[Buildroot] [PATCH 0/2] package/lldpd: security bump to 1.0.22

[Buildroot] [PATCH 0/2] package/lldpd: security bump to 1.0.22

[Joachim Wiberg]

Bump lldpd to 1.0.22, fixing CVE-2026-46433, an out-of-bound read when
removing the VLAN tag.  1.0.21 is picked up along the way, fixing path
traversal and arbitrary file deletion in the privileged process.

No packaging changes were needed: the configure options are identical
between 1.0.20 and 1.0.22, and the LICENSE hash still matches.  The
tarball signature checks out against the key already recorded in the
hash file.

The second patch is independent of the bump.  check-package had six
warnings on S60lldpd, and rewriting it after the S01syslogd reference
also fixes start and stop always reporting success, and stop not
waiting for the daemon to exit before a restart races it.

Best regards
 /Joachim

Joachim Wiberg (2):
  package/lldpd: security bump to version 1.0.22
  package/lldpd: rework start script

 package/lldpd/S60lldpd   | 80 +++++++++++++++++++++++++++++-----------
 package/lldpd/lldpd.hash |  6 +--
 package/lldpd/lldpd.mk   |  2 +-
 3 files changed, 62 insertions(+), 26 deletions(-)

-- 
2.43.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 1/2] package/lldpd: security bump to version 1.0.22

[Joachim Wiberg]

https://github.com/lldpd/lldpd/releases/tag/1.0.22
https://github.com/lldpd/lldpd/releases/tag/1.0.21

Fixes CVE-2026-46433, an out-of-bound read access when removing the
VLAN tag.  1.0.21 fixes path traversal vulnerabilities and arbitrary
file deletion in the privileged process.

GPG signature verified with key AEF2348766F371C689A7360095A42FE8353525F9,
LICENSE hash unchanged.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
 package/lldpd/lldpd.hash | 6 +++---
 package/lldpd/lldpd.mk   | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package/lldpd/lldpd.hash b/package/lldpd/lldpd.hash
index f3cefe7b73..46f2b9b476 100644
--- a/package/lldpd/lldpd.hash
+++ b/package/lldpd/lldpd.hash
@@ -1,6 +1,6 @@
 # Locally computed after checking gpg key
-# https://media.luffy.cx/files/lldpd/lldpd-1.0.20.tar.gz.gpg
+# https://media.luffy.cx/files/lldpd/lldpd-1.0.22.tar.gz.gpg
 # using key AEF2348766F371C689A7360095A42FE8353525F9
-# gpg --verify lldpd-1.0.20.tar.gz.gpg lldpd-1.0.20.tar.gz
-sha256  61b8cb22d4879e68f7825a2fb8e1e92abb4aba4773977cf0258bc32ed9f55450  lldpd-1.0.20.tar.gz
+# gpg --verify lldpd-1.0.22.tar.gz.gpg lldpd-1.0.22.tar.gz
+sha256  9587940ed2314a86774c5499f3dfb13a8eb86232a62d243a83a1f09886848e03  lldpd-1.0.22.tar.gz
 sha256  0e96a5aea65f16e2239231ce4ab90497f8bc3bb8fe6abe9299aade4726ff7c8d  LICENSE
diff --git a/package/lldpd/lldpd.mk b/package/lldpd/lldpd.mk
index a3015e9e7d..f0cbc7e436 100644
--- a/package/lldpd/lldpd.mk
+++ b/package/lldpd/lldpd.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LLDPD_VERSION = 1.0.20
+LLDPD_VERSION = 1.0.22
 LLDPD_SITE = https://media.luffy.cx/files/lldpd
 LLDPD_DEPENDENCIES = \
 	$(if $(BR2_PACKAGE_CHECK),check) \
-- 
2.43.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 2/2] package/lldpd: rework start script

[Joachim Wiberg]

check-package reports six warnings on S60lldpd: indentation with
spaces, no DAEMON variable, and shellcheck complaints.

The script also masks failures, the exit status of
"[ $? = 0 ] && echo OK || echo FAIL" is the one of echo, so start and
stop always return success.  Stopping does not wait for the daemon to
exit either, so a restart can race the instance on its way out.

Rewrite it after package/busybox/S01syslogd, as the manual asks.  lldpd
daemonizes and writes the PID file itself, but does not remove it on
exit, so pass the PID file to both start-stop-daemon and the daemon and
drop the stale file once the process is gone.  Also pick up arguments
from /etc/default/lldpd and add the customary reload alias.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
 package/lldpd/S60lldpd | 80 ++++++++++++++++++++++++++++++------------
 1 file changed, 58 insertions(+), 22 deletions(-)

diff --git a/package/lldpd/S60lldpd b/package/lldpd/S60lldpd
index 3dfa6c1aa1..79605c2f02 100644
--- a/package/lldpd/S60lldpd
+++ b/package/lldpd/S60lldpd
@@ -1,25 +1,61 @@
 #!/bin/sh
-#
-# Controls lldpd.
-#
 
-case $1 in
-    start)
-	printf "Starting lldpd: "
-	start-stop-daemon -S -q -p /var/run/lldpd.pid --exec /usr/sbin/lldpd
-	[ $? = 0 ] && echo "OK" || echo "FAIL"
-	;;
-    stop)
-	printf "Stopping lldpd: "
-	start-stop-daemon -K -q -p /var/run/lldpd.pid
-	[ $? = 0 ] && echo "OK" || echo "FAIL"
-	;;
-    restart)
-	$0 stop
-	$0 start
-	;;
-    *)
-	echo "Usage: $0 {start|stop|restart}"
-	exit 1
-	;;
+DAEMON="lldpd"
+PIDFILE="/var/run/$DAEMON.pid"
+
+LLDPD_ARGS=""
+
+# shellcheck source=/dev/null
+[ -r "/etc/default/$DAEMON" ] && . "/etc/default/$DAEMON"
+
+# lldpd daemonizes and creates the PID file itself, so tell it where to
+# put it, but it does not remove it on exit.
+start() {
+	printf 'Starting %s: ' "$DAEMON"
+	# shellcheck disable=SC2086 # we need the word splitting
+	start-stop-daemon --start --pidfile "$PIDFILE" \
+		--exec "/usr/sbin/$DAEMON" \
+		-- -p "$PIDFILE" $LLDPD_ARGS
+	status=$?
+	if [ "$status" -eq 0 ]; then
+		echo "OK"
+	else
+		echo "FAIL"
+	fi
+	return "$status"
+}
+
+stop() {
+	printf 'Stopping %s: ' "$DAEMON"
+	start-stop-daemon --stop --pidfile "$PIDFILE" \
+		--exec "/usr/sbin/$DAEMON"
+	status=$?
+	if [ "$status" -eq 0 ]; then
+		echo "OK"
+	else
+		echo "FAIL"
+		return "$status"
+	fi
+	while start-stop-daemon --stop --test --quiet --pidfile "$PIDFILE" \
+		--exec "/usr/sbin/$DAEMON"; do
+		sleep 0.1
+	done
+	rm -f "$PIDFILE"
+	return "$status"
+}
+
+restart() {
+	stop
+	start
+}
+
+case "$1" in
+	start|stop|restart)
+		"$1";;
+	reload)
+		# Restart, since there is no true "reload" feature.
+		restart;;
+	*)
+		echo "Usage: $0 {start|stop|restart|reload}"
+		exit 1
 esac
-- 
2.43.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/2] package/lldpd: security bump to version 1.0.22

[Julien Olivain via buildroot]

On 14/09/2026 17:53, Joachim Wiberg wrote:
> https://github.com/lldpd/lldpd/releases/tag/1.0.22
> https://github.com/lldpd/lldpd/releases/tag/1.0.21
> 
> Fixes CVE-2026-46433, an out-of-bound read access when removing the
> VLAN tag.  1.0.21 fixes path traversal vulnerabilities and arbitrary
> file deletion in the privileged process.
> 
> GPG signature verified with key 
> AEF2348766F371C689A7360095A42FE8353525F9,
> LICENSE hash unchanged.
> 
> Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

Series applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/2] package/lldpd: security bump to version 1.0.22

[Raphaël Mélotte via buildroot]

In reply of:
> https://github.com/lldpd/lldpd/releases/tag/1.0.22
> https://github.com/lldpd/lldpd/releases/tag/1.0.21
> 
> Fixes CVE-2026-46433, an out-of-bound read access when removing the
> VLAN tag.  1.0.21 fixes path traversal vulnerabilities and arbitrary
> file deletion in the privileged process.
> 
> GPG signature verified with key AEF2348766F371C689A7360095A42FE8353525F9,
> LICENSE hash unchanged.
> 
> Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

Applied to 2025.02.x, 2026.08.x. Thanks

> ---
>  package/lldpd/lldpd.hash | 6 +++---
>  package/lldpd/lldpd.mk   | 2 +-
>  2 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/package/lldpd/lldpd.hash b/package/lldpd/lldpd.hash
> index f3cefe7b73..46f2b9b476 100644
> --- a/package/lldpd/lldpd.hash
> +++ b/package/lldpd/lldpd.hash
> @@ -1,6 +1,6 @@
>  # Locally computed after checking gpg key
> -# https://media.luffy.cx/files/lldpd/lldpd-1.0.20.tar.gz.gpg
> +# https://media.luffy.cx/files/lldpd/lldpd-1.0.22.tar.gz.gpg
>  # using key AEF2348766F371C689A7360095A42FE8353525F9
> -# gpg --verify lldpd-1.0.20.tar.gz.gpg lldpd-1.0.20.tar.gz
> -sha256  61b8cb22d4879e68f7825a2fb8e1e92abb4aba4773977cf0258bc32ed9f55450  lldpd-1.0.20.tar.gz
> +# gpg --verify lldpd-1.0.22.tar.gz.gpg lldpd-1.0.22.tar.gz
> +sha256  9587940ed2314a86774c5499f3dfb13a8eb86232a62d243a83a1f09886848e03  lldpd-1.0.22.tar.gz
>  sha256  0e96a5aea65f16e2239231ce4ab90497f8bc3bb8fe6abe9299aade4726ff7c8d  LICENSE
> diff --git a/package/lldpd/lldpd.mk b/package/lldpd/lldpd.mk
> index a3015e9e7d..f0cbc7e436 100644
> --- a/package/lldpd/lldpd.mk
> +++ b/package/lldpd/lldpd.mk
> @@ -4,7 +4,7 @@
>  #
>  ################################################################################
>  
> -LLDPD_VERSION = 1.0.20
> +LLDPD_VERSION = 1.0.22
>  LLDPD_SITE = https://media.luffy.cx/files/lldpd
>  LLDPD_DEPENDENCIES = \
>  	$(if $(BR2_PACKAGE_CHECK),check) \
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot