Re: [OE-core][wrynose][PATCH] u-boot: fix CVE-2026-29009

["Yoann Congal" <yoann.congal@smile.fr>]

Hello,

I have a few format issues with your patch but the gist of it looks good
to me.

On Fri Oct 9, 2026 at 2:02 PM CEST, Roopa via lists.openembedded.org Kalmath wrote:
> U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in
> nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled,
> allowing a malicious or compromised NFS server to overflow the 2048-byte
> nfs_path_buff buffer by returning multiple relative symlink targets that
> are appended without cumulative length validation. Attackers can send
> two or more READLINK responses containing relative symlink targets of
> approximately 1100 bytes each to corrupt adjacent BSS variables
> including nfs_server_ip, nfs_server_mount_port, nfs_server_port,
> nfs_our_port, nfs_state, and rpc_id, potentially achieving memory
> corruption and control over the NFS client state machine.

All this paragraph is the CVE description which is not what reader of
these commit messages look for. We want to know what you did to fix the
CVE and why. In this case a simple
"Backport fix referenced by NVD: https://nvd.nist.gov/vuln/detail/cve-2026-29009"
is enough.

Look at https://git.openembedded.org/openembedded-core/log/?h=wrynose&qt=grep&q=CVE
to get an idea of what a commit message usually look like.

> Reference:
> [https://www.cve.org/CVERecord?id=CVE-2026-29009]
>
> Backport the patch to fix CVE-2026-29009:
> [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc]
>
> Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
> ---
>  .../u-boot/files/CVE-2026-29009.patch         | 34 +++++++++++++++++++
>  meta/recipes-bsp/u-boot/u-boot_2026.01.bb     |  4 ++-
>  2 files changed, 37 insertions(+), 1 deletion(-)
>  create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
>
> diff --git a/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
> new file mode 100644
> index 0000000000..1e04562ede
> --- /dev/null
> +++ b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch
> @@ -0,0 +1,34 @@
> +From 2b88f08722584cf235f7dacaa190af3d24deb40f Mon Sep 17 00:00:00 2001
> +From: Roopa Kalmath <Roopa.Kalmath@windriver.com>
> +Date: Fri, 9 Oct 2026 08:38:23 +0000
> +Subject: [PATCH] u-boot:Fix CVE-2026-29009
> +
> +CVE: CVE-2026-29009
> +
> +Upstream-Status: Backport [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc]
> +
> +Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>

While backporting this patch you complely erased the existing commit
message and authorship information. Please keep those, they help
checking that we are indeed fixing the vulnerability, not introducing
regressions, ...

Can you send a v2 with the above fixed?

Thanks!
-- 
Yoann Congal
Smile ECS