* [OE-core][scarthgap 1/9] avahi: fix CVE-2024-52615
2025-08-15 16:44 [OE-core][scarthgap 0/9] Patch review Steve Sakoman
@ 2025-08-15 16:44 ` Steve Sakoman
2025-08-15 16:44 ` [OE-core][scarthgap 2/9] python3: patch CVE-2025-8194 Steve Sakoman
` (7 subsequent siblings)
8 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-08-15 16:44 UTC (permalink / raw)
To: openembedded-core
From: Zhang Peng <peng.zhang1.cn@windriver.com>
CVE-2024-52615:
A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area
DNS queries. This issue simplifies attacks where malicious DNS responses are injected.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-52615]
[https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g]
Upstream patches:
[https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-connectivity/avahi/avahi_0.8.bb | 1 +
.../avahi/files/CVE-2024-52615.patch | 228 ++++++++++++++++++
2 files changed, 229 insertions(+)
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2024-52615.patch
diff --git a/meta/recipes-connectivity/avahi/avahi_0.8.bb b/meta/recipes-connectivity/avahi/avahi_0.8.bb
index 1163c17e20..7930bd3037 100644
--- a/meta/recipes-connectivity/avahi/avahi_0.8.bb
+++ b/meta/recipes-connectivity/avahi/avahi_0.8.bb
@@ -36,6 +36,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/avahi-${PV}.tar.gz \
file://CVE-2023-38472.patch \
file://CVE-2023-38473.patch \
file://CVE-2024-52616.patch \
+ file://CVE-2024-52615.patch \
"
GITHUB_BASE_URI = "https://github.com/avahi/avahi/releases/"
diff --git a/meta/recipes-connectivity/avahi/files/CVE-2024-52615.patch b/meta/recipes-connectivity/avahi/files/CVE-2024-52615.patch
new file mode 100644
index 0000000000..9737f52837
--- /dev/null
+++ b/meta/recipes-connectivity/avahi/files/CVE-2024-52615.patch
@@ -0,0 +1,228 @@
+From 4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942 Mon Sep 17 00:00:00 2001
+From: Michal Sekletar <msekleta@redhat.com>
+Date: Wed, 27 Nov 2024 18:07:32 +0100
+Subject: [PATCH] core/wide-area: fix for CVE-2024-52615
+
+CVE: CVE-2024-52615
+Upstream-Status: Backport [https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942]
+
+Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
+---
+ avahi-core/wide-area.c | 128 ++++++++++++++++++++++-------------------
+ 1 file changed, 69 insertions(+), 59 deletions(-)
+
+diff --git a/avahi-core/wide-area.c b/avahi-core/wide-area.c
+index 00a15056e..06df7afc6 100644
+--- a/avahi-core/wide-area.c
++++ b/avahi-core/wide-area.c
+@@ -81,6 +81,10 @@ struct AvahiWideAreaLookup {
+
+ AvahiAddress dns_server_used;
+
++ int fd;
++ AvahiWatch *watch;
++ AvahiProtocol proto;
++
+ AVAHI_LLIST_FIELDS(AvahiWideAreaLookup, lookups);
+ AVAHI_LLIST_FIELDS(AvahiWideAreaLookup, by_key);
+ };
+@@ -88,9 +92,6 @@ struct AvahiWideAreaLookup {
+ struct AvahiWideAreaLookupEngine {
+ AvahiServer *server;
+
+- int fd_ipv4, fd_ipv6;
+- AvahiWatch *watch_ipv4, *watch_ipv6;
+-
+ /* Cache */
+ AVAHI_LLIST_HEAD(AvahiWideAreaCacheEntry, cache);
+ AvahiHashmap *cache_by_key;
+@@ -125,35 +126,67 @@ static AvahiWideAreaLookup* find_lookup(AvahiWideAreaLookupEngine *e, uint16_t i
+ return l;
+ }
+
++static void socket_event(AVAHI_GCC_UNUSED AvahiWatch *w, int fd, AVAHI_GCC_UNUSED AvahiWatchEvent events, void *userdata);
++
+ static int send_to_dns_server(AvahiWideAreaLookup *l, AvahiDnsPacket *p) {
++ AvahiWideAreaLookupEngine *e;
+ AvahiAddress *a;
++ AvahiServer *s;
++ AvahiWatch *w;
++ int r;
+
+ assert(l);
+ assert(p);
+
+- if (l->engine->n_dns_servers <= 0)
++ e = l->engine;
++ assert(e);
++
++ s = e->server;
++ assert(s);
++
++ if (e->n_dns_servers <= 0)
+ return -1;
+
+- assert(l->engine->current_dns_server < l->engine->n_dns_servers);
++ assert(e->current_dns_server < e->n_dns_servers);
+
+- a = &l->engine->dns_servers[l->engine->current_dns_server];
++ a = &e->dns_servers[e->current_dns_server];
+ l->dns_server_used = *a;
+
+- if (a->proto == AVAHI_PROTO_INET) {
++ if (l->fd >= 0) {
++ /* We are reusing lookup object and sending packet to another server so let's cleanup before we establish connection to new server. */
++ s->poll_api->watch_free(l->watch);
++ l->watch = NULL;
+
+- if (l->engine->fd_ipv4 < 0)
+- return -1;
++ close(l->fd);
++ l->fd = -EBADF;
++ }
+
+- return avahi_send_dns_packet_ipv4(l->engine->fd_ipv4, AVAHI_IF_UNSPEC, p, NULL, &a->data.ipv4, AVAHI_DNS_PORT);
++ assert(a->proto == AVAHI_PROTO_INET || a->proto == AVAHI_PROTO_INET6);
+
+- } else {
+- assert(a->proto == AVAHI_PROTO_INET6);
++ if (a->proto == AVAHI_PROTO_INET)
++ r = s->config.use_ipv4 ? avahi_open_unicast_socket_ipv4() : -1;
++ else
++ r = s->config.use_ipv6 ? avahi_open_unicast_socket_ipv6() : -1;
+
+- if (l->engine->fd_ipv6 < 0)
+- return -1;
++ if (r < 0) {
++ avahi_log_error(__FILE__ ": Failed to create socket for wide area lookup");
++ return -1;
++ }
+
+- return avahi_send_dns_packet_ipv6(l->engine->fd_ipv6, AVAHI_IF_UNSPEC, p, NULL, &a->data.ipv6, AVAHI_DNS_PORT);
++ w = s->poll_api->watch_new(s->poll_api, r, AVAHI_WATCH_IN, socket_event, l);
++ if (!w) {
++ close(r);
++ avahi_log_error(__FILE__ ": Failed to create socket watch for wide area lookup");
++ return -1;
+ }
++
++ l->fd = r;
++ l->watch = w;
++ l->proto = a->proto;
++
++ return a->proto == AVAHI_PROTO_INET ?
++ avahi_send_dns_packet_ipv4(l->fd, AVAHI_IF_UNSPEC, p, NULL, &a->data.ipv4, AVAHI_DNS_PORT):
++ avahi_send_dns_packet_ipv6(l->fd, AVAHI_IF_UNSPEC, p, NULL, &a->data.ipv6, AVAHI_DNS_PORT);
+ }
+
+ static void next_dns_server(AvahiWideAreaLookupEngine *e) {
+@@ -246,6 +279,9 @@ AvahiWideAreaLookup *avahi_wide_area_lookup_new(
+ l->dead = 0;
+ l->key = avahi_key_ref(key);
+ l->cname_key = avahi_key_new_cname(l->key);
++ l->fd = -EBADF;
++ l->watch = NULL;
++ l->proto = AVAHI_PROTO_UNSPEC;
+ l->callback = callback;
+ l->userdata = userdata;
+
+@@ -314,6 +350,12 @@ static void lookup_destroy(AvahiWideAreaLookup *l) {
+ if (l->cname_key)
+ avahi_key_unref(l->cname_key);
+
++ if (l->watch)
++ l->engine->server->poll_api->watch_free(l->watch);
++
++ if (l->fd >= 0)
++ close(l->fd);
++
+ avahi_free(l);
+ }
+
+@@ -572,14 +614,20 @@ static void handle_packet(AvahiWideAreaLookupEngine *e, AvahiDnsPacket *p) {
+ }
+
+ static void socket_event(AVAHI_GCC_UNUSED AvahiWatch *w, int fd, AVAHI_GCC_UNUSED AvahiWatchEvent events, void *userdata) {
+- AvahiWideAreaLookupEngine *e = userdata;
++ AvahiWideAreaLookup *l = userdata;
++ AvahiWideAreaLookupEngine *e = l->engine;
+ AvahiDnsPacket *p = NULL;
+
+- if (fd == e->fd_ipv4)
+- p = avahi_recv_dns_packet_ipv4(e->fd_ipv4, NULL, NULL, NULL, NULL, NULL);
++ assert(l);
++ assert(e);
++ assert(l->fd == fd);
++
++ if (l->proto == AVAHI_PROTO_INET)
++ p = avahi_recv_dns_packet_ipv4(l->fd, NULL, NULL, NULL, NULL, NULL);
+ else {
+- assert(fd == e->fd_ipv6);
+- p = avahi_recv_dns_packet_ipv6(e->fd_ipv6, NULL, NULL, NULL, NULL, NULL);
++ assert(l->proto == AVAHI_PROTO_INET6);
++
++ p = avahi_recv_dns_packet_ipv6(l->fd, NULL, NULL, NULL, NULL, NULL);
+ }
+
+ if (p) {
+@@ -598,32 +646,6 @@ AvahiWideAreaLookupEngine *avahi_wide_area_engine_new(AvahiServer *s) {
+ e->server = s;
+ e->cleanup_dead = 0;
+
+- /* Create sockets */
+- e->fd_ipv4 = s->config.use_ipv4 ? avahi_open_unicast_socket_ipv4() : -1;
+- e->fd_ipv6 = s->config.use_ipv6 ? avahi_open_unicast_socket_ipv6() : -1;
+-
+- if (e->fd_ipv4 < 0 && e->fd_ipv6 < 0) {
+- avahi_log_error(__FILE__": Failed to create wide area sockets: %s", strerror(errno));
+-
+- if (e->fd_ipv6 >= 0)
+- close(e->fd_ipv6);
+-
+- if (e->fd_ipv4 >= 0)
+- close(e->fd_ipv4);
+-
+- avahi_free(e);
+- return NULL;
+- }
+-
+- /* Create watches */
+-
+- e->watch_ipv4 = e->watch_ipv6 = NULL;
+-
+- if (e->fd_ipv4 >= 0)
+- e->watch_ipv4 = s->poll_api->watch_new(e->server->poll_api, e->fd_ipv4, AVAHI_WATCH_IN, socket_event, e);
+- if (e->fd_ipv6 >= 0)
+- e->watch_ipv6 = s->poll_api->watch_new(e->server->poll_api, e->fd_ipv6, AVAHI_WATCH_IN, socket_event, e);
+-
+ e->n_dns_servers = e->current_dns_server = 0;
+
+ /* Initialize cache */
+@@ -651,18 +673,6 @@ void avahi_wide_area_engine_free(AvahiWideAreaLookupEngine *e) {
+ avahi_hashmap_free(e->lookups_by_id);
+ avahi_hashmap_free(e->lookups_by_key);
+
+- if (e->watch_ipv4)
+- e->server->poll_api->watch_free(e->watch_ipv4);
+-
+- if (e->watch_ipv6)
+- e->server->poll_api->watch_free(e->watch_ipv6);
+-
+- if (e->fd_ipv6 >= 0)
+- close(e->fd_ipv6);
+-
+- if (e->fd_ipv4 >= 0)
+- close(e->fd_ipv4);
+-
+ avahi_free(e);
+ }
+
+@@ -680,7 +690,7 @@ void avahi_wide_area_set_servers(AvahiWideAreaLookupEngine *e, const AvahiAddres
+
+ if (a) {
+ for (e->n_dns_servers = 0; n > 0 && e->n_dns_servers < AVAHI_WIDE_AREA_SERVERS_MAX; a++, n--)
+- if ((a->proto == AVAHI_PROTO_INET && e->fd_ipv4 >= 0) || (a->proto == AVAHI_PROTO_INET6 && e->fd_ipv6 >= 0))
++ if (a->proto == AVAHI_PROTO_INET || a->proto == AVAHI_PROTO_INET6)
+ e->dns_servers[e->n_dns_servers++] = *a;
+ } else {
+ assert(n == 0);
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [OE-core][scarthgap 2/9] python3: patch CVE-2025-8194
2025-08-15 16:44 [OE-core][scarthgap 0/9] Patch review Steve Sakoman
2025-08-15 16:44 ` [OE-core][scarthgap 1/9] avahi: fix CVE-2024-52615 Steve Sakoman
@ 2025-08-15 16:44 ` Steve Sakoman
2025-08-15 16:44 ` [OE-core][scarthgap 3/9] go: ignore CVE-2025-0913 Steve Sakoman
` (6 subsequent siblings)
8 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-08-15 16:44 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick commit from 3.12 branch mentioned in NVD report.
https://nvd.nist.gov/vuln/detail/CVE-2025-8194
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../python/python3/CVE-2025-8194.patch | 219 ++++++++++++++++++
.../python/python3_3.12.11.bb | 9 +-
2 files changed, 224 insertions(+), 4 deletions(-)
create mode 100644 meta/recipes-devtools/python/python3/CVE-2025-8194.patch
diff --git a/meta/recipes-devtools/python/python3/CVE-2025-8194.patch b/meta/recipes-devtools/python/python3/CVE-2025-8194.patch
new file mode 100644
index 0000000000..b8243a67f6
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/CVE-2025-8194.patch
@@ -0,0 +1,219 @@
+From c9d9f78feb1467e73fd29356c040bde1c104f29f Mon Sep 17 00:00:00 2001
+From: "Miss Islington (bot)"
+ <31488909+miss-islington@users.noreply.github.com>
+Date: Mon, 4 Aug 2025 13:45:06 +0200
+Subject: [PATCH] [3.12] gh-130577: tarfile now validates archives to ensure
+ member offsets are non-negative (GH-137027) (#137171)
+
+(cherry picked from commit 7040aa54f14676938970e10c5f74ea93cd56aa38)
+
+Co-authored-by: Alexander Urieles <aeurielesn@users.noreply.github.com>
+Co-authored-by: Gregory P. Smith <greg@krypto.org>
+
+CVE: CVE-2025-8194
+Upstream-Status: Backport [https://github.com/python/cpython/commit/c9d9f78feb1467e73fd29356c040bde1c104f29f]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ Lib/tarfile.py | 3 +
+ Lib/test/test_tarfile.py | 156 ++++++++++++++++++
+ ...-07-23-00-35-29.gh-issue-130577.c7EITy.rst | 3 +
+ 3 files changed, 162 insertions(+)
+ create mode 100644 Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst
+
+diff --git a/Lib/tarfile.py b/Lib/tarfile.py
+index 9999a99d54..59d3f6e5cc 100755
+--- a/Lib/tarfile.py
++++ b/Lib/tarfile.py
+@@ -1615,6 +1615,9 @@ class TarInfo(object):
+ """Round up a byte count by BLOCKSIZE and return it,
+ e.g. _block(834) => 1024.
+ """
++ # Only non-negative offsets are allowed
++ if count < 0:
++ raise InvalidHeaderError("invalid offset")
+ blocks, remainder = divmod(count, BLOCKSIZE)
+ if remainder:
+ blocks += 1
+diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
+index a184ba75a8..759fa03ead 100644
+--- a/Lib/test/test_tarfile.py
++++ b/Lib/test/test_tarfile.py
+@@ -50,6 +50,7 @@ bz2name = os.path.join(TEMPDIR, "testtar.tar.bz2")
+ xzname = os.path.join(TEMPDIR, "testtar.tar.xz")
+ tmpname = os.path.join(TEMPDIR, "tmp.tar")
+ dotlessname = os.path.join(TEMPDIR, "testtar")
++SPACE = b" "
+
+ sha256_regtype = (
+ "e09e4bc8b3c9d9177e77256353b36c159f5f040531bbd4b024a8f9b9196c71ce"
+@@ -4488,6 +4489,161 @@ class OverwriteTests(archiver_tests.OverwriteTests, unittest.TestCase):
+ ar.extractall(self.testdir, filter='fully_trusted')
+
+
++class OffsetValidationTests(unittest.TestCase):
++ tarname = tmpname
++ invalid_posix_header = (
++ # name: 100 bytes
++ tarfile.NUL * tarfile.LENGTH_NAME
++ # mode, space, null terminator: 8 bytes
++ + b"000755" + SPACE + tarfile.NUL
++ # uid, space, null terminator: 8 bytes
++ + b"000001" + SPACE + tarfile.NUL
++ # gid, space, null terminator: 8 bytes
++ + b"000001" + SPACE + tarfile.NUL
++ # size, space: 12 bytes
++ + b"\xff" * 11 + SPACE
++ # mtime, space: 12 bytes
++ + tarfile.NUL * 11 + SPACE
++ # chksum: 8 bytes
++ + b"0011407" + tarfile.NUL
++ # type: 1 byte
++ + tarfile.REGTYPE
++ # linkname: 100 bytes
++ + tarfile.NUL * tarfile.LENGTH_LINK
++ # magic: 6 bytes, version: 2 bytes
++ + tarfile.POSIX_MAGIC
++ # uname: 32 bytes
++ + tarfile.NUL * 32
++ # gname: 32 bytes
++ + tarfile.NUL * 32
++ # devmajor, space, null terminator: 8 bytes
++ + tarfile.NUL * 6 + SPACE + tarfile.NUL
++ # devminor, space, null terminator: 8 bytes
++ + tarfile.NUL * 6 + SPACE + tarfile.NUL
++ # prefix: 155 bytes
++ + tarfile.NUL * tarfile.LENGTH_PREFIX
++ # padding: 12 bytes
++ + tarfile.NUL * 12
++ )
++ invalid_gnu_header = (
++ # name: 100 bytes
++ tarfile.NUL * tarfile.LENGTH_NAME
++ # mode, null terminator: 8 bytes
++ + b"0000755" + tarfile.NUL
++ # uid, null terminator: 8 bytes
++ + b"0000001" + tarfile.NUL
++ # gid, space, null terminator: 8 bytes
++ + b"0000001" + tarfile.NUL
++ # size, space: 12 bytes
++ + b"\xff" * 11 + SPACE
++ # mtime, space: 12 bytes
++ + tarfile.NUL * 11 + SPACE
++ # chksum: 8 bytes
++ + b"0011327" + tarfile.NUL
++ # type: 1 byte
++ + tarfile.REGTYPE
++ # linkname: 100 bytes
++ + tarfile.NUL * tarfile.LENGTH_LINK
++ # magic: 8 bytes
++ + tarfile.GNU_MAGIC
++ # uname: 32 bytes
++ + tarfile.NUL * 32
++ # gname: 32 bytes
++ + tarfile.NUL * 32
++ # devmajor, null terminator: 8 bytes
++ + tarfile.NUL * 8
++ # devminor, null terminator: 8 bytes
++ + tarfile.NUL * 8
++ # padding: 167 bytes
++ + tarfile.NUL * 167
++ )
++ invalid_v7_header = (
++ # name: 100 bytes
++ tarfile.NUL * tarfile.LENGTH_NAME
++ # mode, space, null terminator: 8 bytes
++ + b"000755" + SPACE + tarfile.NUL
++ # uid, space, null terminator: 8 bytes
++ + b"000001" + SPACE + tarfile.NUL
++ # gid, space, null terminator: 8 bytes
++ + b"000001" + SPACE + tarfile.NUL
++ # size, space: 12 bytes
++ + b"\xff" * 11 + SPACE
++ # mtime, space: 12 bytes
++ + tarfile.NUL * 11 + SPACE
++ # chksum: 8 bytes
++ + b"0010070" + tarfile.NUL
++ # type: 1 byte
++ + tarfile.REGTYPE
++ # linkname: 100 bytes
++ + tarfile.NUL * tarfile.LENGTH_LINK
++ # padding: 255 bytes
++ + tarfile.NUL * 255
++ )
++ valid_gnu_header = tarfile.TarInfo("filename").tobuf(tarfile.GNU_FORMAT)
++ data_block = b"\xff" * tarfile.BLOCKSIZE
++
++ def _write_buffer(self, buffer):
++ with open(self.tarname, "wb") as f:
++ f.write(buffer)
++
++ def _get_members(self, ignore_zeros=None):
++ with open(self.tarname, "rb") as f:
++ with tarfile.open(
++ mode="r", fileobj=f, ignore_zeros=ignore_zeros
++ ) as tar:
++ return tar.getmembers()
++
++ def _assert_raises_read_error_exception(self):
++ with self.assertRaisesRegex(
++ tarfile.ReadError, "file could not be opened successfully"
++ ):
++ self._get_members()
++
++ def test_invalid_offset_header_validations(self):
++ for tar_format, invalid_header in (
++ ("posix", self.invalid_posix_header),
++ ("gnu", self.invalid_gnu_header),
++ ("v7", self.invalid_v7_header),
++ ):
++ with self.subTest(format=tar_format):
++ self._write_buffer(invalid_header)
++ self._assert_raises_read_error_exception()
++
++ def test_early_stop_at_invalid_offset_header(self):
++ buffer = self.valid_gnu_header + self.invalid_gnu_header + self.valid_gnu_header
++ self._write_buffer(buffer)
++ members = self._get_members()
++ self.assertEqual(len(members), 1)
++ self.assertEqual(members[0].name, "filename")
++ self.assertEqual(members[0].offset, 0)
++
++ def test_ignore_invalid_archive(self):
++ # 3 invalid headers with their respective data
++ buffer = (self.invalid_gnu_header + self.data_block) * 3
++ self._write_buffer(buffer)
++ members = self._get_members(ignore_zeros=True)
++ self.assertEqual(len(members), 0)
++
++ def test_ignore_invalid_offset_headers(self):
++ for first_block, second_block, expected_offset in (
++ (
++ (self.valid_gnu_header),
++ (self.invalid_gnu_header + self.data_block),
++ 0,
++ ),
++ (
++ (self.invalid_gnu_header + self.data_block),
++ (self.valid_gnu_header),
++ 1024,
++ ),
++ ):
++ self._write_buffer(first_block + second_block)
++ members = self._get_members(ignore_zeros=True)
++ self.assertEqual(len(members), 1)
++ self.assertEqual(members[0].name, "filename")
++ self.assertEqual(members[0].offset, expected_offset)
++
++
+ def setUpModule():
+ os_helper.unlink(TEMPDIR)
+ os.makedirs(TEMPDIR)
+diff --git a/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst b/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst
+new file mode 100644
+index 0000000000..342cabbc86
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst
+@@ -0,0 +1,3 @@
++:mod:`tarfile` now validates archives to ensure member offsets are
++non-negative. (Contributed by Alexander Enrique Urieles Nieto in
++:gh:`130577`.)
diff --git a/meta/recipes-devtools/python/python3_3.12.11.bb b/meta/recipes-devtools/python/python3_3.12.11.bb
index 84c4f74158..1c31077320 100644
--- a/meta/recipes-devtools/python/python3_3.12.11.bb
+++ b/meta/recipes-devtools/python/python3_3.12.11.bb
@@ -34,6 +34,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
file://0001-test_deadlock-skip-problematic-test.patch \
file://0001-test_active_children-skip-problematic-test.patch \
file://0001-test_readline-skip-limited-history-test.patch \
+ file://CVE-2025-8194.patch \
"
SRC_URI:append:class-native = " \
@@ -184,14 +185,14 @@ do_install:append:class-native() {
# when they're only used for python called with -O or -OO.
#find ${D} -name *opt-*.pyc -delete
# Remove all pyc files. There are a ton of them and it is probably faster to let
- # python create the ones it wants at runtime rather than manage in the sstate
+ # python create the ones it wants at runtime rather than manage in the sstate
# tarballs and sysroot creation.
find ${D} -name *.pyc -delete
# Nothing should be looking into ${B} for python3-native
sed -i -e 's:${B}:/build/path/unavailable/:g' \
${D}/${libdir}/python${PYTHON_MAJMIN}/config-${PYTHON_MAJMIN}${PYTHON_ABI}*/Makefile
-
+
# disable the lookup in user's site-packages globally
sed -i 's#ENABLE_USER_SITE = None#ENABLE_USER_SITE = False#' ${D}${libdir}/python${PYTHON_MAJMIN}/site.py
@@ -226,7 +227,7 @@ do_install:append() {
rm -f ${D}${libdir}/python${PYTHON_MAJMIN}/test/__pycache__/test_range.cpython*
rm -f ${D}${libdir}/python${PYTHON_MAJMIN}/test/__pycache__/test_xml_etree.cpython*
- # Similar to the above, we're getting reproducibility issues with
+ # Similar to the above, we're getting reproducibility issues with
# /usr/lib/python3.10/__pycache__/traceback.cpython-310.pyc
# so remove it too
rm -f ${D}${libdir}/python${PYTHON_MAJMIN}/__pycache__/traceback.cpython*
@@ -303,7 +304,7 @@ py_package_preprocess () {
cd -
mv ${PKGD}/${bindir}/python${PYTHON_MAJMIN}-config ${PKGD}/${bindir}/python${PYTHON_MAJMIN}-config-${MULTILIB_SUFFIX}
-
+
#Remove the unneeded copy of target sysconfig data
rm -rf ${PKGD}/${libdir}/python-sysconfigdata
}
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [OE-core][scarthgap 3/9] go: ignore CVE-2025-0913
2025-08-15 16:44 [OE-core][scarthgap 0/9] Patch review Steve Sakoman
2025-08-15 16:44 ` [OE-core][scarthgap 1/9] avahi: fix CVE-2024-52615 Steve Sakoman
2025-08-15 16:44 ` [OE-core][scarthgap 2/9] python3: patch CVE-2025-8194 Steve Sakoman
@ 2025-08-15 16:44 ` Steve Sakoman
2025-08-15 16:44 ` [OE-core][scarthgap 4/9] gstreamer1.0-plugins-base: fix CVE-2025-47808 Steve Sakoman
` (5 subsequent siblings)
8 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-08-15 16:44 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
This is problem on Windows platform only.
Per NVD report [1], CPE has "and" clause
Running on/with
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Also linked patch [2] changes Windows files only (and tests).
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-0913
[2] https://go-review.googlesource.com/c/go/+/672396
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/go/go-1.22.12.inc | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc
index af09cb52cd..ea57b23c3e 100644
--- a/meta/recipes-devtools/go/go-1.22.12.inc
+++ b/meta/recipes-devtools/go/go-1.22.12.inc
@@ -19,3 +19,5 @@ SRC_URI += "\
file://CVE-2025-4673.patch \
"
SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71"
+
+CVE_STATUS[CVE-2025-0913] = "not-applicable-platform: Issue only applies on Windows"
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [OE-core][scarthgap 4/9] gstreamer1.0-plugins-base: fix CVE-2025-47808
2025-08-15 16:44 [OE-core][scarthgap 0/9] Patch review Steve Sakoman
` (2 preceding siblings ...)
2025-08-15 16:44 ` [OE-core][scarthgap 3/9] go: ignore CVE-2025-0913 Steve Sakoman
@ 2025-08-15 16:44 ` Steve Sakoman
2025-08-15 16:44 ` [OE-core][scarthgap 5/9] gstreamer1.0-plugins-base: fix CVE-2025-47806 Steve Sakoman
` (4 subsequent siblings)
8 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-08-15 16:44 UTC (permalink / raw)
To: openembedded-core
From: Hitendra Prajapati <hprajapati@mvista.com>
Upstream-Status: Backport from https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/6b19f117518a765a25c99d1c4b09f2838a8ed0c9
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../CVE-2025-47808.patch | 36 +++++++++++++++++++
.../gstreamer1.0-plugins-base_1.22.12.bb | 1 +
2 files changed, 37 insertions(+)
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2025-47808.patch
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2025-47808.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2025-47808.patch
new file mode 100644
index 0000000000..5b9fefc321
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2025-47808.patch
@@ -0,0 +1,36 @@
+From 6b19f117518a765a25c99d1c4b09f2838a8ed0c9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Thu, 8 May 2025 09:04:52 +0300
+Subject: [PATCH] tmplayer: Don't append NULL + 1 to the string buffer when
+ parsing lines without text
+
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4417
+Fixes CVE-2025-47808
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9132>
+
+CVE: CVE-2025-47808
+Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/6b19f117518a765a25c99d1c4b09f2838a8ed0c9]
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ gst/subparse/tmplayerparse.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/gst/subparse/tmplayerparse.c b/gst/subparse/tmplayerparse.c
+index 807e332..a9225d3 100644
+--- a/gst/subparse/tmplayerparse.c
++++ b/gst/subparse/tmplayerparse.c
+@@ -125,7 +125,9 @@ tmplayer_parse_line (ParserState * state, const gchar * line, guint line_num)
+ * durations from the start times anyway, so as long as the parser just
+ * forwards state->start_time by duration after it pushes the line we
+ * are about to return it will all be good. */
+- g_string_append (state->buf, text_start + 1);
++ if (text_start) {
++ g_string_append (state->buf, text_start + 1);
++ }
+ } else if (line_num > 0) {
+ GST_WARNING ("end of subtitle unit but no valid start time?!");
+ }
+--
+2.50.1
+
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.22.12.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.22.12.bb
index 05cb956815..44ecdc0b55 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.22.12.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.22.12.bb
@@ -19,6 +19,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-ba
file://0010-id3v2-Don-t-try-parsing-extended-header-if-not-enoug.patch \
file://0011-discoverer-Don-t-print-channel-layout-for-more-than-.patch \
file://0012-subparse-Check-for-NULL-return-of-strchr-when-parsin.patch \
+ file://CVE-2025-47808.patch \
"
SRC_URI[sha256sum] = "73cfadc3a6ffe77ed974cfd6fb391c605e4531f48db21dd6b9f42b8cb69bd8c1"
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [OE-core][scarthgap 5/9] gstreamer1.0-plugins-base: fix CVE-2025-47806
2025-08-15 16:44 [OE-core][scarthgap 0/9] Patch review Steve Sakoman
` (3 preceding siblings ...)
2025-08-15 16:44 ` [OE-core][scarthgap 4/9] gstreamer1.0-plugins-base: fix CVE-2025-47808 Steve Sakoman
@ 2025-08-15 16:44 ` Steve Sakoman
2025-08-15 16:44 ` [OE-core][scarthgap 6/9] gstreamer1.0-plugins-good: fix multiple CVEs Steve Sakoman
` (3 subsequent siblings)
8 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-08-15 16:44 UTC (permalink / raw)
To: openembedded-core
From: Hitendra Prajapati <hprajapati@mvista.com>
Upstream-Status: Backport from https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/da4380c4df0e00f8d0bad569927bfc7ea35ec37d
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../CVE-2025-47806.patch | 50 +++++++++++++++++++
.../gstreamer1.0-plugins-base_1.22.12.bb | 1 +
2 files changed, 51 insertions(+)
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2025-47806.patch
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2025-47806.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2025-47806.patch
new file mode 100644
index 0000000000..632a5fb38e
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2025-47806.patch
@@ -0,0 +1,50 @@
+From da4380c4df0e00f8d0bad569927bfc7ea35ec37d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Thu, 8 May 2025 12:46:40 +0300
+Subject: [PATCH] subparse: Make sure that subrip time string is not too long
+ before zero-padding
+
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4419
+Fixes CVE-2025-47806
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9135>
+
+CVE: CVE-2025-47806
+Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/da4380c4df0e00f8d0bad569927bfc7ea35ec37d]
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ gst/subparse/gstsubparse.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/gst/subparse/gstsubparse.c b/gst/subparse/gstsubparse.c
+index 4ea4ec6..035068d 100644
+--- a/gst/subparse/gstsubparse.c
++++ b/gst/subparse/gstsubparse.c
+@@ -850,7 +850,7 @@ parse_subrip_time (const gchar * ts_string, GstClockTime * t)
+ g_strdelimit (s, " ", '0');
+ g_strdelimit (s, ".", ',');
+
+- /* make sure we have exactly three digits after he comma */
++ /* make sure we have exactly three digits after the comma */
+ p = strchr (s, ',');
+ if (p == NULL) {
+ /* If there isn't a ',' the timestamp is broken */
+@@ -859,6 +859,15 @@ parse_subrip_time (const gchar * ts_string, GstClockTime * t)
+ return FALSE;
+ }
+
++ /* Check if the comma is too far into the string to avoid
++ * stack overflow when zero-padding the sub-second part.
++ *
++ * Allow for 3 digits of hours just in case. */
++ if ((p - s) > sizeof ("hhh:mm:ss,")) {
++ GST_WARNING ("failed to parse subrip timestamp string '%s'", s);
++ return FALSE;
++ }
++
+ ++p;
+ len = strlen (p);
+ if (len > 3) {
+--
+2.50.1
+
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.22.12.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.22.12.bb
index 44ecdc0b55..bfc6bb65ef 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.22.12.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.22.12.bb
@@ -20,6 +20,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-ba
file://0011-discoverer-Don-t-print-channel-layout-for-more-than-.patch \
file://0012-subparse-Check-for-NULL-return-of-strchr-when-parsin.patch \
file://CVE-2025-47808.patch \
+ file://CVE-2025-47806.patch \
"
SRC_URI[sha256sum] = "73cfadc3a6ffe77ed974cfd6fb391c605e4531f48db21dd6b9f42b8cb69bd8c1"
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [OE-core][scarthgap 6/9] gstreamer1.0-plugins-good: fix multiple CVEs
2025-08-15 16:44 [OE-core][scarthgap 0/9] Patch review Steve Sakoman
` (4 preceding siblings ...)
2025-08-15 16:44 ` [OE-core][scarthgap 5/9] gstreamer1.0-plugins-base: fix CVE-2025-47806 Steve Sakoman
@ 2025-08-15 16:44 ` Steve Sakoman
2025-08-15 16:44 ` [OE-core][scarthgap 7/9] libpam: re-add missing libgen include Steve Sakoman
` (2 subsequent siblings)
8 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-08-15 16:44 UTC (permalink / raw)
To: openembedded-core
From: Hitendra Prajapati <hprajapati@mvista.com>
* CVE-2025-47183 - Upstream-Status: Backport from https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/c4d0f4bbd9a8e97f119a4528b9f4662a6b80922c && https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/d76cae74dad89994bfcdad83da6ef1ad69074332
* CVE-2025-47219 - Upstream-Status: Backport from https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/b80803943388050cb870c95934fc52feeffb94ac
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../CVE-2025-47183-001.patch | 151 ++++++++++++++++++
.../CVE-2025-47183-002.patch | 80 ++++++++++
.../CVE-2025-47219.patch | 40 +++++
.../gstreamer1.0-plugins-good_1.22.12.bb | 3 +
4 files changed, 274 insertions(+)
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/CVE-2025-47183-001.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/CVE-2025-47183-002.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/CVE-2025-47219.patch
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/CVE-2025-47183-001.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/CVE-2025-47183-001.patch
new file mode 100644
index 0000000000..bd25c5f1ed
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/CVE-2025-47183-001.patch
@@ -0,0 +1,151 @@
+From c4d0f4bbd9a8e97f119a4528b9f4662a6b80922c Mon Sep 17 00:00:00 2001
+From: Jochen Henneberg <jochen@centricular.com>
+Date: Tue, 10 Dec 2024 21:34:48 +0100
+Subject: [PATCH] qtdemux: Use mvhd transform matrix and support for flipping
+
+The mvhd matrix is now combined with the tkhd matrix. The combined
+matrix is then checked if it matches one of the standard values for
+GST_TAG_IMAGE_ORIENTATION.
+This check now includes matrices with flipping.
+
+Fixes #4064
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8127>
+
+CVE: CVE-2025-47183
+Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/c4d0f4bbd9a8e97f119a4528b9f4662a6b80922c]
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ gst/isomp4/qtdemux.c | 53 ++++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 49 insertions(+), 4 deletions(-)
+
+diff --git a/gst/isomp4/qtdemux.c b/gst/isomp4/qtdemux.c
+index 10b21a6..e708ef4 100644
+--- a/gst/isomp4/qtdemux.c
++++ b/gst/isomp4/qtdemux.c
+@@ -10861,6 +10861,23 @@ qtdemux_parse_transformation_matrix (GstQTDemux * qtdemux,
+ return TRUE;
+ }
+
++static void
++qtdemux_mul_transformation_matrix (GstQTDemux * qtdemux,
++ guint32 * a, guint32 * b, guint32 * c)
++{
++#define QTMUL_MATRIX(_a,_b) (((_a) == 0 || (_b) == 0) ? 0 : \
++ ((_a) == (_b) ? 1 : -1))
++#define QTADD_MATRIX(_a,_b) ((_a) + (_b) > 0 ? (1U << 16) : \
++ ((_a) + (_b) < 0) ? (G_MAXUINT16 << 16) : 0u)
++
++ c[2] = c[5] = c[6] = c[7] = 0;
++ c[0] = QTADD_MATRIX (QTMUL_MATRIX (a[0], b[0]), QTMUL_MATRIX (a[1], b[3]));
++ c[1] = QTADD_MATRIX (QTMUL_MATRIX (a[0], b[1]), QTMUL_MATRIX (a[1], b[4]));
++ c[3] = QTADD_MATRIX (QTMUL_MATRIX (a[3], b[0]), QTMUL_MATRIX (a[4], b[3]));
++ c[4] = QTADD_MATRIX (QTMUL_MATRIX (a[3], b[1]), QTMUL_MATRIX (a[4], b[4]));
++ c[8] = a[8];
++}
++
+ static void
+ qtdemux_inspect_transformation_matrix (GstQTDemux * qtdemux,
+ QtDemuxStream * stream, guint32 * matrix, GstTagList ** taglist)
+@@ -10889,6 +10906,14 @@ qtdemux_inspect_transformation_matrix (GstQTDemux * qtdemux,
+ rotation_tag = "rotate-180";
+ } else if (QTCHECK_MATRIX (matrix, 0, G_MAXUINT16, 1, 0)) {
+ rotation_tag = "rotate-270";
++ } else if (QTCHECK_MATRIX (matrix, G_MAXUINT16, 0, 0, 1)) {
++ rotation_tag = "flip-rotate-0";
++ } else if (QTCHECK_MATRIX (matrix, 0, G_MAXUINT16, 1, 0)) {
++ rotation_tag = "flip-rotate-90";
++ } else if (QTCHECK_MATRIX (matrix, 1, 0, 0, G_MAXUINT16)) {
++ rotation_tag = "flip-rotate-180";
++ } else if (QTCHECK_MATRIX (matrix, 0, 1, 1, 0)) {
++ rotation_tag = "flip-rotate-270";
+ } else {
+ GST_FIXME_OBJECT (qtdemux, "Unhandled transformation matrix values");
+ }
+@@ -11175,7 +11200,7 @@ qtdemux_parse_stereo_svmi_atom (GstQTDemux * qtdemux, QtDemuxStream * stream,
+ * traks that do not decode to something (like strm traks) will not have a pad.
+ */
+ static gboolean
+-qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
++qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak, guint32 * mvhd_matrix)
+ {
+ GstByteReader tkhd;
+ int offset;
+@@ -11347,15 +11372,21 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+
+ /* parse rest of tkhd */
+ if (stream->subtype == FOURCC_vide) {
++ guint32 tkhd_matrix[9];
+ guint32 matrix[9];
+
+ /* version 1 uses some 64-bit ints */
+ if (!gst_byte_reader_skip (&tkhd, 20 + value_size))
+ goto corrupt_file;
+
+- if (!qtdemux_parse_transformation_matrix (qtdemux, &tkhd, matrix, "tkhd"))
++ if (!qtdemux_parse_transformation_matrix (qtdemux, &tkhd, tkhd_matrix,
++ "tkhd"))
+ goto corrupt_file;
+
++ /* calculate the final matrix from the mvhd_matrix and the tkhd matrix */
++ qtdemux_mul_transformation_matrix (qtdemux, mvhd_matrix, tkhd_matrix,
++ matrix);
++
+ if (!gst_byte_reader_get_uint32_be (&tkhd, &w)
+ || !gst_byte_reader_get_uint32_be (&tkhd, &h))
+ goto corrupt_file;
+@@ -14198,11 +14229,14 @@ qtdemux_parse_tree (GstQTDemux * qtdemux)
+ guint64 creation_time;
+ GstDateTime *datetime = NULL;
+ gint version;
++ GstByteReader mvhd_reader;
++ guint32 matrix[9];
+
+ /* make sure we have a usable taglist */
+ qtdemux->tag_list = gst_tag_list_make_writable (qtdemux->tag_list);
+
+- mvhd = qtdemux_tree_get_child_by_type (qtdemux->moov_node, FOURCC_mvhd);
++ mvhd = qtdemux_tree_get_child_by_type_full (qtdemux->moov_node,
++ FOURCC_mvhd, &mvhd_reader);
+ if (mvhd == NULL) {
+ GST_LOG_OBJECT (qtdemux, "No mvhd node found, looking for redirects.");
+ return qtdemux_parse_redirects (qtdemux);
+@@ -14213,15 +14247,26 @@ qtdemux_parse_tree (GstQTDemux * qtdemux)
+ creation_time = QT_UINT64 ((guint8 *) mvhd->data + 12);
+ qtdemux->timescale = QT_UINT32 ((guint8 *) mvhd->data + 28);
+ qtdemux->duration = QT_UINT64 ((guint8 *) mvhd->data + 32);
++ if (!gst_byte_reader_skip (&mvhd_reader, 4 + 8 + 8 + 4 + 8))
++ return FALSE;
+ } else if (version == 0) {
+ creation_time = QT_UINT32 ((guint8 *) mvhd->data + 12);
+ qtdemux->timescale = QT_UINT32 ((guint8 *) mvhd->data + 20);
+ qtdemux->duration = QT_UINT32 ((guint8 *) mvhd->data + 24);
++ if (!gst_byte_reader_skip (&mvhd_reader, 4 + 4 + 4 + 4 + 4))
++ return FALSE;
+ } else {
+ GST_WARNING_OBJECT (qtdemux, "Unhandled mvhd version %d", version);
+ return FALSE;
+ }
+
++ if (!gst_byte_reader_skip (&mvhd_reader, 4 + 2 + 2 + 2 * 4))
++ return FALSE;
++
++ if (!qtdemux_parse_transformation_matrix (qtdemux, &mvhd_reader, matrix,
++ "mvhd"))
++ return FALSE;
++
+ /* Moving qt creation time (secs since 1904) to unix time */
+ if (creation_time != 0) {
+ /* Try to use epoch first as it should be faster and more commonly found */
+@@ -14290,7 +14335,7 @@ qtdemux_parse_tree (GstQTDemux * qtdemux)
+ /* parse all traks */
+ trak = qtdemux_tree_get_child_by_type (qtdemux->moov_node, FOURCC_trak);
+ while (trak) {
+- qtdemux_parse_trak (qtdemux, trak);
++ qtdemux_parse_trak (qtdemux, trak, matrix);
+ /* iterate all siblings */
+ trak = qtdemux_tree_get_sibling_by_type (trak, FOURCC_trak);
+ }
+--
+2.50.1
+
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/CVE-2025-47183-002.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/CVE-2025-47183-002.patch
new file mode 100644
index 0000000000..77127dd466
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/CVE-2025-47183-002.patch
@@ -0,0 +1,80 @@
+From d76cae74dad89994bfcdad83da6ef1ad69074332 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Tue, 29 Apr 2025 09:43:58 +0300
+Subject: [PATCH] qtdemux: Use byte reader to parse mvhd box
+
+This avoids OOB reads.
+
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4394
+Fixes CVE-2025-47183
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9133>
+
+CVE: CVE-2025-47183
+Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/d76cae74dad89994bfcdad83da6ef1ad69074332]
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ gst/isomp4/qtdemux.c | 36 ++++++++++++++++++++++++++----------
+ 1 file changed, 26 insertions(+), 10 deletions(-)
+
+diff --git a/gst/isomp4/qtdemux.c b/gst/isomp4/qtdemux.c
+index e708ef4..0d29869 100644
+--- a/gst/isomp4/qtdemux.c
++++ b/gst/isomp4/qtdemux.c
+@@ -14228,7 +14228,7 @@ qtdemux_parse_tree (GstQTDemux * qtdemux)
+ GNode *pssh;
+ guint64 creation_time;
+ GstDateTime *datetime = NULL;
+- gint version;
++ guint8 version;
+ GstByteReader mvhd_reader;
+ guint32 matrix[9];
+
+@@ -14242,19 +14242,35 @@ qtdemux_parse_tree (GstQTDemux * qtdemux)
+ return qtdemux_parse_redirects (qtdemux);
+ }
+
+- version = QT_UINT8 ((guint8 *) mvhd->data + 8);
++ if (!gst_byte_reader_get_uint8 (&mvhd_reader, &version))
++ return FALSE;
++ /* flags */
++ if (!gst_byte_reader_skip (&mvhd_reader, 3))
++ return FALSE;
+ if (version == 1) {
+- creation_time = QT_UINT64 ((guint8 *) mvhd->data + 12);
+- qtdemux->timescale = QT_UINT32 ((guint8 *) mvhd->data + 28);
+- qtdemux->duration = QT_UINT64 ((guint8 *) mvhd->data + 32);
+- if (!gst_byte_reader_skip (&mvhd_reader, 4 + 8 + 8 + 4 + 8))
++ if (!gst_byte_reader_get_uint64_be (&mvhd_reader, &creation_time))
++ return FALSE;
++ /* modification time */
++ if (!gst_byte_reader_skip (&mvhd_reader, 8))
++ return FALSE;
++ if (!gst_byte_reader_get_uint32_be (&mvhd_reader, &qtdemux->timescale))
++ return FALSE;
++ if (!gst_byte_reader_get_uint64_be (&mvhd_reader, &qtdemux->duration))
+ return FALSE;
+ } else if (version == 0) {
+- creation_time = QT_UINT32 ((guint8 *) mvhd->data + 12);
+- qtdemux->timescale = QT_UINT32 ((guint8 *) mvhd->data + 20);
+- qtdemux->duration = QT_UINT32 ((guint8 *) mvhd->data + 24);
+- if (!gst_byte_reader_skip (&mvhd_reader, 4 + 4 + 4 + 4 + 4))
++ guint32 tmp;
++
++ if (!gst_byte_reader_get_uint32_be (&mvhd_reader, &tmp))
++ return FALSE;
++ creation_time = tmp;
++ /* modification time */
++ if (!gst_byte_reader_skip (&mvhd_reader, 4))
++ return FALSE;
++ if (!gst_byte_reader_get_uint32_be (&mvhd_reader, &qtdemux->timescale))
++ return FALSE;
++ if (!gst_byte_reader_get_uint32_be (&mvhd_reader, &tmp))
+ return FALSE;
++ qtdemux->duration = tmp;
+ } else {
+ GST_WARNING_OBJECT (qtdemux, "Unhandled mvhd version %d", version);
+ return FALSE;
+--
+2.50.1
+
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/CVE-2025-47219.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/CVE-2025-47219.patch
new file mode 100644
index 0000000000..0d7e02ec1e
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/CVE-2025-47219.patch
@@ -0,0 +1,40 @@
+From b80803943388050cb870c95934fc52feeffb94ac Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Sat, 3 May 2025 09:43:32 +0300
+Subject: [PATCH] qtdemux: Check if enough bytes are available for each stsd
+ entry
+
+There must be at least 8 bytes for the length / fourcc of each entry. After
+reading those, the length is already validated against the remaining available
+bytes.
+
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4407
+Fixes CVE-2025-47219
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9137>
+
+CVE: CVE-2025-47219
+Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/b80803943388050cb870c95934fc52feeffb94ac]
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ gst/isomp4/qtdemux.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/gst/isomp4/qtdemux.c b/gst/isomp4/qtdemux.c
+index 10b21a6..b40aa81 100644
+--- a/gst/isomp4/qtdemux.c
++++ b/gst/isomp4/qtdemux.c
+@@ -11399,6 +11399,10 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+ gchar *codec = NULL;
+ QtDemuxStreamStsdEntry *entry = &stream->stsd_entries[stsd_index];
+
++ /* needs at least length and fourcc */
++ if (remaining_stsd_len < 8)
++ goto corrupt_file;
++
+ /* and that entry should fit within stsd */
+ len = QT_UINT32 (stsd_entry_data);
+ if (len > remaining_stsd_len)
+--
+2.50.1
+
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.22.12.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.22.12.bb
index 608c3030ba..31bc8af015 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.22.12.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.22.12.bb
@@ -38,6 +38,9 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-go
file://0029-wavparse-Check-that-at-least-32-bytes-are-available-.patch \
file://0030-wavparse-Fix-clipping-of-size-to-the-file-size.patch \
file://0031-wavparse-Check-size-before-reading-ds64-chunk.patch \
+ file://CVE-2025-47183-001.patch \
+ file://CVE-2025-47183-002.patch \
+ file://CVE-2025-47219.patch \
"
SRC_URI[sha256sum] = "9c1913f981900bd8867182639b20907b28ed78ef7a222cfbf2d8ba9dab992fa7"
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [OE-core][scarthgap 7/9] libpam: re-add missing libgen include
2025-08-15 16:44 [OE-core][scarthgap 0/9] Patch review Steve Sakoman
` (5 preceding siblings ...)
2025-08-15 16:44 ` [OE-core][scarthgap 6/9] gstreamer1.0-plugins-good: fix multiple CVEs Steve Sakoman
@ 2025-08-15 16:44 ` Steve Sakoman
2025-08-15 16:44 ` [OE-core][scarthgap 8/9] cmake: Add PACKAGECONFIG option for debugger support Steve Sakoman
2025-08-15 16:45 ` [OE-core][scarthgap 9/9] go-helloworld: fix license Steve Sakoman
8 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-08-15 16:44 UTC (permalink / raw)
To: openembedded-core
From: Martin Jansa <martin.jansa@gmail.com>
It was added by original commit for CVE-2025-6020-01.patch
https://github.com/linux-pam/linux-pam/commit/475bd60c552b98c7eddb3270b0b4196847c0072e#diff-05f443e6acbe32a148a45648148739bf6f02f13acc5c20c6037bf933223d4d77
but removed here in the rebase, causing:
../../../Linux-PAM-1.5.3/modules/pam_namespace/pam_namespace.c:326:11: error: call to undeclared function 'dirname'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
326 | parent = dirname(buf);
| ^
../../../Linux-PAM-1.5.3/modules/pam_namespace/pam_namespace.c:326:9: error: incompatible integer to pointer conversion assigning to 'char*' from 'int' [-Wint-conversion]
326 | parent = dirname(buf);
| ^ ~~~~~~~~~~~~
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../pam/libpam/0002-pam-namespace-rebase.patch | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-extended/pam/libpam/0002-pam-namespace-rebase.patch b/meta/recipes-extended/pam/libpam/0002-pam-namespace-rebase.patch
index ff5a8a4946..c57011da0b 100644
--- a/meta/recipes-extended/pam/libpam/0002-pam-namespace-rebase.patch
+++ b/meta/recipes-extended/pam/libpam/0002-pam-namespace-rebase.patch
@@ -714,7 +714,7 @@ diff --git a/modules/pam_namespace/pam_namespace.h b/modules/pam_namespace/pam_n
index a991b4c..180e042 100644
--- a/modules/pam_namespace/pam_namespace.h
+++ b/modules/pam_namespace/pam_namespace.h
-@@ -44,21 +44,16 @@
+@@ -44,21 +44,17 @@
#include <stdlib.h>
#include <errno.h>
#include <syslog.h>
@@ -728,7 +728,7 @@ index a991b4c..180e042 100644
-#include <sys/resource.h>
#include <sys/mount.h>
#include <sys/wait.h>
--#include <libgen.h>
+ #include <libgen.h>
#include <fcntl.h>
#include <sched.h>
#include <glob.h>
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [OE-core][scarthgap 8/9] cmake: Add PACKAGECONFIG option for debugger support
2025-08-15 16:44 [OE-core][scarthgap 0/9] Patch review Steve Sakoman
` (6 preceding siblings ...)
2025-08-15 16:44 ` [OE-core][scarthgap 7/9] libpam: re-add missing libgen include Steve Sakoman
@ 2025-08-15 16:44 ` Steve Sakoman
2025-08-15 16:45 ` [OE-core][scarthgap 9/9] go-helloworld: fix license Steve Sakoman
8 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-08-15 16:44 UTC (permalink / raw)
To: openembedded-core
From: Nikhil R <nikhilr5@kpit.com>
Starting from CMake version 2.27 support for interactive debugging of CMake
scripts and configurations was added. However, by default the `nativesdk-cmake`
is compiled with debugger support turned off.
This change adds debugger support for cmake
(From OE-Core rev: 8acfca456c3502f0d097ba01a2d08f83fb75ab60)
Signed-off-by: Nikhil R <nikhilr5@kpit.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/cmake/cmake_3.28.3.bb | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/meta/recipes-devtools/cmake/cmake_3.28.3.bb b/meta/recipes-devtools/cmake/cmake_3.28.3.bb
index 63d483801a..2d47b4c027 100644
--- a/meta/recipes-devtools/cmake/cmake_3.28.3.bb
+++ b/meta/recipes-devtools/cmake/cmake_3.28.3.bb
@@ -44,9 +44,11 @@ EXTRA_OECMAKE=" \
-DKWSYS_CHAR_IS_SIGNED=1 \
-DBUILD_CursesDialog=0 \
-DKWSYS_LFS_WORKS=1 \
- -DCMake_ENABLE_DEBUGGER=0 \
"
+PACKAGECONFIG ??= ""
+PACKAGECONFIG[debugger] = "-DCMake_ENABLE_DEBUGGER=1,-DCMake_ENABLE_DEBUGGER=0,"
+
do_install:append:class-nativesdk() {
mkdir -p ${D}${datadir}/cmake
install -m 644 ${WORKDIR}/OEToolchainConfig.cmake ${D}${datadir}/cmake/
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [OE-core][scarthgap 9/9] go-helloworld: fix license
2025-08-15 16:44 [OE-core][scarthgap 0/9] Patch review Steve Sakoman
` (7 preceding siblings ...)
2025-08-15 16:44 ` [OE-core][scarthgap 8/9] cmake: Add PACKAGECONFIG option for debugger support Steve Sakoman
@ 2025-08-15 16:45 ` Steve Sakoman
8 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-08-15 16:45 UTC (permalink / raw)
To: openembedded-core
From: Quentin Schulz <quentin.schulz@cherry.de>
The example repo doesn't seem to have ever been under MIT to begin with
but rather Apache-2.0. It was then changed to the license used by the
goland projectm that is BSD-3-Clause, 2 years ago in commit 00c7068f9d83
("all: update to Go license").
The license file exists in the sources, so use that one instead of
taking it from the OE-Core license directory.
License-Update: Incorrect license is now proper
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-extended/go-examples/go-helloworld_0.1.bb | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-extended/go-examples/go-helloworld_0.1.bb b/meta/recipes-extended/go-examples/go-helloworld_0.1.bb
index 98cd4d8103..6f0214aa60 100644
--- a/meta/recipes-extended/go-examples/go-helloworld_0.1.bb
+++ b/meta/recipes-extended/go-examples/go-helloworld_0.1.bb
@@ -2,8 +2,8 @@ SUMMARY = "This is a simple example recipe that cross-compiles a Go program."
SECTION = "examples"
HOMEPAGE = "https://golang.org/"
-LICENSE = "MIT"
-LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302"
+LICENSE = "BSD-3-Clause"
+LIC_FILES_CHKSUM = "file://src/${GO_IMPORT}/LICENSE;md5=5d4950ecb7b26d2c5e4e7b4e0dd74707"
SRC_URI = "git://go.googlesource.com/example;branch=master;protocol=https"
SRCREV = "d9923f6970e9ba7e0d23aa9448ead71ea57235ae"
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread