Re: [OE-core][wrynose][PATCH] sudo: fix CVE-2026-82474

["Yoann Congal" <yoann.congal@smile.fr>]

On Mon Oct 19, 2026 at 4:56 PM CEST, Yoann Congal wrote:
> On Fri Oct 16, 2026 at 8:56 AM CEST, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
>> From: Darsh Kelaiya <dkelaiya@cisco.com>
>>
>> This patch applies the upstream fix as referenced in [2],
>> using the commit shown in [1].
>>
>> The recipe enables Linux intercept support. Check execveat commands
>> and log subcommands instead of allowing this syscall unconditionally.
>> Resolve directory file descriptors and AT_EMPTY_PATH to paths for
>> sudoers policy checks.
>>
>> Apply prerequisites [3] and [4] for proc_read_link() and fexecve paths.
>> Include follow-ups [5] and [6] to reject failed pathname rewrites and
>> correct relative-path moves. Keep the upstream source changes intact.
>>
>> [1] https://github.com/sudo-project/sudo/commit/71fbe42dcd5a1c8f799540583a2dfb2ae6221edf
>> [2] https://nvd.nist.gov/vuln/detail/CVE-2026-82474
>> [3] https://github.com/sudo-project/sudo/commit/1a312af6348594df371e6088aeed99685977f575
>> [4] https://github.com/sudo-project/sudo/commit/e822b729da31baf9154946329a9d6ef569f0d182
>> [5] https://github.com/sudo-project/sudo/commit/d1121181a87b2b47b4dfbb2af42399fcc5f1e3cd
>> [6] https://github.com/sudo-project/sudo/commit/02b14c043825b52be6cd537b7f11bd5e7e10512e
>>
>> Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
>> ---
>>  .../files/CVE-2026-82474-dependent_p1.patch   |  94 +++
>>  .../files/CVE-2026-82474-dependent_p2.patch   |  34 +
>>  .../files/CVE-2026-82474-regression_p1.patch  |  39 ++
>>  .../files/CVE-2026-82474-regression_p2.patch  |  33 +
>>  .../sudo/files/CVE-2026-82474.patch           | 617 ++++++++++++++++++
>>  meta/recipes-extended/sudo/sudo_1.9.17p2.bb   |   5 +
>>  6 files changed, 822 insertions(+)
>>  create mode 100644 meta/recipes-extended/sudo/files/CVE-2026-82474-dependent_p1.patch
>>  create mode 100644 meta/recipes-extended/sudo/files/CVE-2026-82474-dependent_p2.patch
>>  create mode 100644 meta/recipes-extended/sudo/files/CVE-2026-82474-regression_p1.patch
>>  create mode 100644 meta/recipes-extended/sudo/files/CVE-2026-82474-regression_p2.patch
>>  create mode 100644 meta/recipes-extended/sudo/files/CVE-2026-82474.patch
>
> Hello,
>
> I think this fix is also needed for blacksail and master. Can you send
> the relevant upgrade/backports so I can merge this on wrynose?

Hello,

This CVE is now fixed on master but the cherry-pick does not apply
cleanly for blacksail. Can you send this fix for blacksail as well?

Thanks!
-- 
Yoann Congal
Smile ECS