fields");
++#elif defined(__USE_TIME64_REDIRECTS)
++TST_TEST_TCONF("test requires __USE_TIME64_REDIRECTS to be undefined");
++#else
+
+ static void run(void)
+ {
+@@ -47,6 +51,4 @@ static struct tst_test test = {
+ .test_all = run,
+ .needs_tmpdir = 1,
+ };
+-#else
+-TST_TEST_TCONF("test requires struct semid64_ds to have the time_high fields");
+ #endif
+--
+2.34.1
+
diff --git a/meta/recipes-extended/ltp/ltp_20250130.bb b/meta/recipes-extended/ltp/ltp_20250130.bb
index f9521acbc6..4c03b583fa 100644
--- a/meta/recipes-extended/ltp/ltp_20250130.bb
+++ b/meta/recipes-extended/ltp/ltp_20250130.bb
@@ -31,7 +31,8 @@ SRC_URI = "git://github.com/linux-test-project/ltp.git;branch=master;protocol=ht
file://0001-Add-__clear_cache-declaration-for-clang.patch \
file://0001-kernel-kvm-don-t-hardcode-objcopy.patch \
file://0001-cve-2015-3290-Disable-AVX-for-x86_64.patch \
- "
+ file://0001-syscalls-semctl08-Skip-semctl08-when-__USE_TIME64_RE.patch \
+ "
S = "${WORKDIR}/git"
--
2.43.0
^ permalink raw reply related [flat|nested] 10+ messages in thread