Inputs to share CVE patch for binutils CVE-2023-25584

Inputs to share CVE patch for binutils CVE-2023-25584

[Ashishx88]

[-- Attachment #1: Type: text/plain, Size: 961 bytes --]

Hi Members ,

I am trying to submit an CVE patch  CVE-2023-25584 for binutils
*This is my first patch in community so apologies if any basic info is missed*

Can members please help me for

1) Do i need to share only specific CVE patch with community
or
Patch with updates meta/recipes-devtools/binutils/binutils-2.39.inc &  CVE  both files being updated in same patch
(Currently this is what i have created )

2) Is there any known place where i can share that i am looking at this CVE so we save effort duplication

3) Can i share the patch as attachment here or i need to send via " git send-email " only.
Currently i am facing some issue with git send-email at my end

4) I have validated the patch for (langdale) :
# devtool build binutils
# devtool build-image core-image-minimal
# bitbake binutils (after  cleanall )
# bitbake core-image-minimal
Is there any other test i need to do to ensure the sanity ?

Thanks ,
Ashish.

[-- Attachment #2: Type: text/html, Size: 1700 bytes --]

Re: [OE-core] Inputs to share CVE patch for binutils CVE-2023-25584

[Khem Raj]

On Sun, Jan 21, 2024 at 8:43 AM Ashishx88 <ashish.emailaddress@gmail.com> wrote:
>
> Hi Members ,
>
> I am trying to submit an CVE patch  CVE-2023-25584 for binutils
> This is my first patch in community so apologies if any basic info is missed
>
> Can members please help me for
>
> 1) Do i need to share only specific CVE patch with community
>           or
>      Patch with updates meta/recipes-devtools/binutils/binutils-2.39.inc &  CVE  both files being updated in same patch
>      (Currently this is what i have created )

Process is same for submitting changes for project be it a feature a
bug fix or new feature.
you prepare the changeset and then send the patches ( and cover letter
if multiple patches)
 to mailing list for review. This is a good guide in developer manual here

https://docs.yoctoproject.org/contributor-guide/submit-changes.html?highlight=submitting+patches

>
> 2) Is there any known place where i can share that i am looking at this CVE so we save effort duplication

Usually, its a good idea to send email in advance to inform the
community about your work
that does have some advantage but when patches arrive on mailing list
thats mostly when we
know of someone did the work for sure.

>
> 3) Can i share the patch as attachment here or i need to send via "git send-email" only.
>     Currently i am facing some issue with git send-email  at my end

Most maintainers pick them from mailing list or tools like lore or
patchwork. So git send-email
has had good results of sending patches intact. So using that might be
a good idea.

>
> 4) I have validated the patch for (langdale) :
>     # devtool build binutils
>     # devtool build-image core-image-minimal
>     # bitbake binutils (after  cleanall )
>     # bitbake core-image-minimal
>     Is there any other test i need to do to ensure the sanity ?

Thats good. You can always mention these activities in cover letter,
thats very useful
information for reviewers and maintainers.

>
> Thanks ,
> Ashish.
>
>
>
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#194093): https://lists.openembedded.org/g/openembedded-core/message/194093
> Mute This Topic: https://lists.openembedded.org/mt/103869223/1997914
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [raj.khem@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>

Re: Inputs to share CVE patch for binutils CVE-2023-25584

[Ashishx88]

[-- Attachment #1: Type: text/plain, Size: 364 bytes --]

Hi Khem Raj / Members ,
- Have shared my first patch https://lists.openembedded.org/g/openembedded-core/message/194117
Can members please review this and help me improve any aspect of patch if required.

- Also how do we know that patch has been accepted and merged ?
In BUGZILLA we generally we get an intimation for the patch generally

Thanks ,
Ashish

[-- Attachment #2: Type: text/html, Size: 563 bytes --]

Re: Inputs to share CVE patch for binutils CVE-2023-25584

[Ashishx88]

[-- Attachment #1: Type: text/plain, Size: 272 bytes --]

Hi Members ,

I have submitted ver2 after locally checking with patchtest https://lists.openembedded.org/g/openembedded-core/message/194129
Any feedback will be helpful as i can learn and look at some other CVE as i have some bandwidth  this week

Thanks ,
Ashish

[-- Attachment #2: Type: text/html, Size: 428 bytes --]