* [OE-core][scarthgap 0/8] Patch review
@ 2025-01-23 2:59 Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 1/8] rsync: fix CVE-2024-12084 Steve Sakoman
` (7 more replies)
0 siblings, 8 replies; 16+ messages in thread
From: Steve Sakoman @ 2025-01-23 2:59 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Friday, January 24
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/869
The following changes since commit 660e00469f9c99fe733cc8b37f67438a96ff2e97:
libgfortran: fix buildpath QA issue (2025-01-21 12:33:25 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Archana Polampalli (6):
rsync: fix CVE-2024-12084
rsync: fix CVE-2024-12085
rsync: fix CVE-2024-12086
rsync: fix CVE-2024-12087
rsync: fix CVE-2024-12088
rsync: fix CVE-2024-12747
Harish Sadineni (1):
rust-target-config: Fix TARGET_C_INT_WIDTH with correct size
Jiaying Song (1):
boost: fix do_fetch error
.../classes-recipe/rust-target-config.bbclass | 10 +-
.../rsync/files/CVE-2024-12084-0001.patch | 156 ++++++++++++++
.../rsync/files/CVE-2024-12084-0002.patch | 43 ++++
.../rsync/files/CVE-2024-12085.patch | 32 +++
.../rsync/files/CVE-2024-12086-0001.patch | 42 ++++
.../rsync/files/CVE-2024-12086-0002.patch | 108 ++++++++++
.../rsync/files/CVE-2024-12086-0003.patch | 108 ++++++++++
.../rsync/files/CVE-2024-12086-0004.patch | 41 ++++
.../rsync/files/CVE-2024-12087-0001.patch | 49 +++++
.../rsync/files/CVE-2024-12087-0002.patch | 31 +++
.../rsync/files/CVE-2024-12087-0003.patch | 40 ++++
.../rsync/files/CVE-2024-12088.patch | 141 +++++++++++++
.../rsync/files/CVE-2024-12747.patch | 192 ++++++++++++++++++
meta/recipes-devtools/rsync/rsync_3.2.7.bb | 12 ++
meta/recipes-support/boost/boost-1.84.0.inc | 2 +-
15 files changed, 1001 insertions(+), 6 deletions(-)
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12084-0001.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12084-0002.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12085.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12086-0001.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12086-0002.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12086-0003.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12086-0004.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12087-0001.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12087-0002.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12087-0003.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12088.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12747.patch
--
2.43.0
^ permalink raw reply [flat|nested] 16+ messages in thread
* [OE-core][scarthgap 1/8] rsync: fix CVE-2024-12084
2025-01-23 2:59 [OE-core][scarthgap 0/8] Patch review Steve Sakoman
@ 2025-01-23 2:59 ` Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 2/8] rsync: fix CVE-2024-12085 Steve Sakoman
` (6 subsequent siblings)
7 siblings, 0 replies; 16+ messages in thread
From: Steve Sakoman @ 2025-01-23 2:59 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due
to improper handling of attacker-controlled checksum lengths (s2length) in the code.
When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write
out of bounds in the sum2 buffer.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../rsync/files/CVE-2024-12084-0001.patch | 156 ++++++++++++++++++
.../rsync/files/CVE-2024-12084-0002.patch | 43 +++++
meta/recipes-devtools/rsync/rsync_3.2.7.bb | 2 +
3 files changed, 201 insertions(+)
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12084-0001.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12084-0002.patch
diff --git a/meta/recipes-devtools/rsync/files/CVE-2024-12084-0001.patch b/meta/recipes-devtools/rsync/files/CVE-2024-12084-0001.patch
new file mode 100644
index 0000000000..d654067fab
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2024-12084-0001.patch
@@ -0,0 +1,156 @@
+From 0902b52f6687b1f7952422080d50b93108742e53 Mon Sep 17 00:00:00 2001
+From: Wayne Davison <wayne@opencoder.net>
+Date: Tue, 29 Oct 2024 22:55:29 -0700
+Subject: [PATCH] Some checksum buffer fixes.
+
+- Put sum2_array into sum_struct to hold an array of sum2 checksums
+ that are each xfer_sum_len bytes.
+- Remove sum2 buf from sum_buf.
+- Add macro sum2_at() to access each sum2 array element.
+- Throw an error if a sums header has an s2length larger than
+ xfer_sum_len.
+
+CVE: CVE-2024-12084
+
+Upstream-Status: Backport [https://git.samba.org/?p=rsync.git;a=commit;h=0902b52f6687b1f7952422080d50b93108742e53]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ io.c | 3 ++-
+ match.c | 8 ++++----
+ rsync.c | 5 ++++-
+ rsync.h | 4 +++-
+ sender.c | 4 +++-
+ 5 files changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/io.c b/io.c
+index a99ac0ec..bb60eeca 100644
+--- a/io.c
++++ b/io.c
+@@ -55,6 +55,7 @@ extern int read_batch;
+ extern int compat_flags;
+ extern int protect_args;
+ extern int checksum_seed;
++extern int xfer_sum_len;
+ extern int daemon_connection;
+ extern int protocol_version;
+ extern int remove_source_files;
+@@ -1977,7 +1978,7 @@ void read_sum_head(int f, struct sum_struct *sum)
+ exit_cleanup(RERR_PROTOCOL);
+ }
+ sum->s2length = protocol_version < 27 ? csum_length : (int)read_int(f);
+- if (sum->s2length < 0 || sum->s2length > MAX_DIGEST_LEN) {
++ if (sum->s2length < 0 || sum->s2length > xfer_sum_len) {
+ rprintf(FERROR, "Invalid checksum length %d [%s]\n",
+ sum->s2length, who_am_i());
+ exit_cleanup(RERR_PROTOCOL);
+diff --git a/match.c b/match.c
+index cdb30a15..36e78ed2 100644
+--- a/match.c
++++ b/match.c
+@@ -232,7 +232,7 @@ static void hash_search(int f,struct sum_struct *s,
+ done_csum2 = 1;
+ }
+
+- if (memcmp(sum2,s->sums[i].sum2,s->s2length) != 0) {
++ if (memcmp(sum2, sum2_at(s, i), s->s2length) != 0) {
+ false_alarms++;
+ continue;
+ }
+@@ -252,7 +252,7 @@ static void hash_search(int f,struct sum_struct *s,
+ if (i != aligned_i) {
+ if (sum != s->sums[aligned_i].sum1
+ || l != s->sums[aligned_i].len
+- || memcmp(sum2, s->sums[aligned_i].sum2, s->s2length) != 0)
++ || memcmp(sum2, sum2_at(s, aligned_i), s->s2length) != 0)
+ goto check_want_i;
+ i = aligned_i;
+ }
+@@ -271,7 +271,7 @@ static void hash_search(int f,struct sum_struct *s,
+ if (sum != s->sums[i].sum1)
+ goto check_want_i;
+ get_checksum2((char *)map, l, sum2);
+- if (memcmp(sum2, s->sums[i].sum2, s->s2length) != 0)
++ if (memcmp(sum2, sum2_at(s, i), s->s2length) != 0)
+ goto check_want_i;
+ /* OK, we have a re-alignment match. Bump the offset
+ * forward to the new match point. */
+@@ -290,7 +290,7 @@ static void hash_search(int f,struct sum_struct *s,
+ && (!updating_basis_file || s->sums[want_i].offset >= offset
+ || s->sums[want_i].flags & SUMFLG_SAME_OFFSET)
+ && sum == s->sums[want_i].sum1
+- && memcmp(sum2, s->sums[want_i].sum2, s->s2length) == 0) {
++ && memcmp(sum2, sum2_at(s, want_i), s->s2length) == 0) {
+ /* we've found an adjacent match - the RLL coder
+ * will be happy */
+ i = want_i;
+diff --git a/rsync.c b/rsync.c
+index cd288f57..b130aba5 100644
+--- a/rsync.c
++++ b/rsync.c
+@@ -437,7 +437,10 @@ int read_ndx_and_attrs(int f_in, int f_out, int *iflag_ptr, uchar *type_ptr, cha
+ */
+ void free_sums(struct sum_struct *s)
+ {
+- if (s->sums) free(s->sums);
++ if (s->sums) {
++ free(s->sums);
++ free(s->sum2_array);
++ }
+ free(s);
+ }
+
+diff --git a/rsync.h b/rsync.h
+index d3709fe0..8ddbe702 100644
+--- a/rsync.h
++++ b/rsync.h
+@@ -958,12 +958,12 @@ struct sum_buf {
+ uint32 sum1; /**< simple checksum */
+ int32 chain; /**< next hash-table collision */
+ short flags; /**< flag bits */
+- char sum2[SUM_LENGTH]; /**< checksum */
+ };
+
+ struct sum_struct {
+ OFF_T flength; /**< total file length */
+ struct sum_buf *sums; /**< points to info for each chunk */
++ char *sum2_array; /**< checksums of length xfer_sum_len */
+ int32 count; /**< how many chunks */
+ int32 blength; /**< block_length */
+ int32 remainder; /**< flength % block_length */
+@@ -982,6 +982,8 @@ struct map_struct {
+ int status; /* first errno from read errors */
+ };
+
++#define sum2_at(s, i) ((s)->sum2_array + ((OFF_T)(i) * xfer_sum_len))
++
+ #define NAME_IS_FILE (0) /* filter name as a file */
+ #define NAME_IS_DIR (1<<0) /* filter name as a dir */
+ #define NAME_IS_XATTR (1<<2) /* filter name as an xattr */
+diff --git a/sender.c b/sender.c
+index 3d4f052e..ab205341 100644
+--- a/sender.c
++++ b/sender.c
+@@ -31,6 +31,7 @@ extern int log_before_transfer;
+ extern int stdout_format_has_i;
+ extern int logfile_format_has_i;
+ extern int want_xattr_optim;
++extern int xfer_sum_len;
+ extern int csum_length;
+ extern int append_mode;
+ extern int copy_links;
+@@ -94,10 +95,11 @@ static struct sum_struct *receive_sums(int f)
+ return(s);
+
+ s->sums = new_array(struct sum_buf, s->count);
++ s->sum2_array = new_array(char, s->count * xfer_sum_len);
+
+ for (i = 0; i < s->count; i++) {
+ s->sums[i].sum1 = read_int(f);
+- read_buf(f, s->sums[i].sum2, s->s2length);
++ read_buf(f, sum2_at(s, i), s->s2length);
+
+ s->sums[i].offset = offset;
+ s->sums[i].flags = 0;
+--
+2.40.0
diff --git a/meta/recipes-devtools/rsync/files/CVE-2024-12084-0002.patch b/meta/recipes-devtools/rsync/files/CVE-2024-12084-0002.patch
new file mode 100644
index 0000000000..266b80c241
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2024-12084-0002.patch
@@ -0,0 +1,43 @@
+From 42e2b56c4ede3ab164f9a5c6dae02aa84606a6c1 Mon Sep 17 00:00:00 2001
+From: Wayne Davison <wayne@opencoder.net>
+Date: Tue, 5 Nov 2024 11:01:03 -0800
+Subject: [PATCH] Another cast when multiplying integers.
+
+CVE: CVE-2024-12084
+
+Upstream-Status: Backport [https://git.samba.org/?p=rsync.git;a=commit;h=42e2b56c4ede3ab164f9a5c6dae02aa84606a6c1]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ rsync.h | 2 +-
+ sender.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/rsync.h b/rsync.h
+index 8ddbe702..0f9e277f 100644
+--- a/rsync.h
++++ b/rsync.h
+@@ -982,7 +982,7 @@ struct map_struct {
+ int status; /* first errno from read errors */
+ };
+
+-#define sum2_at(s, i) ((s)->sum2_array + ((OFF_T)(i) * xfer_sum_len))
++#define sum2_at(s, i) ((s)->sum2_array + ((size_t)(i) * xfer_sum_len))
+
+ #define NAME_IS_FILE (0) /* filter name as a file */
+ #define NAME_IS_DIR (1<<0) /* filter name as a dir */
+diff --git a/sender.c b/sender.c
+index ab205341..2bbff2fa 100644
+--- a/sender.c
++++ b/sender.c
+@@ -95,7 +95,7 @@ static struct sum_struct *receive_sums(int f)
+ return(s);
+
+ s->sums = new_array(struct sum_buf, s->count);
+- s->sum2_array = new_array(char, s->count * xfer_sum_len);
++ s->sum2_array = new_array(char, (size_t)s->count * xfer_sum_len);
+
+ for (i = 0; i < s->count; i++) {
+ s->sums[i].sum1 = read_int(f);
+--
+2.40.0
diff --git a/meta/recipes-devtools/rsync/rsync_3.2.7.bb b/meta/recipes-devtools/rsync/rsync_3.2.7.bb
index 130581a785..2f3ea61978 100644
--- a/meta/recipes-devtools/rsync/rsync_3.2.7.bb
+++ b/meta/recipes-devtools/rsync/rsync_3.2.7.bb
@@ -15,6 +15,8 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
file://makefile-no-rebuild.patch \
file://determism.patch \
file://0001-Add-missing-prototypes-to-function-declarations.patch \
+ file://CVE-2024-12084-0001.patch \
+ file://CVE-2024-12084-0002.patch \
"
SRC_URI[sha256sum] = "4e7d9d3f6ed10878c58c5fb724a67dacf4b6aac7340b13e488fb2dc41346f2bb"
--
2.43.0
^ permalink raw reply related [flat|nested] 16+ messages in thread
* [OE-core][scarthgap 2/8] rsync: fix CVE-2024-12085
2025-01-23 2:59 [OE-core][scarthgap 0/8] Patch review Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 1/8] rsync: fix CVE-2024-12084 Steve Sakoman
@ 2025-01-23 2:59 ` Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 3/8] rsync: fix CVE-2024-12086 Steve Sakoman
` (5 subsequent siblings)
7 siblings, 0 replies; 16+ messages in thread
From: Steve Sakoman @ 2025-01-23 2:59 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
A flaw was found in the rsync daemon which could be triggered when rsync compares
file checksums. This flaw allows an attacker to manipulate the checksum length
(s2length) to cause a comparison between a checksum and uninitialized memory and
leak one byte of uninitialized stack data at a time.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../rsync/files/CVE-2024-12085.patch | 32 +++++++++++++++++++
meta/recipes-devtools/rsync/rsync_3.2.7.bb | 1 +
2 files changed, 33 insertions(+)
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12085.patch
diff --git a/meta/recipes-devtools/rsync/files/CVE-2024-12085.patch b/meta/recipes-devtools/rsync/files/CVE-2024-12085.patch
new file mode 100644
index 0000000000..165d5a62f9
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2024-12085.patch
@@ -0,0 +1,32 @@
+From 589b0691e59f761ccb05ddb8e1124991440db2c7 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Thu, 14 Nov 2024 09:57:08 +1100
+Subject: [PATCH] prevent information leak off the stack
+
+prevent leak of uninitialised stack data in hash_search
+
+CVE: CVE-2024-12085
+
+Upstream-Status: Backport [https://git.samba.org/?p=rsync.git;a=commit;h=589b0691e59f761ccb05ddb8e1124991440db2c7]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ match.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/match.c b/match.c
+index 36e78ed2..dfd6af2c 100644
+--- a/match.c
++++ b/match.c
+@@ -147,6 +147,9 @@ static void hash_search(int f,struct sum_struct *s,
+ int more;
+ schar *map;
+
++ // prevent possible memory leaks
++ memset(sum2, 0, sizeof sum2);
++
+ /* want_i is used to encourage adjacent matches, allowing the RLL
+ * coding of the output to work more efficiently. */
+ want_i = 0;
+--
+2.40.0
diff --git a/meta/recipes-devtools/rsync/rsync_3.2.7.bb b/meta/recipes-devtools/rsync/rsync_3.2.7.bb
index 2f3ea61978..0d9c68a915 100644
--- a/meta/recipes-devtools/rsync/rsync_3.2.7.bb
+++ b/meta/recipes-devtools/rsync/rsync_3.2.7.bb
@@ -17,6 +17,7 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
file://0001-Add-missing-prototypes-to-function-declarations.patch \
file://CVE-2024-12084-0001.patch \
file://CVE-2024-12084-0002.patch \
+ file://CVE-2024-12085.patch \
"
SRC_URI[sha256sum] = "4e7d9d3f6ed10878c58c5fb724a67dacf4b6aac7340b13e488fb2dc41346f2bb"
--
2.43.0
^ permalink raw reply related [flat|nested] 16+ messages in thread
* [OE-core][scarthgap 3/8] rsync: fix CVE-2024-12086
2025-01-23 2:59 [OE-core][scarthgap 0/8] Patch review Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 1/8] rsync: fix CVE-2024-12084 Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 2/8] rsync: fix CVE-2024-12085 Steve Sakoman
@ 2025-01-23 2:59 ` Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 4/8] rsync: fix CVE-2024-12087 Steve Sakoman
` (4 subsequent siblings)
7 siblings, 0 replies; 16+ messages in thread
From: Steve Sakoman @ 2025-01-23 2:59 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
A flaw was found in rsync. It could allow a server to enumerate the contents of an
arbitrary file from the client's machine. This issue occurs when files are being
copied from a client to a server. During this process, the rsync server will send
checksums of local data to the client to compare with in order to determine what
data needs to be sent to the server. By sending specially constructed checksum values
for arbitrary files, an attacker may be able to reconstruct the data of those files
byte-by-byte based on the responses from the client.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../rsync/files/CVE-2024-12086-0001.patch | 42 +++++++
.../rsync/files/CVE-2024-12086-0002.patch | 108 ++++++++++++++++++
.../rsync/files/CVE-2024-12086-0003.patch | 108 ++++++++++++++++++
.../rsync/files/CVE-2024-12086-0004.patch | 41 +++++++
meta/recipes-devtools/rsync/rsync_3.2.7.bb | 4 +
5 files changed, 303 insertions(+)
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12086-0001.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12086-0002.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12086-0003.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12086-0004.patch
diff --git a/meta/recipes-devtools/rsync/files/CVE-2024-12086-0001.patch b/meta/recipes-devtools/rsync/files/CVE-2024-12086-0001.patch
new file mode 100644
index 0000000000..958a25a37b
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2024-12086-0001.patch
@@ -0,0 +1,42 @@
+From 8ad4b5d912fad1df29717dddaa775724da77d299 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Sat, 23 Nov 2024 11:08:03 +1100
+Subject: [PATCH] refuse fuzzy options when fuzzy not selected
+
+this prevents a malicious server providing a file to compare to when
+the user has not given the fuzzy option
+
+CVE: CVE-2024-12086
+
+Upstream-Status: Backport [https://git.samba.org/?p=rsync.git;a=commit;h=8ad4b5d912fad1df29717dddaa775724da77d299]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ receiver.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/receiver.c b/receiver.c
+index 6b4b369e..2d7f6033 100644
+--- a/receiver.c
++++ b/receiver.c
+@@ -66,6 +66,7 @@ extern char sender_file_sum[MAX_DIGEST_LEN];
+ extern struct file_list *cur_flist, *first_flist, *dir_flist;
+ extern filter_rule_list daemon_filter_list;
+ extern OFF_T preallocated_len;
++extern int fuzzy_basis;
+
+ extern struct name_num_item *xfer_sum_nni;
+ extern int xfer_sum_len;
+@@ -716,6 +717,10 @@ int recv_files(int f_in, int f_out, char *local_name)
+ fnamecmp = get_backup_name(fname);
+ break;
+ case FNAMECMP_FUZZY:
++ if (fuzzy_basis == 0) {
++ rprintf(FERROR_XFER, "rsync: refusing malicious fuzzy operation for %s\n", xname);
++ exit_cleanup(RERR_PROTOCOL);
++ }
+ if (file->dirname) {
+ pathjoin(fnamecmpbuf, sizeof fnamecmpbuf, file->dirname, xname);
+ fnamecmp = fnamecmpbuf;
+--
+2.40.0
diff --git a/meta/recipes-devtools/rsync/files/CVE-2024-12086-0002.patch b/meta/recipes-devtools/rsync/files/CVE-2024-12086-0002.patch
new file mode 100644
index 0000000000..5d25f12dd8
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2024-12086-0002.patch
@@ -0,0 +1,108 @@
+From b4a27ca25d0abb6fcf14f41b7e11f3a6e1d8a4ff Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Sat, 23 Nov 2024 12:26:10 +1100
+Subject: [PATCH] added secure_relative_open()
+
+this is an open that enforces no symlink following for all path
+components in a relative path
+
+CVE: CVE-2024-12086
+
+Upstream-Status: Backport [https://git.samba.org/?p=rsync.git;a=commit;h=b4a27ca25d0abb6fcf14f41b7e11f3a6e1d8a4ff]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ syscall.c | 74 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 74 insertions(+)
+
+diff --git a/syscall.c b/syscall.c
+index b4b0f1f1..cffc814b 100644
+--- a/syscall.c
++++ b/syscall.c
+@@ -33,6 +33,8 @@
+ #include <sys/syscall.h>
+ #endif
+
++#include "ifuncs.h"
++
+ extern int dry_run;
+ extern int am_root;
+ extern int am_sender;
+@@ -707,3 +709,75 @@ int do_open_nofollow(const char *pathname, int flags)
+
+ return fd;
+ }
++
++/*
++ open a file relative to a base directory. The basedir can be NULL,
++ in which case the current working directory is used. The relpath
++ must be a relative path, and the relpath must not contain any
++ elements in the path which follow symlinks (ie. like O_NOFOLLOW, but
++ applies to all path components, not just the last component)
++*/
++int secure_relative_open(const char *basedir, const char *relpath, int flags, mode_t mode)
++{
++ if (!relpath || relpath[0] == '/') {
++ // must be a relative path
++ errno = EINVAL;
++ return -1;
++ }
++
++#if !defined(O_NOFOLLOW) || !defined(O_DIRECTORY)
++ // really old system, all we can do is live with the risks
++ if (!basedir) {
++ return open(relpath, flags, mode);
++ }
++ char fullpath[MAXPATHLEN];
++ pathjoin(fullpath, sizeof fullpath, basedir, relpath);
++ return open(fullpath, flags, mode);
++#else
++ int dirfd = AT_FDCWD;
++ if (basedir != NULL) {
++ dirfd = openat(AT_FDCWD, basedir, O_RDONLY | O_DIRECTORY);
++ if (dirfd == -1) {
++ return -1;
++ }
++ }
++ int retfd = -1;
++
++ char *path_copy = my_strdup(relpath, __FILE__, __LINE__);
++ if (!path_copy) {
++ return -1;
++ }
++
++ for (const char *part = strtok(path_copy, "/");
++ part != NULL;
++ part = strtok(NULL, "/"))
++ {
++ int next_fd = openat(dirfd, part, O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
++ if (next_fd == -1 && errno == ENOTDIR) {
++ if (strtok(NULL, "/") != NULL) {
++ // this is not the last component of the path
++ errno = ELOOP;
++ goto cleanup;
++ }
++ // this could be the last component of the path, try as a file
++ retfd = openat(dirfd, part, flags | O_NOFOLLOW, mode);
++ goto cleanup;
++ }
++ if (next_fd == -1) {
++ goto cleanup;
++ }
++ if (dirfd != AT_FDCWD) close(dirfd);
++ dirfd = next_fd;
++ }
++
++ // the path must be a directory
++ errno = EINVAL;
++
++cleanup:
++ free(path_copy);
++ if (dirfd != AT_FDCWD) {
++ close(dirfd);
++ }
++ return retfd;
++#endif // O_NOFOLLOW, O_DIRECTORY
++}
+--
+2.40.0
diff --git a/meta/recipes-devtools/rsync/files/CVE-2024-12086-0003.patch b/meta/recipes-devtools/rsync/files/CVE-2024-12086-0003.patch
new file mode 100644
index 0000000000..de1747adf2
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2024-12086-0003.patch
@@ -0,0 +1,108 @@
+From c35e28331f10ba6eba370611abd78bde32d54da7 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Sat, 23 Nov 2024 12:28:13 +1100
+Subject: [PATCH] receiver: use secure_relative_open() for basis file
+
+this prevents attacks where the basis file is manipulated by a
+malicious sender to gain information about files outside the
+destination tree
+
+CVE: CVE-2024-12086
+
+Upstream-Status: Backport [https://git.samba.org/?p=rsync.git;a=commit;h=c35e28331f10ba6eba370611abd78bde32d54da7]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ receiver.c | 42 ++++++++++++++++++++++++++----------------
+ 1 file changed, 26 insertions(+), 16 deletions(-)
+
+diff --git a/receiver.c b/receiver.c
+index 2d7f6033..8031b8f4 100644
+--- a/receiver.c
++++ b/receiver.c
+@@ -552,6 +552,8 @@ int recv_files(int f_in, int f_out, char *local_name)
+ progress_init();
+
+ while (1) {
++ const char *basedir = NULL;
++
+ cleanup_disable();
+
+ /* This call also sets cur_flist. */
+@@ -722,27 +724,29 @@ int recv_files(int f_in, int f_out, char *local_name)
+ exit_cleanup(RERR_PROTOCOL);
+ }
+ if (file->dirname) {
+- pathjoin(fnamecmpbuf, sizeof fnamecmpbuf, file->dirname, xname);
+- fnamecmp = fnamecmpbuf;
+- } else
+- fnamecmp = xname;
++ basedir = file->dirname;
++ }
++ fnamecmp = xname;
+ break;
+ default:
+ if (fnamecmp_type > FNAMECMP_FUZZY && fnamecmp_type-FNAMECMP_FUZZY <= basis_dir_cnt) {
+ fnamecmp_type -= FNAMECMP_FUZZY + 1;
+ if (file->dirname) {
+- stringjoin(fnamecmpbuf, sizeof fnamecmpbuf,
+- basis_dir[fnamecmp_type], "/", file->dirname, "/", xname, NULL);
+- } else
+- pathjoin(fnamecmpbuf, sizeof fnamecmpbuf, basis_dir[fnamecmp_type], xname);
++ pathjoin(fnamecmpbuf, sizeof fnamecmpbuf, basis_dir[fnamecmp_type], file->dirname);
++ basedir = fnamecmpbuf;
++ } else {
++ basedir = basis_dir[fnamecmp_type];
++ }
++ fnamecmp = xname;
+ } else if (fnamecmp_type >= basis_dir_cnt) {
+ rprintf(FERROR,
+ "invalid basis_dir index: %d.\n",
+ fnamecmp_type);
+ exit_cleanup(RERR_PROTOCOL);
+- } else
+- pathjoin(fnamecmpbuf, sizeof fnamecmpbuf, basis_dir[fnamecmp_type], fname);
+- fnamecmp = fnamecmpbuf;
++ } else {
++ basedir = basis_dir[fnamecmp_type];
++ fnamecmp = fname;
++ }
+ break;
+ }
+ if (!fnamecmp || (daemon_filter_list.head
+@@ -765,7 +769,7 @@ int recv_files(int f_in, int f_out, char *local_name)
+ }
+
+ /* open the file */
+- fd1 = do_open(fnamecmp, O_RDONLY, 0);
++ fd1 = secure_relative_open(basedir, fnamecmp, O_RDONLY, 0);
+
+ if (fd1 == -1 && protocol_version < 29) {
+ if (fnamecmp != fname) {
+@@ -776,14 +780,20 @@ int recv_files(int f_in, int f_out, char *local_name)
+
+ if (fd1 == -1 && basis_dir[0]) {
+ /* pre-29 allowed only one alternate basis */
+- pathjoin(fnamecmpbuf, sizeof fnamecmpbuf,
+- basis_dir[0], fname);
+- fnamecmp = fnamecmpbuf;
++ basedir = basis_dir[0];
++ fnamecmp = fname;
+ fnamecmp_type = FNAMECMP_BASIS_DIR_LOW;
+- fd1 = do_open(fnamecmp, O_RDONLY, 0);
++ fd1 = secure_relative_open(basedir, fnamecmp, O_RDONLY, 0);
+ }
+ }
+
++ if (basedir) {
++ // for the following code we need the full
++ // path name as a single string
++ pathjoin(fnamecmpbuf, sizeof fnamecmpbuf, basedir, fnamecmp);
++ fnamecmp = fnamecmpbuf;
++ }
++
+ one_inplace = inplace_partial && fnamecmp_type == FNAMECMP_PARTIAL_DIR;
+ updating_basis_or_equiv = one_inplace
+ || (inplace && (fnamecmp == fname || fnamecmp_type == FNAMECMP_BACKUP));
+--
+2.40.0
diff --git a/meta/recipes-devtools/rsync/files/CVE-2024-12086-0004.patch b/meta/recipes-devtools/rsync/files/CVE-2024-12086-0004.patch
new file mode 100644
index 0000000000..b85e1dfae4
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2024-12086-0004.patch
@@ -0,0 +1,41 @@
+From 9f86ddc9652247233f32b241a79d5aa4fb9d4afa Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Tue, 26 Nov 2024 09:16:31 +1100
+Subject: [PATCH] disallow ../ elements in relpath for secure_relative_open
+
+CVE: CVE-2024-12086
+
+Upstream-Status: Backport [https://git.samba.org/?p=rsync.git;a=commit;h=9f86ddc9652247233f32b241a79d5aa4fb9d4afa]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ syscall.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/syscall.c b/syscall.c
+index cffc814b..081357bb 100644
+--- a/syscall.c
++++ b/syscall.c
+@@ -716,6 +716,8 @@ int do_open_nofollow(const char *pathname, int flags)
+ must be a relative path, and the relpath must not contain any
+ elements in the path which follow symlinks (ie. like O_NOFOLLOW, but
+ applies to all path components, not just the last component)
++
++ The relpath must also not contain any ../ elements in the path
+ */
+ int secure_relative_open(const char *basedir, const char *relpath, int flags, mode_t mode)
+ {
+@@ -724,6 +726,11 @@ int secure_relative_open(const char *basedir, const char *relpath, int flags, mo
+ errno = EINVAL;
+ return -1;
+ }
++ if (strncmp(relpath, "../", 3) == 0 || strstr(relpath, "/../")) {
++ // no ../ elements allowed in the relpath
++ errno = EINVAL;
++ return -1;
++ }
+
+ #if !defined(O_NOFOLLOW) || !defined(O_DIRECTORY)
+ // really old system, all we can do is live with the risks
+--
+2.40.0
diff --git a/meta/recipes-devtools/rsync/rsync_3.2.7.bb b/meta/recipes-devtools/rsync/rsync_3.2.7.bb
index 0d9c68a915..0bde73aad2 100644
--- a/meta/recipes-devtools/rsync/rsync_3.2.7.bb
+++ b/meta/recipes-devtools/rsync/rsync_3.2.7.bb
@@ -18,6 +18,10 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
file://CVE-2024-12084-0001.patch \
file://CVE-2024-12084-0002.patch \
file://CVE-2024-12085.patch \
+ file://CVE-2024-12086-0001.patch \
+ file://CVE-2024-12086-0002.patch \
+ file://CVE-2024-12086-0003.patch \
+ file://CVE-2024-12086-0004.patch \
"
SRC_URI[sha256sum] = "4e7d9d3f6ed10878c58c5fb724a67dacf4b6aac7340b13e488fb2dc41346f2bb"
--
2.43.0
^ permalink raw reply related [flat|nested] 16+ messages in thread
* [OE-core][scarthgap 4/8] rsync: fix CVE-2024-12087
2025-01-23 2:59 [OE-core][scarthgap 0/8] Patch review Steve Sakoman
` (2 preceding siblings ...)
2025-01-23 2:59 ` [OE-core][scarthgap 3/8] rsync: fix CVE-2024-12086 Steve Sakoman
@ 2025-01-23 2:59 ` Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 5/8] rsync: fix CVE-2024-12088 Steve Sakoman
` (3 subsequent siblings)
7 siblings, 0 replies; 16+ messages in thread
From: Steve Sakoman @ 2025-01-23 2:59 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
A path traversal vulnerability exists in rsync. It stems from behavior enabled
by the `--inc-recursive` option, a default-enabled option for many client options
and can be enabled by the server even if not explicitly enabled by the client.
When using the `--inc-recursive` option, a lack of proper symlink verification
coupled with deduplication checks occurring on a per-file-list basis could allow
a server to write files outside of the client's intended destination directory.
A malicious server could write malicious files to arbitrary locations named after
valid directories/paths on the client.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../rsync/files/CVE-2024-12087-0001.patch | 49 +++++++++++++++++++
.../rsync/files/CVE-2024-12087-0002.patch | 31 ++++++++++++
.../rsync/files/CVE-2024-12087-0003.patch | 40 +++++++++++++++
meta/recipes-devtools/rsync/rsync_3.2.7.bb | 3 ++
4 files changed, 123 insertions(+)
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12087-0001.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12087-0002.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12087-0003.patch
diff --git a/meta/recipes-devtools/rsync/files/CVE-2024-12087-0001.patch b/meta/recipes-devtools/rsync/files/CVE-2024-12087-0001.patch
new file mode 100644
index 0000000000..67abc64a62
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2024-12087-0001.patch
@@ -0,0 +1,49 @@
+From 688f5c379a433038bde36897a156d589be373a98 Mon Sep 17 00:00:00 2001
+From: Wayne Davison <wayne@opencoder.net>
+Date: Thu, 14 Nov 2024 15:46:50 -0800
+Subject: [PATCH] Refuse a duplicate dirlist.
+
+CVE: CVE-2024-12087
+
+Upstream-Status: Backport [https://git.samba.org/?p=rsync.git;a=commit;h=688f5c379a433038bde36897a156d589be373a98]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ flist.c | 9 +++++++++
+ rsync.h | 1 +
+ 2 files changed, 10 insertions(+)
+
+diff --git a/flist.c b/flist.c
+index 464d556e..847b1054 100644
+--- a/flist.c
++++ b/flist.c
+@@ -2584,6 +2584,15 @@ struct file_list *recv_file_list(int f, int dir_ndx)
+ init_hard_links();
+ #endif
+
++ if (inc_recurse && dir_ndx >= 0) {
++ struct file_struct *file = dir_flist->files[dir_ndx];
++ if (file->flags & FLAG_GOT_DIR_FLIST) {
++ rprintf(FERROR_XFER, "rsync: refusing malicious duplicate flist for dir %d\n", dir_ndx);
++ exit_cleanup(RERR_PROTOCOL);
++ }
++ file->flags |= FLAG_GOT_DIR_FLIST;
++ }
++
+ flist = flist_new(0, "recv_file_list");
+ flist_expand(flist, FLIST_START_LARGE);
+
+diff --git a/rsync.h b/rsync.h
+index 0f9e277f..b9a7101a 100644
+--- a/rsync.h
++++ b/rsync.h
+@@ -84,6 +84,7 @@
+ #define FLAG_DUPLICATE (1<<4) /* sender */
+ #define FLAG_MISSING_DIR (1<<4) /* generator */
+ #define FLAG_HLINKED (1<<5) /* receiver/generator (checked on all types) */
++#define FLAG_GOT_DIR_FLIST (1<<5)/* sender/receiver/generator - dir_flist only */
+ #define FLAG_HLINK_FIRST (1<<6) /* receiver/generator (w/FLAG_HLINKED) */
+ #define FLAG_IMPLIED_DIR (1<<6) /* sender/receiver/generator (dirs only) */
+ #define FLAG_HLINK_LAST (1<<7) /* receiver/generator */
+--
+2.40.0
diff --git a/meta/recipes-devtools/rsync/files/CVE-2024-12087-0002.patch b/meta/recipes-devtools/rsync/files/CVE-2024-12087-0002.patch
new file mode 100644
index 0000000000..8a22e0c371
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2024-12087-0002.patch
@@ -0,0 +1,31 @@
+From 344327385fa47fa5bb67a32c237735e6240cfb93 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Tue, 26 Nov 2024 16:12:45 +1100
+Subject: [PATCH] range check dir_ndx before use
+
+CVE: CVE-2024-12087
+
+Upstream-Status: Backport [https://git.samba.org/?p=rsync.git;a=commit;h=344327385fa47fa5bb67a32c237735e6240cfb93]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ flist.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/flist.c b/flist.c
+index 847b1054..087f9da6 100644
+--- a/flist.c
++++ b/flist.c
+@@ -2585,6 +2585,10 @@ struct file_list *recv_file_list(int f, int dir_ndx)
+ #endif
+
+ if (inc_recurse && dir_ndx >= 0) {
++ if (dir_ndx >= dir_flist->used) {
++ rprintf(FERROR_XFER, "rsync: refusing invalid dir_ndx %u >= %u\n", dir_ndx, dir_flist->used);
++ exit_cleanup(RERR_PROTOCOL);
++ }
+ struct file_struct *file = dir_flist->files[dir_ndx];
+ if (file->flags & FLAG_GOT_DIR_FLIST) {
+ rprintf(FERROR_XFER, "rsync: refusing malicious duplicate flist for dir %d\n", dir_ndx);
+--
+2.40.0
diff --git a/meta/recipes-devtools/rsync/files/CVE-2024-12087-0003.patch b/meta/recipes-devtools/rsync/files/CVE-2024-12087-0003.patch
new file mode 100644
index 0000000000..0ece69c4e7
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2024-12087-0003.patch
@@ -0,0 +1,40 @@
+From 996af4a79f9afe4d7158ecdd87c78cee382c6b39 Mon Sep 17 00:00:00 2001
+From: Natanael Copa <ncopa@alpinelinux.org>
+Date: Wed, 15 Jan 2025 15:10:24 +0100
+Subject: [PATCH] Fix FLAG_GOT_DIR_FLIST collission with FLAG_HLINKED
+
+fixes commit 688f5c379a43 (Refuse a duplicate dirlist.)
+
+Fixes: https://github.com/RsyncProject/rsync/issues/702
+Fixes: https://github.com/RsyncProject/rsync/issues/697
+CVE: CVE-2024-12087
+
+Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/996af4a79f9afe4d7158ecdd87c78cee382c6b39]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ rsync.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/rsync.h b/rsync.h
+index 9be1297b..479ac484 100644
+--- a/rsync.h
++++ b/rsync.h
+@@ -84,7 +84,6 @@
+ #define FLAG_DUPLICATE (1<<4) /* sender */
+ #define FLAG_MISSING_DIR (1<<4) /* generator */
+ #define FLAG_HLINKED (1<<5) /* receiver/generator (checked on all types) */
+-#define FLAG_GOT_DIR_FLIST (1<<5)/* sender/receiver/generator - dir_flist only */
+ #define FLAG_HLINK_FIRST (1<<6) /* receiver/generator (w/FLAG_HLINKED) */
+ #define FLAG_IMPLIED_DIR (1<<6) /* sender/receiver/generator (dirs only) */
+ #define FLAG_HLINK_LAST (1<<7) /* receiver/generator */
+@@ -93,6 +92,7 @@
+ #define FLAG_SKIP_GROUP (1<<10) /* receiver/generator */
+ #define FLAG_TIME_FAILED (1<<11)/* generator */
+ #define FLAG_MOD_NSEC (1<<12) /* sender/receiver/generator */
++#define FLAG_GOT_DIR_FLIST (1<<13)/* sender/receiver/generator - dir_flist only */
+
+ /* These flags are passed to functions but not stored. */
+
+--
+2.40.0
diff --git a/meta/recipes-devtools/rsync/rsync_3.2.7.bb b/meta/recipes-devtools/rsync/rsync_3.2.7.bb
index 0bde73aad2..d6942dc595 100644
--- a/meta/recipes-devtools/rsync/rsync_3.2.7.bb
+++ b/meta/recipes-devtools/rsync/rsync_3.2.7.bb
@@ -22,6 +22,9 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
file://CVE-2024-12086-0002.patch \
file://CVE-2024-12086-0003.patch \
file://CVE-2024-12086-0004.patch \
+ file://CVE-2024-12087-0001.patch \
+ file://CVE-2024-12087-0002.patch \
+ file://CVE-2024-12087-0003.patch \
"
SRC_URI[sha256sum] = "4e7d9d3f6ed10878c58c5fb724a67dacf4b6aac7340b13e488fb2dc41346f2bb"
--
2.43.0
^ permalink raw reply related [flat|nested] 16+ messages in thread
* [OE-core][scarthgap 5/8] rsync: fix CVE-2024-12088
2025-01-23 2:59 [OE-core][scarthgap 0/8] Patch review Steve Sakoman
` (3 preceding siblings ...)
2025-01-23 2:59 ` [OE-core][scarthgap 4/8] rsync: fix CVE-2024-12087 Steve Sakoman
@ 2025-01-23 2:59 ` Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 6/8] rsync: fix CVE-2024-12747 Steve Sakoman
` (2 subsequent siblings)
7 siblings, 0 replies; 16+ messages in thread
From: Steve Sakoman @ 2025-01-23 2:59 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
A flaw was found in rsync. When using the `--safe-links` option, rsync fails to
properly verify if a symbolic link destination contains another symbolic link within it.
This results in a path traversal vulnerability, which may lead to arbitrary file write
outside the desired directory.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../rsync/files/CVE-2024-12088.patch | 141 ++++++++++++++++++
meta/recipes-devtools/rsync/rsync_3.2.7.bb | 1 +
2 files changed, 142 insertions(+)
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12088.patch
diff --git a/meta/recipes-devtools/rsync/files/CVE-2024-12088.patch b/meta/recipes-devtools/rsync/files/CVE-2024-12088.patch
new file mode 100644
index 0000000000..b2a3a86e1a
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2024-12088.patch
@@ -0,0 +1,141 @@
+From 407c71c7ce562137230e8ba19149c81ccc47c387 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Sat, 23 Nov 2024 15:15:53 +1100
+Subject: [PATCH] make --safe-links stricter
+
+when --safe-links is used also reject links where a '../' component is
+included in the destination as other than the leading part of the
+filename
+
+CVE: CVE-2024-12088
+
+Upstream-Status: Backport [https://git.samba.org/?p=rsync.git;a=commit;h=407c71c7ce562137230e8ba19149c81ccc47c387]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ testsuite/safe-links.test | 55 ++++++++++++++++++++++++++++++++++++
+ testsuite/unsafe-byname.test | 2 +-
+ util1.c | 26 ++++++++++++++++-
+ 3 files changed, 81 insertions(+), 2 deletions(-)
+ create mode 100644 testsuite/safe-links.test
+
+diff --git a/testsuite/safe-links.test b/testsuite/safe-links.test
+new file mode 100644
+index 00000000..6e95a4b9
+--- /dev/null
++++ b/testsuite/safe-links.test
+@@ -0,0 +1,55 @@
++#!/bin/sh
++
++. "$suitedir/rsync.fns"
++
++test_symlink() {
++ is_a_link "$1" || test_fail "File $1 is not a symlink"
++}
++
++test_regular() {
++ if [ ! -f "$1" ]; then
++ test_fail "File $1 is not regular file or not exists"
++ fi
++}
++
++test_notexist() {
++ if [ -e "$1" ]; then
++ test_fail "File $1 exists"
++ fi
++ if [ -h "$1" ]; then
++ test_fail "File $1 exists as a symlink"
++ fi
++}
++
++cd "$tmpdir"
++
++mkdir from
++
++mkdir "from/safe"
++mkdir "from/unsafe"
++
++mkdir "from/safe/files"
++mkdir "from/safe/links"
++
++touch "from/safe/files/file1"
++touch "from/safe/files/file2"
++touch "from/unsafe/unsafefile"
++
++ln -s ../files/file1 "from/safe/links/"
++ln -s ../files/file2 "from/safe/links/"
++ln -s ../../unsafe/unsafefile "from/safe/links/"
++ln -s a/a/a/../../../unsafe2 "from/safe/links/"
++
++#echo "LISTING FROM"
++#ls -lR from
++
++echo "rsync with relative path and just -a"
++$RSYNC -avv --safe-links from/safe/ to
++
++#echo "LISTING TO"
++#ls -lR to
++
++test_symlink to/links/file1
++test_symlink to/links/file2
++test_notexist to/links/unsafefile
++test_notexist to/links/unsafe2
+diff --git a/testsuite/unsafe-byname.test b/testsuite/unsafe-byname.test
+index 75e72014..d2e318ef 100644
+--- a/testsuite/unsafe-byname.test
++++ b/testsuite/unsafe-byname.test
+@@ -40,7 +40,7 @@ test_unsafe ..//../dest from/dir unsafe
+ test_unsafe .. from/file safe
+ test_unsafe ../.. from/file unsafe
+ test_unsafe ..//.. from//file unsafe
+-test_unsafe dir/.. from safe
++test_unsafe dir/.. from unsafe
+ test_unsafe dir/../.. from unsafe
+ test_unsafe dir/..//.. from unsafe
+
+diff --git a/util1.c b/util1.c
+index da50ff1e..f260d398 100644
+--- a/util1.c
++++ b/util1.c
+@@ -1318,7 +1318,14 @@ int handle_partial_dir(const char *fname, int create)
+ *
+ * "src" is the top source directory currently applicable at the level
+ * of the referenced symlink. This is usually the symlink's full path
+- * (including its name), as referenced from the root of the transfer. */
++ * (including its name), as referenced from the root of the transfer.
++ *
++ * NOTE: this also rejects dest names with a .. component in other
++ * than the first component of the name ie. it rejects names such as
++ * a/b/../x/y. This needs to be done as the leading subpaths 'a' or
++ * 'b' could later be replaced with symlinks such as a link to '.'
++ * resulting in the link being transferred now becoming unsafe
++ */
+ int unsafe_symlink(const char *dest, const char *src)
+ {
+ const char *name, *slash;
+@@ -1328,6 +1335,23 @@ int unsafe_symlink(const char *dest, const char *src)
+ if (!dest || !*dest || *dest == '/')
+ return 1;
+
++ // reject destinations with /../ in the name other than at the start of the name
++ const char *dest2 = dest;
++ while (strncmp(dest2, "../", 3) == 0) {
++ dest2 += 3;
++ while (*dest2 == '/') {
++ // allow for ..//..///../foo
++ dest2++;
++ }
++ }
++ if (strstr(dest2, "/../"))
++ return 1;
++
++ // reject if the destination ends in /..
++ const size_t dlen = strlen(dest);
++ if (dlen > 3 && strcmp(&dest[dlen-3], "/..") == 0)
++ return 1;
++
+ /* find out what our safety margin is */
+ for (name = src; (slash = strchr(name, '/')) != 0; name = slash+1) {
+ /* ".." segment starts the count over. "." segment is ignored. */
+--
+2.40.0
diff --git a/meta/recipes-devtools/rsync/rsync_3.2.7.bb b/meta/recipes-devtools/rsync/rsync_3.2.7.bb
index d6942dc595..169650fe91 100644
--- a/meta/recipes-devtools/rsync/rsync_3.2.7.bb
+++ b/meta/recipes-devtools/rsync/rsync_3.2.7.bb
@@ -25,6 +25,7 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
file://CVE-2024-12087-0001.patch \
file://CVE-2024-12087-0002.patch \
file://CVE-2024-12087-0003.patch \
+ file://CVE-2024-12088.patch \
"
SRC_URI[sha256sum] = "4e7d9d3f6ed10878c58c5fb724a67dacf4b6aac7340b13e488fb2dc41346f2bb"
--
2.43.0
^ permalink raw reply related [flat|nested] 16+ messages in thread
* [OE-core][scarthgap 6/8] rsync: fix CVE-2024-12747
2025-01-23 2:59 [OE-core][scarthgap 0/8] Patch review Steve Sakoman
` (4 preceding siblings ...)
2025-01-23 2:59 ` [OE-core][scarthgap 5/8] rsync: fix CVE-2024-12088 Steve Sakoman
@ 2025-01-23 2:59 ` Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 7/8] rust-target-config: Fix TARGET_C_INT_WIDTH with correct size Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 8/8] boost: fix do_fetch error Steve Sakoman
7 siblings, 0 replies; 16+ messages in thread
From: Steve Sakoman @ 2025-01-23 2:59 UTC (permalink / raw)
To: openembedded-core
From: Archana Polampalli <archana.polampalli@windriver.com>
A flaw was found in rsync. This vulnerability arises from a race condition during
rsync's handling of symbolic links. Rsync's default behavior when encountering
symbolic links is to skip them. If an attacker replaced a regular file with a
symbolic link at the right time, it was possible to bypass the default behavior
and traverse symbolic links. Depending on the privileges of the rsync process,
an attacker could leak sensitive information, potentially leading to privilege escalation.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../rsync/files/CVE-2024-12747.patch | 192 ++++++++++++++++++
meta/recipes-devtools/rsync/rsync_3.2.7.bb | 1 +
2 files changed, 193 insertions(+)
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12747.patch
diff --git a/meta/recipes-devtools/rsync/files/CVE-2024-12747.patch b/meta/recipes-devtools/rsync/files/CVE-2024-12747.patch
new file mode 100644
index 0000000000..b1dd0a03b9
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2024-12747.patch
@@ -0,0 +1,192 @@
+From 0590b09d9a34ae72741b91ec0708a820650198b0 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Wed, 18 Dec 2024 08:59:42 +1100
+Subject: [PATCH] fixed symlink race condition in sender
+
+when we open a file that we don't expect to be a symlink use
+O_NOFOLLOW to prevent a race condition where an attacker could change
+a file between being a normal file and a symlink
+
+CVE: CVE-2024-12747
+
+Upstream-Status: Backport [https://git.samba.org/?p=rsync.git;a=commit;h=0590b09d9a34ae72741b91ec0708a820650198b0]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ checksum.c | 2 +-
+ flist.c | 2 +-
+ generator.c | 4 ++--
+ receiver.c | 2 +-
+ sender.c | 2 +-
+ syscall.c | 20 ++++++++++++++++++++
+ t_unsafe.c | 3 +++
+ tls.c | 3 +++
+ trimslash.c | 2 ++
+ util1.c | 2 +-
+ 10 files changed, 35 insertions(+), 7 deletions(-)
+
+diff --git a/checksum.c b/checksum.c
+index cb21882c..66e80896 100644
+--- a/checksum.c
++++ b/checksum.c
+@@ -406,7 +406,7 @@ void file_checksum(const char *fname, const STRUCT_STAT *st_p, char *sum)
+ int32 remainder;
+ int fd;
+
+- fd = do_open(fname, O_RDONLY, 0);
++ fd = do_open_checklinks(fname);
+ if (fd == -1) {
+ memset(sum, 0, file_sum_len);
+ return;
+diff --git a/flist.c b/flist.c
+index 087f9da6..17832533 100644
+--- a/flist.c
++++ b/flist.c
+@@ -1390,7 +1390,7 @@ struct file_struct *make_file(const char *fname, struct file_list *flist,
+
+ if (copy_devices && am_sender && IS_DEVICE(st.st_mode)) {
+ if (st.st_size == 0) {
+- int fd = do_open(fname, O_RDONLY, 0);
++ int fd = do_open_checklinks(fname);
+ if (fd >= 0) {
+ st.st_size = get_device_size(fd, fname);
+ close(fd);
+diff --git a/generator.c b/generator.c
+index 110db28f..3f13bb95 100644
+--- a/generator.c
++++ b/generator.c
+@@ -1798,7 +1798,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
+
+ if (write_devices && IS_DEVICE(sx.st.st_mode) && sx.st.st_size == 0) {
+ /* This early open into fd skips the regular open below. */
+- if ((fd = do_open(fnamecmp, O_RDONLY, 0)) >= 0)
++ if ((fd = do_open_nofollow(fnamecmp, O_RDONLY)) >= 0)
+ real_sx.st.st_size = sx.st.st_size = get_device_size(fd, fnamecmp);
+ }
+
+@@ -1867,7 +1867,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
+ }
+
+ /* open the file */
+- if (fd < 0 && (fd = do_open(fnamecmp, O_RDONLY, 0)) < 0) {
++ if (fd < 0 && (fd = do_open_checklinks(fnamecmp)) < 0) {
+ rsyserr(FERROR, errno, "failed to open %s, continuing",
+ full_fname(fnamecmp));
+ pretend_missing:
+diff --git a/receiver.c b/receiver.c
+index 8031b8f4..edfbb210 100644
+--- a/receiver.c
++++ b/receiver.c
+@@ -775,7 +775,7 @@ int recv_files(int f_in, int f_out, char *local_name)
+ if (fnamecmp != fname) {
+ fnamecmp = fname;
+ fnamecmp_type = FNAMECMP_FNAME;
+- fd1 = do_open(fnamecmp, O_RDONLY, 0);
++ fd1 = do_open_nofollow(fnamecmp, O_RDONLY);
+ }
+
+ if (fd1 == -1 && basis_dir[0]) {
+diff --git a/sender.c b/sender.c
+index 2bbff2fa..a4d46c39 100644
+--- a/sender.c
++++ b/sender.c
+@@ -350,7 +350,7 @@ void send_files(int f_in, int f_out)
+ exit_cleanup(RERR_PROTOCOL);
+ }
+
+- fd = do_open(fname, O_RDONLY, 0);
++ fd = do_open_checklinks(fname);
+ if (fd == -1) {
+ if (errno == ENOENT) {
+ enum logcode c = am_daemon && protocol_version < 28 ? FERROR : FWARNING;
+diff --git a/syscall.c b/syscall.c
+index 081357bb..8cea2900 100644
+--- a/syscall.c
++++ b/syscall.c
+@@ -45,6 +45,8 @@ extern int preallocate_files;
+ extern int preserve_perms;
+ extern int preserve_executability;
+ extern int open_noatime;
++extern int copy_links;
++extern int copy_unsafe_links;
+
+ #ifndef S_BLKSIZE
+ # if defined hpux || defined __hpux__ || defined __hpux
+@@ -788,3 +790,21 @@ cleanup:
+ return retfd;
+ #endif // O_NOFOLLOW, O_DIRECTORY
+ }
++
++/*
++ varient of do_open/do_open_nofollow which does do_open() if the
++ copy_links or copy_unsafe_links options are set and does
++ do_open_nofollow() otherwise
++
++ This is used to prevent a race condition where an attacker could be
++ switching a file between being a symlink and being a normal file
++
++ The open is always done with O_RDONLY flags
++ */
++int do_open_checklinks(const char *pathname)
++{
++ if (copy_links || copy_unsafe_links) {
++ return do_open(pathname, O_RDONLY, 0);
++ }
++ return do_open_nofollow(pathname, O_RDONLY);
++}
+diff --git a/t_unsafe.c b/t_unsafe.c
+index 010cac50..e10619a2 100644
+--- a/t_unsafe.c
++++ b/t_unsafe.c
+@@ -28,6 +28,9 @@ int am_root = 0;
+ int am_sender = 1;
+ int read_only = 0;
+ int list_only = 0;
++int copy_links = 0;
++int copy_unsafe_links = 0;
++
+ short info_levels[COUNT_INFO], debug_levels[COUNT_DEBUG];
+
+ int
+diff --git a/tls.c b/tls.c
+index e6b0708a..858f8f10 100644
+--- a/tls.c
++++ b/tls.c
+@@ -49,6 +49,9 @@ int list_only = 0;
+ int link_times = 0;
+ int link_owner = 0;
+ int nsec_times = 0;
++int safe_symlinks = 0;
++int copy_links = 0;
++int copy_unsafe_links = 0;
+
+ #ifdef SUPPORT_XATTRS
+
+diff --git a/trimslash.c b/trimslash.c
+index 1ec928ca..f2774cd7 100644
+--- a/trimslash.c
++++ b/trimslash.c
+@@ -26,6 +26,8 @@ int am_root = 0;
+ int am_sender = 1;
+ int read_only = 1;
+ int list_only = 0;
++int copy_links = 0;
++int copy_unsafe_links = 0;
+
+ int
+ main(int argc, char **argv)
+diff --git a/util1.c b/util1.c
+index f260d398..d84bc414 100644
+--- a/util1.c
++++ b/util1.c
+@@ -365,7 +365,7 @@ int copy_file(const char *source, const char *dest, int tmpfilefd, mode_t mode)
+ int len; /* Number of bytes read into `buf'. */
+ OFF_T prealloc_len = 0, offset = 0;
+
+- if ((ifd = do_open(source, O_RDONLY, 0)) < 0) {
++ if ((ifd = do_open_nofollow(source, O_RDONLY)) < 0) {
+ int save_errno = errno;
+ rsyserr(FERROR_XFER, errno, "open %s", full_fname(source));
+ errno = save_errno;
+--
+2.40.0
diff --git a/meta/recipes-devtools/rsync/rsync_3.2.7.bb b/meta/recipes-devtools/rsync/rsync_3.2.7.bb
index 169650fe91..d0796d3c12 100644
--- a/meta/recipes-devtools/rsync/rsync_3.2.7.bb
+++ b/meta/recipes-devtools/rsync/rsync_3.2.7.bb
@@ -26,6 +26,7 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
file://CVE-2024-12087-0002.patch \
file://CVE-2024-12087-0003.patch \
file://CVE-2024-12088.patch \
+ file://CVE-2024-12747.patch \
"
SRC_URI[sha256sum] = "4e7d9d3f6ed10878c58c5fb724a67dacf4b6aac7340b13e488fb2dc41346f2bb"
--
2.43.0
^ permalink raw reply related [flat|nested] 16+ messages in thread
* [OE-core][scarthgap 7/8] rust-target-config: Fix TARGET_C_INT_WIDTH with correct size
2025-01-23 2:59 [OE-core][scarthgap 0/8] Patch review Steve Sakoman
` (5 preceding siblings ...)
2025-01-23 2:59 ` [OE-core][scarthgap 6/8] rsync: fix CVE-2024-12747 Steve Sakoman
@ 2025-01-23 2:59 ` Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 8/8] boost: fix do_fetch error Steve Sakoman
7 siblings, 0 replies; 16+ messages in thread
From: Steve Sakoman @ 2025-01-23 2:59 UTC (permalink / raw)
To: openembedded-core
From: Harish Sadineni <Harish.Sadineni@windriver.com>
[YOCTO #15600]
The TARGET_C_INT_WIDTH value was incorrectly set to 64 instead of 32.
It is updated for PPC, Mips, and riscv64 architectures.
Discussion links for solution:
https://lists.openembedded.org/g/openembedded-core/message/207486
https://lists.openembedded.org/g/openembedded-core/message/207496
Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b9df8cd8b29064d115dab3bfd1ea14f94a5c0238)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes-recipe/rust-target-config.bbclass | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/meta/classes-recipe/rust-target-config.bbclass b/meta/classes-recipe/rust-target-config.bbclass
index 926b0630b1..1bd7626bd8 100644
--- a/meta/classes-recipe/rust-target-config.bbclass
+++ b/meta/classes-recipe/rust-target-config.bbclass
@@ -195,7 +195,7 @@ MAX_ATOMIC_WIDTH[mipsel] = "32"
DATA_LAYOUT[mips64] = "E-m:e-i8:8:32-i16:16:32-i64:64-n32:64-S128"
TARGET_ENDIAN[mips64] = "big"
TARGET_POINTER_WIDTH[mips64] = "64"
-TARGET_C_INT_WIDTH[mips64] = "64"
+TARGET_C_INT_WIDTH[mips64] = "32"
MAX_ATOMIC_WIDTH[mips64] = "64"
## mips64-n32-unknown-linux-{gnu, musl}
@@ -209,7 +209,7 @@ MAX_ATOMIC_WIDTH[mips64-n32] = "64"
DATA_LAYOUT[mips64el] = "e-m:e-i8:8:32-i16:16:32-i64:64-n32:64-S128"
TARGET_ENDIAN[mips64el] = "little"
TARGET_POINTER_WIDTH[mips64el] = "64"
-TARGET_C_INT_WIDTH[mips64el] = "64"
+TARGET_C_INT_WIDTH[mips64el] = "32"
MAX_ATOMIC_WIDTH[mips64el] = "64"
## powerpc-unknown-linux-{gnu, musl}
@@ -223,14 +223,14 @@ MAX_ATOMIC_WIDTH[powerpc] = "32"
DATA_LAYOUT[powerpc64] = "E-m:e-i64:64-n32:64-S128-v256:256:256-v512:512:512"
TARGET_ENDIAN[powerpc64] = "big"
TARGET_POINTER_WIDTH[powerpc64] = "64"
-TARGET_C_INT_WIDTH[powerpc64] = "64"
+TARGET_C_INT_WIDTH[powerpc64] = "32"
MAX_ATOMIC_WIDTH[powerpc64] = "64"
## powerpc64le-unknown-linux-{gnu, musl}
DATA_LAYOUT[powerpc64le] = "e-m:e-i64:64-n32:64-v256:256:256-v512:512:512"
TARGET_ENDIAN[powerpc64le] = "little"
TARGET_POINTER_WIDTH[powerpc64le] = "64"
-TARGET_C_INT_WIDTH[powerpc64le] = "64"
+TARGET_C_INT_WIDTH[powerpc64le] = "32"
MAX_ATOMIC_WIDTH[powerpc64le] = "64"
## riscv32gc-unknown-linux-{gnu, musl}
@@ -244,7 +244,7 @@ MAX_ATOMIC_WIDTH[riscv32gc] = "32"
DATA_LAYOUT[riscv64gc] = "e-m:e-p:64:64-i64:64-i128:128-n64-S128"
TARGET_ENDIAN[riscv64gc] = "little"
TARGET_POINTER_WIDTH[riscv64gc] = "64"
-TARGET_C_INT_WIDTH[riscv64gc] = "64"
+TARGET_C_INT_WIDTH[riscv64gc] = "32"
MAX_ATOMIC_WIDTH[riscv64gc] = "64"
## loongarch64-unknown-linux-{gnu, musl}
--
2.43.0
^ permalink raw reply related [flat|nested] 16+ messages in thread
* [OE-core][scarthgap 8/8] boost: fix do_fetch error
2025-01-23 2:59 [OE-core][scarthgap 0/8] Patch review Steve Sakoman
` (6 preceding siblings ...)
2025-01-23 2:59 ` [OE-core][scarthgap 7/8] rust-target-config: Fix TARGET_C_INT_WIDTH with correct size Steve Sakoman
@ 2025-01-23 2:59 ` Steve Sakoman
7 siblings, 0 replies; 16+ messages in thread
From: Steve Sakoman @ 2025-01-23 2:59 UTC (permalink / raw)
To: openembedded-core
From: Jiaying Song <jiaying.song.cn@windriver.com>
Change the SRC_URI to the correct value due to the following error:
WARNING: boost-native-1.84.0-r0 do_fetch: Checksum failure encountered with download of https://boostorg.jfrog.io/artifactory/main/release/1.84.0/source/boost_1_84_0.tar.bz2 - will attempt other sources if available
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-support/boost/boost-1.84.0.inc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-support/boost/boost-1.84.0.inc b/meta/recipes-support/boost/boost-1.84.0.inc
index 5bbea2ba5b..be1ad20f47 100644
--- a/meta/recipes-support/boost/boost-1.84.0.inc
+++ b/meta/recipes-support/boost/boost-1.84.0.inc
@@ -11,7 +11,7 @@ BOOST_VER = "${@"_".join(d.getVar("PV").split("."))}"
BOOST_MAJ = "${@"_".join(d.getVar("PV").split(".")[0:2])}"
BOOST_P = "boost_${BOOST_VER}"
-SRC_URI = "https://boostorg.jfrog.io/artifactory/main/release/${PV}/source/${BOOST_P}.tar.bz2"
+SRC_URI = "https://archives.boost.io/release/${PV}/source/${BOOST_P}.tar.bz2"
SRC_URI[sha256sum] = "cc4b893acf645c9d4b698e9a0f08ca8846aa5d6c68275c14c3e7949c24109454"
UPSTREAM_CHECK_URI = "http://www.boost.org/users/download/"
--
2.43.0
^ permalink raw reply related [flat|nested] 16+ messages in thread
* [OE-core][scarthgap 0/8] Patch review
@ 2025-04-11 20:33 Steve Sakoman
0 siblings, 0 replies; 16+ messages in thread
From: Steve Sakoman @ 2025-04-11 20:33 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Tuesday, April 15
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1386
Note: there was a failure during oe-selftest-fedora cve_check which is related to NFS issues on the autobuilder infrastructure and not this patch set
The following changes since commit 4003b5faa1e5acfa025e1d0df4e021e06cf8724c:
mc: set ac_cv_path_ZIP to avoid buildpaths QA issues (2025-04-01 08:10:07 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Archana Polampalli (2):
go: fix CVE-2025-22870
ghostscript: upgrade 10.04.0 -> 10.05.0
Changqing Li (1):
patch.py: set commituser and commitemail for addNote
Hitendra Prajapati (1):
go: fix CVE-2025-22871
Peter Marko (4):
ofono: patch CVE-2024-7537
cve-update-nvd2-native: add workaround for json5 style list
xz: upgrade 5.4.6 -> 5.4.7
xz: patch CVE-2025-31115
meta/lib/oe/patch.py | 14 +-
.../ofono/ofono/CVE-2024-7537.patch | 59 ++++++
meta/recipes-connectivity/ofono/ofono_2.4.bb | 1 +
.../meta/cve-update-nvd2-native.bb | 5 +
meta/recipes-devtools/go/go-1.22.12.inc | 2 +
.../go/go/CVE-2025-22870.patch | 80 ++++++++
.../go/go/CVE-2025-22871.patch | 172 ++++++++++++++++++
...ript_10.04.0.bb => ghostscript_10.05.0.bb} | 2 +-
.../xz/xz/CVE-2025-31115-01.patch | 29 +++
.../xz/xz/CVE-2025-31115-02.patch | 152 ++++++++++++++++
.../xz/xz/CVE-2025-31115-03.patch | 98 ++++++++++
.../xz/xz/CVE-2025-31115-04.patch | 56 ++++++
.../xz/{xz_5.4.6.bb => xz_5.4.7.bb} | 8 +-
13 files changed, 669 insertions(+), 9 deletions(-)
create mode 100644 meta/recipes-connectivity/ofono/ofono/CVE-2024-7537.patch
create mode 100644 meta/recipes-devtools/go/go/CVE-2025-22870.patch
create mode 100644 meta/recipes-devtools/go/go/CVE-2025-22871.patch
rename meta/recipes-extended/ghostscript/{ghostscript_10.04.0.bb => ghostscript_10.05.0.bb} (97%)
create mode 100644 meta/recipes-extended/xz/xz/CVE-2025-31115-01.patch
create mode 100644 meta/recipes-extended/xz/xz/CVE-2025-31115-02.patch
create mode 100644 meta/recipes-extended/xz/xz/CVE-2025-31115-03.patch
create mode 100644 meta/recipes-extended/xz/xz/CVE-2025-31115-04.patch
rename meta/recipes-extended/xz/{xz_5.4.6.bb => xz_5.4.7.bb} (89%)
--
2.43.0
^ permalink raw reply [flat|nested] 16+ messages in thread
* [OE-core][scarthgap 0/8] Patch review
@ 2025-05-09 15:45 Steve Sakoman
0 siblings, 0 replies; 16+ messages in thread
From: Steve Sakoman @ 2025-05-09 15:45 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Tuesday, May 13
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1557
The following changes since commit 45c50169fa7e34349acf3e24fc19e573cbab4e65:
bluez5: backport a patch to fix btmgmt -i (2025-05-06 09:01:45 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Haixiao Yan (1):
glibc: Add single-threaded fast path to rand()
Praveen Kumar (1):
connman :fix CVE-2025-32743
Vijay Anusuri (6):
libsoup-2.4: Fix CVE-2024-52530
libsoup-2.4: Fix CVE-2024-52531
libsoup-2.4: Fix CVE-2024-52532
libsoup-2.4: Fix CVE-2025-32906
libsoup-2.4: Fix CVE-2025-32909
libsoup: Fix CVE-2025-32914
.../connman/connman/CVE-2025-32743.patch | 48 ++++++
.../connman/connman_1.42.bb | 1 +
...dd-single-threaded-fast-path-to-rand.patch | 47 ++++++
meta/recipes-core/glibc/glibc_2.39.bb | 1 +
.../libsoup/libsoup-2.4/CVE-2024-52530.patch | 149 ++++++++++++++++++
.../libsoup-2.4/CVE-2024-52531-1.patch | 131 +++++++++++++++
.../libsoup-2.4/CVE-2024-52531-2.patch | 36 +++++
.../libsoup-2.4/CVE-2024-52532-1.patch | 36 +++++
.../libsoup-2.4/CVE-2024-52532-2.patch | 42 +++++
.../libsoup-2.4/CVE-2024-52532-3.patch | 46 ++++++
.../libsoup-2.4/CVE-2025-32906-1.patch | 61 +++++++
.../libsoup-2.4/CVE-2025-32906-2.patch | 83 ++++++++++
.../libsoup/libsoup-2.4/CVE-2025-32909.patch | 36 +++++
.../libsoup/libsoup-2.4_2.74.3.bb | 12 +-
.../libsoup-3.4.4/CVE-2025-32914.patch | 111 +++++++++++++
meta/recipes-support/libsoup/libsoup_3.4.4.bb | 1 +
16 files changed, 840 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-connectivity/connman/connman/CVE-2025-32743.patch
create mode 100644 meta/recipes-core/glibc/glibc/0001-stdlib-Add-single-threaded-fast-path-to-rand.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2024-52530.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2024-52531-1.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2024-52531-2.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2024-52532-1.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2024-52532-2.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2024-52532-3.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-32906-1.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-32906-2.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2025-32909.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32914.patch
--
2.43.0
^ permalink raw reply [flat|nested] 16+ messages in thread
* [OE-core][scarthgap 0/8] Patch review
@ 2025-06-17 16:04 Steve Sakoman
0 siblings, 0 replies; 16+ messages in thread
From: Steve Sakoman @ 2025-06-17 16:04 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Thursday, June 19
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1820
The following changes since commit f7ee6db8ca5dc72b7a468531e31403b60e6a0020:
testimage: get real os-release file (2025-06-09 08:06:42 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Aleksandar Nikolic (1):
scripts/install-buildtools: Update to 5.0.10
Colin Pinnell McAllister (1):
ffmpeg: fix CVE-2025-1373
Deepesh Varatharajan (1):
gcc: Upgrade to GCC 13.4
Jiaying Song (1):
python3-requests: upgrade 2.32.3 -> 2.32.4
Peter Marko (1):
net-tools: patch CVE-2025-46836
Poonam Jadhav (1):
libpng: Add ptest
Sandeep Gundlupet Raju (1):
tune-cortexr52: Remove aarch64 for ARM Cortex-R52
Savvas Etairidis (1):
systemd: Rename systemd_v255.21 to systemd_255.21
meta/conf/distro/include/maintainers.inc | 2 +-
.../distro/include/ptest-packagelists.inc | 1 +
.../include/arm/armv8r/tune-cortexr52.inc | 5 +-
.../{systemd_v255.21.bb => systemd_255.21.bb} | 0
.../gcc/{gcc-13.3.inc => gcc-13.4.inc} | 8 +-
...ian_13.3.bb => gcc-cross-canadian_13.4.bb} | 0
.../{gcc-cross_13.3.bb => gcc-cross_13.4.bb} | 0
...-crosssdk_13.3.bb => gcc-crosssdk_13.4.bb} | 0
...cc-runtime_13.3.bb => gcc-runtime_13.4.bb} | 0
...itizers_13.3.bb => gcc-sanitizers_13.4.bb} | 0
...{gcc-source_13.3.bb => gcc-source_13.4.bb} | 0
...ix-c-tweak-for-Wrange-loop-construct.patch | 113 ----
...4fffe3fc82a710bea66ad651720d71c938b8.patch | 549 ------------------
.../gcc/{gcc_13.3.bb => gcc_13.4.bb} | 0
...initial_13.3.bb => libgcc-initial_13.4.bb} | 0
.../gcc/{libgcc_13.3.bb => libgcc_13.4.bb} | 0
...ibgfortran_13.3.bb => libgfortran_13.4.bb} | 0
...s_2.32.3.bb => python3-requests_2.32.4.bb} | 2 +-
.../net-tools/CVE-2025-46836-01.patch | 91 +++
.../net-tools/CVE-2025-46836-02.patch | 31 +
.../net-tools/net-tools_2.10.bb | 2 +
.../recipes-multimedia/ffmpeg/ffmpeg_6.1.2.bb | 4 +
.../recipes-multimedia/libpng/files/run-ptest | 7 +
.../libpng/libpng_1.6.42.bb | 42 +-
scripts/install-buildtools | 4 +-
25 files changed, 185 insertions(+), 676 deletions(-)
rename meta/recipes-core/systemd/{systemd_v255.21.bb => systemd_255.21.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-13.3.inc => gcc-13.4.inc} (94%)
rename meta/recipes-devtools/gcc/{gcc-cross-canadian_13.3.bb => gcc-cross-canadian_13.4.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-cross_13.3.bb => gcc-cross_13.4.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-crosssdk_13.3.bb => gcc-crosssdk_13.4.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-runtime_13.3.bb => gcc-runtime_13.4.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-sanitizers_13.3.bb => gcc-sanitizers_13.4.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-source_13.3.bb => gcc-source_13.4.bb} (100%)
delete mode 100644 meta/recipes-devtools/gcc/gcc/0028-gcc-Fix-c-tweak-for-Wrange-loop-construct.patch
delete mode 100644 meta/recipes-devtools/gcc/gcc/gcc.git-ab884fffe3fc82a710bea66ad651720d71c938b8.patch
rename meta/recipes-devtools/gcc/{gcc_13.3.bb => gcc_13.4.bb} (100%)
rename meta/recipes-devtools/gcc/{libgcc-initial_13.3.bb => libgcc-initial_13.4.bb} (100%)
rename meta/recipes-devtools/gcc/{libgcc_13.3.bb => libgcc_13.4.bb} (100%)
rename meta/recipes-devtools/gcc/{libgfortran_13.3.bb => libgfortran_13.4.bb} (100%)
rename meta/recipes-devtools/python/{python3-requests_2.32.3.bb => python3-requests_2.32.4.bb} (91%)
create mode 100644 meta/recipes-extended/net-tools/net-tools/CVE-2025-46836-01.patch
create mode 100644 meta/recipes-extended/net-tools/net-tools/CVE-2025-46836-02.patch
create mode 100644 meta/recipes-multimedia/libpng/files/run-ptest
--
2.43.0
^ permalink raw reply [flat|nested] 16+ messages in thread
* [OE-core][scarthgap 0/8] Patch review
@ 2025-09-17 20:04 Steve Sakoman
0 siblings, 0 replies; 16+ messages in thread
From: Steve Sakoman @ 2025-09-17 20:04 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Friday, Spetember 19
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2395
The following changes since commit baa5e7ea5f37f54c2a00080798ad7fb4c0664f69:
pulseaudio: Add audio group explicitly (2025-09-02 09:27:13 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Divya Chellam (1):
wpa-supplicant: fix CVE-2022-37660
Haixiao Yan (1):
buildtools-tarball: fix unbound variable issues under 'set -u'
Jinfeng Wang (1):
systemtap: Fix task_work_cancel build
Libo Chen (1):
runqemu: fix special characters bug
Martin Jansa (1):
license.py: avoid deprecated ast.Str
Ross Burton (1):
grub2: fix CVE-2024-56738
Vijay Anusuri (2):
cups: upgrade 2.4.10 -> 2.4.11
cups: Fix for CVE-2025-58060 and CVE-2025-58364
meta/lib/oe/license.py | 4 +-
.../grub/files/CVE-2024-56738.patch | 75 ++
meta/recipes-bsp/grub/grub2.inc | 1 +
.../openssl/files/environment.d-openssl.sh | 24 +-
.../wpa-supplicant/CVE-2022-37660-0001.patch | 254 +++++
.../wpa-supplicant/CVE-2022-37660-0002.patch | 139 +++
.../wpa-supplicant/CVE-2022-37660-0003.patch | 196 ++++
.../wpa-supplicant/CVE-2022-37660-0004.patch | 941 ++++++++++++++++++
.../wpa-supplicant/CVE-2022-37660-0005.patch | 144 +++
.../wpa-supplicant/wpa-supplicant_2.10.bb | 5 +
.../git/git/environment.d-git.sh | 8 +-
.../environment.d-python3-requests.sh | 4 +-
meta/recipes-extended/cups/cups.inc | 9 +-
.../cups/0001-use-echo-only-in-init.patch | 2 +-
...-don-t-try-to-run-generated-binaries.patch | 2 +-
...-fix-multilib-install-file-conflicts.patch | 6 +-
.../cups/cups/CVE-2024-47175-1.patch | 73 --
.../cups/cups/CVE-2024-47175-2.patch | 151 ---
.../cups/cups/CVE-2024-47175-3.patch | 119 ---
.../cups/cups/CVE-2024-47175-4.patch | 249 -----
.../cups/cups/CVE-2024-47175-5.patch | 40 -
.../cups/cups/CVE-2025-58060.patch | 60 ++
.../cups/cups/CVE-2025-58364.patch | 61 ++
.../cups/cups/libexecdir.patch | 5 +-
.../cups/{cups_2.4.10.bb => cups_2.4.11.bb} | 2 +-
...sk_work-compatible-with-6.11-kernels.patch | 103 ++
.../recipes-kernel/systemtap/systemtap_git.bb | 1 +
.../curl/curl/environment.d-curl.sh | 8 +-
scripts/runqemu | 7 +-
29 files changed, 2019 insertions(+), 674 deletions(-)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2024-56738.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2022-37660-0001.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2022-37660-0002.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2022-37660-0003.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2022-37660-0004.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2022-37660-0005.patch
delete mode 100644 meta/recipes-extended/cups/cups/CVE-2024-47175-1.patch
delete mode 100644 meta/recipes-extended/cups/cups/CVE-2024-47175-2.patch
delete mode 100644 meta/recipes-extended/cups/cups/CVE-2024-47175-3.patch
delete mode 100644 meta/recipes-extended/cups/cups/CVE-2024-47175-4.patch
delete mode 100644 meta/recipes-extended/cups/cups/CVE-2024-47175-5.patch
create mode 100644 meta/recipes-extended/cups/cups/CVE-2025-58060.patch
create mode 100644 meta/recipes-extended/cups/cups/CVE-2025-58364.patch
rename meta/recipes-extended/cups/{cups_2.4.10.bb => cups_2.4.11.bb} (51%)
create mode 100644 meta/recipes-kernel/systemtap/systemtap/0001-Make-stp_task_work-compatible-with-6.11-kernels.patch
--
2.43.0
^ permalink raw reply [flat|nested] 16+ messages in thread
* [OE-core][scarthgap 0/8] Patch review
@ 2025-10-03 16:47 Steve Sakoman
0 siblings, 0 replies; 16+ messages in thread
From: Steve Sakoman @ 2025-10-03 16:47 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Tuesday, October 7
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2495
The following changes since commit 55e0c38dc28b73fa689446e2d5e564d235a24084:
vim: upgrade 9.1.1652 -> 9.1.1683 (2025-09-29 13:04:14 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Adrian Freihofer (2):
expect: Revert "expect-native: fix do_compile failure with gcc-14"
expect: fix native build with GCC 15
Khem Raj (1):
expect: Fix build with GCC 15
Ross Burton (3):
expect: update code for Tcl channel implementation
expect: don't run aclocal in do_configure
expect: cleanup do_install
Vijay Anusuri (1):
gstreamer1.0-plugins-bad: Fix CVE-2025-3887
Yogita Urade (1):
tiff: fix CVE-2025-9900
.../expect/expect/tcl840.patch | 27 ++++++
meta/recipes-devtools/expect/expect_5.45.4.bb | 18 ++--
.../CVE-2025-3887-1.patch | 50 ++++++++++
.../CVE-2025-3887-2.patch | 95 +++++++++++++++++++
.../gstreamer1.0-plugins-bad_1.22.12.bb | 2 +
.../libtiff/tiff/CVE-2025-9900.patch | 54 +++++++++++
meta/recipes-multimedia/libtiff/tiff_4.6.0.bb | 1 +
7 files changed, 237 insertions(+), 10 deletions(-)
create mode 100644 meta/recipes-devtools/expect/expect/tcl840.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2025-3887-1.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2025-3887-2.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2025-9900.patch
--
2.43.0
^ permalink raw reply [flat|nested] 16+ messages in thread
* [OE-core][scarthgap 0/8] Patch review
@ 2025-10-28 13:46 Steve Sakoman
0 siblings, 0 replies; 16+ messages in thread
From: Steve Sakoman @ 2025-10-28 13:46 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Thursday, October 30
Passed a-full on the autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2645
with the exception of the meta-aws test, which failed due to a meta-aws commit
changing the distro from poky-agl to agl
The following changes since commit 649147913e89cd8f7390cb17cd0be94c9710ffa6:
oeqa/runtime/ping: don't bother trying to ping localhost (2025-10-17 07:47:32 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Anders Heimer (1):
libpam: mark CVE-2025-6018 as not applicable
Daniel Semkowicz (1):
gstreamer1.0-plugins-bad: fix buffer allocation fail for v4l2codecs
Martin Jansa (1):
flex: fix build with gcc-15 on host
Matthias Schiffer (1):
curl: only set CA bundle in target build
Peter Marko (1):
expat: patch CVE-2025-59375
Rasmus Villemoes (1):
iptables: remove /etc/ethertypes
Soumya Sambu (2):
elfutils: Fix CVE-2025-1376
elfutils: Fix CVE-2025-1377
.../expat/expat/CVE-2025-59375-00.patch | 52 ++
.../expat/expat/CVE-2025-59375-01.patch | 48 ++
.../expat/expat/CVE-2025-59375-02.patch | 109 ++++
.../expat/expat/CVE-2025-59375-03.patch | 127 ++++
.../expat/expat/CVE-2025-59375-04.patch | 62 ++
.../expat/expat/CVE-2025-59375-05.patch | 64 ++
.../expat/expat/CVE-2025-59375-06.patch | 68 +++
.../expat/expat/CVE-2025-59375-07.patch | 52 ++
.../expat/expat/CVE-2025-59375-08.patch | 577 ++++++++++++++++++
.../expat/expat/CVE-2025-59375-09.patch | 43 ++
.../expat/expat/CVE-2025-59375-10.patch | 54 ++
.../expat/expat/CVE-2025-59375-11.patch | 66 ++
.../expat/expat/CVE-2025-59375-12.patch | 58 ++
.../expat/expat/CVE-2025-59375-13.patch | 309 ++++++++++
.../expat/expat/CVE-2025-59375-14.patch | 122 ++++
.../expat/expat/CVE-2025-59375-15.patch | 70 +++
.../expat/expat/CVE-2025-59375-16.patch | 146 +++++
.../expat/expat/CVE-2025-59375-17.patch | 28 +
.../expat/expat/CVE-2025-59375-18.patch | 74 +++
.../expat/expat/CVE-2025-59375-19.patch | 103 ++++
.../expat/expat/CVE-2025-59375-20.patch | 285 +++++++++
.../expat/expat/CVE-2025-59375-21.patch | 196 ++++++
.../expat/expat/CVE-2025-59375-22.patch | 37 ++
.../expat/expat/CVE-2025-59375-23.patch | 47 ++
.../expat/expat/CVE-2025-59375-24.patch | 36 ++
meta/recipes-core/expat/expat_2.6.4.bb | 25 +
.../elfutils/elfutils_0.191.bb | 2 +
.../elfutils/files/CVE-2025-1376.patch | 58 ++
.../elfutils/files/CVE-2025-1377.patch | 69 +++
...01-Match-malloc-signature-to-its-use.patch | 25 +
meta/recipes-devtools/flex/flex_2.6.4.bb | 1 +
.../iptables/iptables_1.8.10.bb | 2 +
meta/recipes-extended/pam/libpam_1.5.3.bb | 2 +
...s-chain-up-to-parent-decide_allocati.patch | 87 +++
.../gstreamer1.0-plugins-bad_1.22.12.bb | 1 +
meta/recipes-support/curl/curl_8.7.1.bb | 4 +-
36 files changed, 3108 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-00.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-01.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-02.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-03.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-04.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-05.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-06.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-07.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-08.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-09.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-10.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-11.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-12.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-13.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-14.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-15.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-16.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-17.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-18.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-19.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-20.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-21.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-22.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-23.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2025-59375-24.patch
create mode 100644 meta/recipes-devtools/elfutils/files/CVE-2025-1376.patch
create mode 100644 meta/recipes-devtools/elfutils/files/CVE-2025-1377.patch
create mode 100644 meta/recipes-devtools/flex/flex/0001-Match-malloc-signature-to-its-use.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/0005-v4l2codecs-Always-chain-up-to-parent-decide_allocati.patch
--
2.43.0
^ permalink raw reply [flat|nested] 16+ messages in thread
* [OE-core][scarthgap 0/8] Patch review
@ 2025-12-02 22:19 Steve Sakoman
0 siblings, 0 replies; 16+ messages in thread
From: Steve Sakoman @ 2025-12-02 22:19 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Thursday, December 4
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2811
The following changes since commit 1fbd9eddbdf0da062df0510cabff6f6ee33d5752:
libarchive: patch CVE-2025-60753 (2025-11-24 08:08:18 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Changqing Li (1):
libmicrohttpd: fix CVE-2025-59777, CVE-2025-62689
Moritz Haase (1):
curl: Ensure 'CURL_CA_BUNDLE' from host env is indeed respected
Peter Marko (5):
gnutls: patch CVE-2025-9820
libpng: patch CVE-2025-64505
libpng: patch CVE-2025-64506
libpng: patch CVE-2025-64720
libpng: patch CVE-2025-65018
Praveen Kumar (1):
python3: fix CVE-2025-6075
.../python/python3/CVE-2025-6075.patch | 355 +
.../python/python3_3.12.12.bb | 1 +
.../libpng/files/CVE-2025-64505-01.patch | 111 +
.../libpng/files/CVE-2025-64505-02.patch | 163 +
.../libpng/files/CVE-2025-64505-03.patch | 52 +
.../libpng/files/CVE-2025-64506.patch | 57 +
.../libpng/files/CVE-2025-64720.patch | 103 +
.../libpng/files/CVE-2025-65018-01.patch | 60 +
.../libpng/files/CVE-2025-65018-02.patch | 163 +
.../libpng/libpng_1.6.42.bb | 7 +
.../curl/curl/environment.d-curl.sh | 4 +-
.../gnutls/gnutls/CVE-2025-9820.patch | 250 +
meta/recipes-support/gnutls/gnutls_3.8.4.bb | 1 +
...0001-Remove-broken-experimental-code.patch | 14471 ++++++++++++++++
.../libmicrohttpd/libmicrohttpd_1.0.1.bb | 3 +-
15 files changed, 15798 insertions(+), 3 deletions(-)
create mode 100644 meta/recipes-devtools/python/python3/CVE-2025-6075.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-64505-01.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-64505-02.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-64505-03.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-64506.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-64720.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-65018-01.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-65018-02.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2025-9820.patch
create mode 100644 meta/recipes-support/libmicrohttpd/files/0001-Remove-broken-experimental-code.patch
--
2.43.0
^ permalink raw reply [flat|nested] 16+ messages in thread
end of thread, other threads:[~2025-12-02 22:19 UTC | newest]
Thread overview: 16+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-01-23 2:59 [OE-core][scarthgap 0/8] Patch review Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 1/8] rsync: fix CVE-2024-12084 Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 2/8] rsync: fix CVE-2024-12085 Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 3/8] rsync: fix CVE-2024-12086 Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 4/8] rsync: fix CVE-2024-12087 Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 5/8] rsync: fix CVE-2024-12088 Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 6/8] rsync: fix CVE-2024-12747 Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 7/8] rust-target-config: Fix TARGET_C_INT_WIDTH with correct size Steve Sakoman
2025-01-23 2:59 ` [OE-core][scarthgap 8/8] boost: fix do_fetch error Steve Sakoman
-- strict thread matches above, loose matches on Subject: below --
2025-04-11 20:33 [OE-core][scarthgap 0/8] Patch review Steve Sakoman
2025-05-09 15:45 Steve Sakoman
2025-06-17 16:04 Steve Sakoman
2025-09-17 20:04 Steve Sakoman
2025-10-03 16:47 Steve Sakoman
2025-10-28 13:46 Steve Sakoman
2025-12-02 22:19 Steve Sakoman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox