Re: [OE-core][scarthgap][PATCH 1/6] rsync: Fix CVE-2026-29518

["Yoann Congal" <yoann.congal@smile.fr>]

On Tue Jul 7, 2026 at 11:52 AM CEST, Ashishkumar Parmar -X (asparmar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
> Hi Yoann,
>
> Thanks for the reminder.
>
> Yes, I am already working on the required rsync fixes for wrynose first, as suggested, and plan to send the wrynose series in the next 2-3 days.
>
> Once that is posted, I will follow up on this series accordingly.
>
> Regards,
> Ashish

Hello Ashish,

As a reminder, this series is still blocked pending a v3 wrynose series
(you told me to drop v2):
https://lore.kernel.org/all/20260717052059.773645-1-asparmar@cisco.com/

My plan is to keep checking this for a few weeks but ultimately drop
this series if this situation does not change.

Regards,
> ________________________________
> From: Yoann Congal <yoann.congal@smile.fr>
> Sent: 06 July 2026 22:49
> To: Yoann Congal <yoann.congal@smile.fr>; Ashishkumar Parmar -X (asparmar - E INFOCHIPS PRIVATE LIMITED at Cisco) <asparmar@cisco.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
> Cc: xe-linux-external (Internal Group) <xe-linux-external@cisco.com>
> Subject: Re: [OE-core][scarthgap][PATCH 1/6] rsync: Fix CVE-2026-29518
>
> On Mon Jun 22, 2026 at 1:31 PM CEST, Yoann Congal wrote:
>> On Fri Jun 12, 2026 at 2:13 PM CEST, Ashishkumar Parmar X (asparmar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
>>> From: Ashishkumar Parmar <asparmar@cisco.com>
>>>
>>> Pick the upstream backport [1] for CVE-2026-29518 as mentioned in [3],
>>> where a non-chrooted rsync daemon could be exposed to a parent path
>>> TOCTOU race that allowed file access outside the module.
>>>
>>> Also include the dependent upstream fix that followed the CVE fix:
>>> - CVE-2026-29518_p2.patch [2] secures sender read-path opens by
>>>   opening files from the module root, closing the same race on the
>>>   read side.
>>>
>>> [1] https://github.com/RsyncProject/rsync/commit/1a5ad81add1004354a3d8ba841b94ffe19cd2505
>>> [2] https://github.com/RsyncProject/rsync/commit/99b36291d06ca66229942c7a525a1f5566f10c85
>>> [3] https://www.cve.org/CVERecord?id=CVE-2026-29518
>>>
>>> Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
>>> ---
>>
>> Hello,
>>
>> It looks like this whole series is needed for wrynose (rsync 3.4.1).
>> Can you send fixes there first, and, then, ping here?
>
> Hello Ashishkumar,
>
> Gentle ping for this patch series. Do you plan to send the needed
> wrynose series?
>
> Regards,
>
>>
>> Thanks!
>>
>>>  .../rsync/files/CVE-2026-29518_p1.patch       | 330 ++++++++++++++++++
>>>  .../rsync/files/CVE-2026-29518_p2.patch       |  73 ++++
>>>  meta/recipes-devtools/rsync/rsync_3.2.7.bb    |   2 +
>>>  3 files changed, 405 insertions(+)
>>>  create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p1.patch
>>>  create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p2.patch
>
> --
> Yoann Congal
> Smile ECS


-- 
Yoann Congal
Smile ECS