From: "Yoann Congal" <yoann.congal@smile.fr>
To: <dkelaiya@cisco.com>, <openembedded-core@lists.openembedded.org>
Subject: Re: [OE-core][wrynose][PATCH] sudo: fix CVE-2026-82474
Date: Mon, 19 Oct 2026 16:56:14 +0200 [thread overview]
Message-ID: <DM8WHNPDNECC.29BQ7CT8Z4HTX@smile.fr> (raw)
In-Reply-To: <20261016065612.3926487-1-dkelaiya@cisco.com>
On Fri Oct 16, 2026 at 8:56 AM CEST, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Darsh Kelaiya <dkelaiya@cisco.com>
>
> This patch applies the upstream fix as referenced in [2],
> using the commit shown in [1].
>
> The recipe enables Linux intercept support. Check execveat commands
> and log subcommands instead of allowing this syscall unconditionally.
> Resolve directory file descriptors and AT_EMPTY_PATH to paths for
> sudoers policy checks.
>
> Apply prerequisites [3] and [4] for proc_read_link() and fexecve paths.
> Include follow-ups [5] and [6] to reject failed pathname rewrites and
> correct relative-path moves. Keep the upstream source changes intact.
>
> [1] https://github.com/sudo-project/sudo/commit/71fbe42dcd5a1c8f799540583a2dfb2ae6221edf
> [2] https://nvd.nist.gov/vuln/detail/CVE-2026-82474
> [3] https://github.com/sudo-project/sudo/commit/1a312af6348594df371e6088aeed99685977f575
> [4] https://github.com/sudo-project/sudo/commit/e822b729da31baf9154946329a9d6ef569f0d182
> [5] https://github.com/sudo-project/sudo/commit/d1121181a87b2b47b4dfbb2af42399fcc5f1e3cd
> [6] https://github.com/sudo-project/sudo/commit/02b14c043825b52be6cd537b7f11bd5e7e10512e
>
> Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
> ---
> .../files/CVE-2026-82474-dependent_p1.patch | 94 +++
> .../files/CVE-2026-82474-dependent_p2.patch | 34 +
> .../files/CVE-2026-82474-regression_p1.patch | 39 ++
> .../files/CVE-2026-82474-regression_p2.patch | 33 +
> .../sudo/files/CVE-2026-82474.patch | 617 ++++++++++++++++++
> meta/recipes-extended/sudo/sudo_1.9.17p2.bb | 5 +
> 6 files changed, 822 insertions(+)
> create mode 100644 meta/recipes-extended/sudo/files/CVE-2026-82474-dependent_p1.patch
> create mode 100644 meta/recipes-extended/sudo/files/CVE-2026-82474-dependent_p2.patch
> create mode 100644 meta/recipes-extended/sudo/files/CVE-2026-82474-regression_p1.patch
> create mode 100644 meta/recipes-extended/sudo/files/CVE-2026-82474-regression_p2.patch
> create mode 100644 meta/recipes-extended/sudo/files/CVE-2026-82474.patch
Hello,
I think this fix is also needed for blacksail and master. Can you send
the relevant upgrade/backports so I can merge this on wrynose?
Thanks!
Regards,
--
Yoann Congal
Smile ECS
prev parent reply other threads:[~2026-10-19 14:56 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-16 6:56 [OE-core][wrynose][PATCH] sudo: fix CVE-2026-82474 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-19 14:56 ` Yoann Congal [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DM8WHNPDNECC.29BQ7CT8Z4HTX@smile.fr \
--to=yoann.congal@smile.fr \
--cc=dkelaiya@cisco.com \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox