RE: [OE-core] [scarthgap][PATCH 1/3] cpio: patch CVE-2026-66485

["Marko, Peter" <Peter.Marko@siemens.com>]

> -----Original Message-----
> From: Yoann Congal <yoann.congal@smile.fr>
> Sent: Friday, August 28, 2026 10:25 AM
> To: Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com>;
> openembedded-core@lists.openembedded.org
> Subject: Re: [OE-core] [scarthgap][PATCH 1/3] cpio: patch CVE-2026-66485
> 
> On Sat Aug 15, 2026 at 9:08 PM CEST, Peter Marko via lists.openembedded.org
> wrote:
> > From: Peter Marko <peter.marko@siemens.com>
> >
> > Pick patch mentioned in NVD CVE description.
> >
> > Signed-off-by: Peter Marko <peter.marko@siemens.com>
> > Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> > (From OE-Core rev: c105fbf82e2f50b05dc680e0601bf0ea3198e58c)
> > Signed-off-by: Peter Marko <peter.marko@siemens.com>
> > ---
> >  meta/recipes-extended/cpio/cpio_2.15.bb       |   1 +
> >  .../cpio/files/CVE-2026-66485.patch           | 210 ++++++++++++++++++
> >  2 files changed, 211 insertions(+)
> >  create mode 100644 meta/recipes-extended/cpio/files/CVE-2026-66485.patch
> 
> Hello,
> 
> It looks like this series triggers ptests issues:
> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/61/builds/4362
> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/73/builds/4378
> 
> https://valkyrie.yocto.io/pub/non-release/20260824-88/testresults/qemux86-64-
> ptest/core-image-ptest-cpio/log.do_testimage.311338.20260824214940
> | FAIL: CVE-2019-14866 (tar header size overflow)
> 
> Can you look into this?

I really hate the expectfail default setting, sometimes I miss the failure...

Could you please take the first two patches from this series?
Only the third one is causing the error.
After two weeks of vacation lot of things piled up so it will take me some time to clear my backlog to be able to look at this issue.

Thanks,
  Peter

> 
> Thanks!
> --
> Yoann Congal
> Smile ECS