* [OE-core][walnascar 1/8] connman :fix CVE-2025-32366
2025-05-20 19:48 [OE-core][walnascar 0/8] Patch review Steve Sakoman
@ 2025-05-20 19:48 ` Steve Sakoman
2025-05-20 19:48 ` [OE-core][walnascar 2/8] iputils: Security fix for CVE-2025-47268 Steve Sakoman
` (6 subsequent siblings)
7 siblings, 0 replies; 13+ messages in thread
From: Steve Sakoman @ 2025-05-20 19:48 UTC (permalink / raw)
To: openembedded-core
From: Praveen Kumar <praveen.kumar@windriver.com>
In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length
that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen)
and memcpy(response+offset,*end,*rdlen) without a check for whether
the sum of *end and *rdlen exceeds max. Consequently, *rdlen may be
larger than the amount of remaining packet data in the current state
of parsing. Values of stack memory locations may be sent over the
network in a response.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-32366
Upstream-patch:
https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=8d3be0285f1d4667bfe85dba555c663eb3d704b4
Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../connman/connman/CVE-2025-32366.patch | 41 +++++++++++++++++++
.../connman/connman_1.43.bb | 1 +
2 files changed, 42 insertions(+)
create mode 100644 meta/recipes-connectivity/connman/connman/CVE-2025-32366.patch
diff --git a/meta/recipes-connectivity/connman/connman/CVE-2025-32366.patch b/meta/recipes-connectivity/connman/connman/CVE-2025-32366.patch
new file mode 100644
index 0000000000..62f07e707a
--- /dev/null
+++ b/meta/recipes-connectivity/connman/connman/CVE-2025-32366.patch
@@ -0,0 +1,41 @@
+From 8d3be0285f1d4667bfe85dba555c663eb3d704b4 Mon Sep 17 00:00:00 2001
+From: Yoonje Shin <ioerts@kookmin.ac.kr>
+Date: Mon, 12 May 2025 10:48:18 +0200
+Subject: [PATCH] dnsproxy: Address CVE-2025-32366 vulnerability
+
+In Connman parse_rr in dnsproxy.c has a memcpy length
+that depends on an RR RDLENGTH value (i.e., *rdlen=ntohs(rr->rdlen)
+and memcpy(response+offset,*end,*rdlen)). Here, rdlen may be larger
+than the amount of remaining packet data in the current state of
+parsing. As a result, values of stack memory locations may be sent
+over the network in a response.
+
+This patch adds a check to ensure that (*end + *rdlen) does not exceed
+the valid range. If the condition is violated, the function returns
+-EINVAL.
+
+CVE: CVE-2025-32366
+
+Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=8d3be0285f1d4667bfe85dba555c663eb3d704b4]
+
+Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
+---
+ src/dnsproxy.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/dnsproxy.c b/src/dnsproxy.c
+index 7ee26d9..1dd2f7f 100644
+--- a/src/dnsproxy.c
++++ b/src/dnsproxy.c
+@@ -998,6 +998,9 @@ static int parse_rr(const unsigned char *buf, const unsigned char *start,
+ if ((offset + *rdlen) > *response_size)
+ return -ENOBUFS;
+
++ if ((*end + *rdlen) > max)
++ return -EINVAL;
++
+ memcpy(response + offset, *end, *rdlen);
+
+ *end += *rdlen;
+--
+2.40.0
diff --git a/meta/recipes-connectivity/connman/connman_1.43.bb b/meta/recipes-connectivity/connman/connman_1.43.bb
index 02abda568f..936e880c06 100644
--- a/meta/recipes-connectivity/connman/connman_1.43.bb
+++ b/meta/recipes-connectivity/connman/connman_1.43.bb
@@ -7,6 +7,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/network/${BPN}/${BP}.tar.xz \
file://no-version-scripts.patch \
file://0002-resolve-musl-does-not-implement-res_ninit.patch \
file://CVE-2025-32743.patch \
+ file://CVE-2025-32366.patch \
"
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* [OE-core][walnascar 2/8] iputils: Security fix for CVE-2025-47268
2025-05-20 19:48 [OE-core][walnascar 0/8] Patch review Steve Sakoman
2025-05-20 19:48 ` [OE-core][walnascar 1/8] connman :fix CVE-2025-32366 Steve Sakoman
@ 2025-05-20 19:48 ` Steve Sakoman
2025-05-20 19:48 ` [OE-core][walnascar 3/8] makedumpfile: upgrade 1.7.6 -> 1.7.7 Steve Sakoman
` (5 subsequent siblings)
7 siblings, 0 replies; 13+ messages in thread
From: Steve Sakoman @ 2025-05-20 19:48 UTC (permalink / raw)
To: openembedded-core
From: Yi Zhao <yi.zhao@windriver.com>
CVE-2025-47268
ping in iputils through 20240905 allows a denial of service (application
error or incorrect data collection) via a crafted ICMP Echo Reply
packet, because of a signed 64-bit integer overflow in timestamp
multiplication.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-47268
Patch from:
https://github.com/iputils/iputils/commit/070cfacd7348386173231fb16fad4983d4e6ae40
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../iputils/iputils/CVE-2025-47268.patch | 143 ++++++++++++++++++
.../iputils/iputils_20240905.bb | 4 +-
2 files changed, 146 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-extended/iputils/iputils/CVE-2025-47268.patch
diff --git a/meta/recipes-extended/iputils/iputils/CVE-2025-47268.patch b/meta/recipes-extended/iputils/iputils/CVE-2025-47268.patch
new file mode 100644
index 0000000000..dd31b79031
--- /dev/null
+++ b/meta/recipes-extended/iputils/iputils/CVE-2025-47268.patch
@@ -0,0 +1,143 @@
+From 070cfacd7348386173231fb16fad4983d4e6ae40 Mon Sep 17 00:00:00 2001
+From: Petr Vorel <pvorel@suse.cz>
+Date: Mon, 5 May 2025 23:55:57 +0200
+Subject: [PATCH] ping: Fix signed 64-bit integer overflow in RTT calculation
+
+Crafted ICMP Echo Reply packet can cause signed integer overflow in
+
+1) triptime calculation:
+triptime = tv->tv_sec * 1000000 + tv->tv_usec;
+
+2) tsum2 increment which uses triptime
+rts->tsum2 += (double)((long long)triptime * (long long)triptime);
+
+3) final tmvar:
+tmvar = (rts->tsum2 / total) - (tmavg * tmavg)
+
+ $ export CFLAGS="-O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer"
+ $ export LDFLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer"
+ $ meson setup .. -Db_sanitize=address,undefined
+ $ ninja
+ $ ./ping/ping -c2 127.0.0.1
+
+ PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
+ 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.061 ms
+ ../ping/ping_common.c:757:25: runtime error: signed integer overflow: -2513732689199106 * 1000000 cannot be represented in type 'long int'
+ ../ping/ping_common.c:757:12: runtime error: signed integer overflow: -4975495174606980224 + -6510615555425289427 cannot be represented in type 'long int'
+ ../ping/ping_common.c:769:47: runtime error: signed integer overflow: 6960633343677281965 * 6960633343677281965 cannot be represented in type 'long int'
+ 24 bytes from 127.0.0.1: icmp_seq=1 ttl=64 (truncated)
+ ./ping/ping: Warning: time of day goes back (-7256972569576721377us), taking countermeasures
+ ./ping/ping: Warning: time of day goes back (-7256972569576721232us), taking countermeasures
+ 24 bytes from 127.0.0.1: icmp_seq=1 ttl=64 (truncated)
+ ../ping/ping_common.c:265:16: runtime error: signed integer overflow: 6960633343677281965 * 2 cannot be represented in type 'long int'
+ 64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.565 ms
+
+ --- 127.0.0.1 ping statistics ---
+ 2 packets transmitted, 2 received, +2 duplicates, 0% packet loss, time 1002ms
+ ../ping/ping_common.c:940:42: runtime error: signed integer overflow: 1740158335919320832 * 1740158335919320832 cannot be represented in type 'long int'
+ rtt min/avg/max/mdev = 0.000/1740158335919320.832/6960633343677281.965/-1623514645242292.-224 ms
+
+To fix the overflow check allowed ranges of struct timeval members:
+* tv_sec <0, LONG_MAX/1000000>
+* tv_usec <0, 999999>
+
+Fix includes 2 new error messages (needs translation).
+Also existing message "time of day goes back ..." needed to be modified
+as it now prints tv->tv_sec which is a second (needs translation update).
+
+After fix:
+
+ $ ./ping/ping -c2 127.0.0.1
+ 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.057 ms
+ ./ping/ping: Warning: invalid tv_usec -6510615555424928611 us
+ ./ping/ping: Warning: time of day goes back (-3985394643238914 s), taking countermeasures
+ ./ping/ping: Warning: invalid tv_usec -6510615555424928461 us
+ ./ping/ping: Warning: time of day goes back (-3985394643238914 s), taking countermeasures
+ 24 bytes from 127.0.0.1: icmp_seq=1 ttl=64 (truncated)
+ ./ping/ping: Warning: invalid tv_usec -6510615555425884541 us
+ ./ping/ping: Warning: time of day goes back (-4243165695442945 s), taking countermeasures
+ 24 bytes from 127.0.0.1: icmp_seq=1 ttl=64 (truncated)
+ 64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.111 ms
+
+ --- 127.0.0.1 ping statistics ---
+ 2 packets transmitted, 2 received, +2 duplicates, 0% packet loss, time 101ms
+ rtt min/avg/max/mdev = 0.000/0.042/0.111/0.046 ms
+
+Fixes: https://github.com/iputils/iputils/issues/584
+Fixes: CVE-2025-472
+Link: https://github.com/Zephkek/ping-rtt-overflow/
+Co-developed-by: Cyril Hrubis <chrubis@suse.cz>
+Reported-by: Mohamed Maatallah <hotelsmaatallahrecemail@gmail.com>
+Reviewed-by: Mohamed Maatallah <hotelsmaatallahrecemail@gmail.com>
+Reviewed-by: Cyril Hrubis <chrubis@suse.cz>
+Reviewed-by: Noah Meyerhans <noahm@debian.org>
+Signed-off-by: Petr Vorel <pvorel@suse.cz>
+
+CVE: CVE-2025-47268
+
+Upstream-Status: Backport
+[https://github.com/iputils/iputils/commit/070cfacd7348386173231fb16fad4983d4e6ae40]
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ iputils_common.h | 3 +++
+ ping/ping_common.c | 22 +++++++++++++++++++---
+ 2 files changed, 22 insertions(+), 3 deletions(-)
+
+diff --git a/iputils_common.h b/iputils_common.h
+index 49e790d..829a749 100644
+--- a/iputils_common.h
++++ b/iputils_common.h
+@@ -10,6 +10,9 @@
+ !!__builtin_types_compatible_p(__typeof__(arr), \
+ __typeof__(&arr[0]))])) * 0)
+
++/* 1000001 = 1000000 tv_sec + 1 tv_usec */
++#define TV_SEC_MAX_VAL (LONG_MAX/1000001)
++
+ #ifdef __GNUC__
+ # define iputils_attribute_format(t, n, m) __attribute__((__format__ (t, n, m)))
+ #else
+diff --git a/ping/ping_common.c b/ping/ping_common.c
+index dadd2a4..4e99d89 100644
+--- a/ping/ping_common.c
++++ b/ping/ping_common.c
+@@ -754,16 +754,32 @@ int gather_statistics(struct ping_rts *rts, uint8_t *icmph, int icmplen,
+
+ restamp:
+ tvsub(tv, &tmp_tv);
+- triptime = tv->tv_sec * 1000000 + tv->tv_usec;
+- if (triptime < 0) {
+- error(0, 0, _("Warning: time of day goes back (%ldus), taking countermeasures"), triptime);
++
++ if (tv->tv_usec >= 1000000) {
++ error(0, 0, _("Warning: invalid tv_usec %ld us"), tv->tv_usec);
++ tv->tv_usec = 999999;
++ }
++
++ if (tv->tv_usec < 0) {
++ error(0, 0, _("Warning: invalid tv_usec %ld us"), tv->tv_usec);
++ tv->tv_usec = 0;
++ }
++
++ if (tv->tv_sec > TV_SEC_MAX_VAL) {
++ error(0, 0, _("Warning: invalid tv_sec %ld s"), tv->tv_sec);
++ triptime = 0;
++ } else if (tv->tv_sec < 0) {
++ error(0, 0, _("Warning: time of day goes back (%ld s), taking countermeasures"), tv->tv_sec);
+ triptime = 0;
+ if (!rts->opt_latency) {
+ gettimeofday(tv, NULL);
+ rts->opt_latency = 1;
+ goto restamp;
+ }
++ } else {
++ triptime = tv->tv_sec * 1000000 + tv->tv_usec;
+ }
++
+ if (!csfailed) {
+ rts->tsum += triptime;
+ rts->tsum2 += (double)((long long)triptime * (long long)triptime);
+--
+2.34.1
+
diff --git a/meta/recipes-extended/iputils/iputils_20240905.bb b/meta/recipes-extended/iputils/iputils_20240905.bb
index ca8ddc530d..64d58a91c2 100644
--- a/meta/recipes-extended/iputils/iputils_20240905.bb
+++ b/meta/recipes-extended/iputils/iputils_20240905.bb
@@ -10,7 +10,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=627cc07ec86a45951d43e30658bbd819"
DEPENDS = "gnutls"
-SRC_URI = "git://github.com/iputils/iputils;branch=master;protocol=https"
+SRC_URI = "git://github.com/iputils/iputils;branch=master;protocol=https \
+ file://CVE-2025-47268.patch \
+ "
SRCREV = "10b50784aae3fb75c96cdf9b1668916b49557dd5"
S = "${WORKDIR}/git"
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* [OE-core][walnascar 3/8] makedumpfile: upgrade 1.7.6 -> 1.7.7
2025-05-20 19:48 [OE-core][walnascar 0/8] Patch review Steve Sakoman
2025-05-20 19:48 ` [OE-core][walnascar 1/8] connman :fix CVE-2025-32366 Steve Sakoman
2025-05-20 19:48 ` [OE-core][walnascar 2/8] iputils: Security fix for CVE-2025-47268 Steve Sakoman
@ 2025-05-20 19:48 ` Steve Sakoman
2025-05-20 19:48 ` [OE-core][walnascar 4/8] openssh: Upgrade 9.9p2 -> 10.0p1 Steve Sakoman
` (4 subsequent siblings)
7 siblings, 0 replies; 13+ messages in thread
From: Steve Sakoman @ 2025-05-20 19:48 UTC (permalink / raw)
To: openembedded-core
From: Yi Zhao <yi.zhao@windriver.com>
ChangeLog:
https://github.com/makedumpfile/makedumpfile/releases/tag/1.7.7
This version supports the following new kernels:
- 6.12, 6.13, 6.14
Drop backport patch.
(From OE-Core rev: 364e15aadcbb3ac754c2c484f7920420b4cb3138)
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...-compiling-error-too-many-arguments-.patch | 43 -------------------
...umpfile_1.7.6.bb => makedumpfile_1.7.7.bb} | 3 +-
2 files changed, 1 insertion(+), 45 deletions(-)
delete mode 100644 meta/recipes-kernel/makedumpfile/makedumpfile/0001-PATCH-fix-gcc-15-compiling-error-too-many-arguments-.patch
rename meta/recipes-kernel/makedumpfile/{makedumpfile_1.7.6.bb => makedumpfile_1.7.7.bb} (92%)
diff --git a/meta/recipes-kernel/makedumpfile/makedumpfile/0001-PATCH-fix-gcc-15-compiling-error-too-many-arguments-.patch b/meta/recipes-kernel/makedumpfile/makedumpfile/0001-PATCH-fix-gcc-15-compiling-error-too-many-arguments-.patch
deleted file mode 100644
index 90f1b4038b..0000000000
--- a/meta/recipes-kernel/makedumpfile/makedumpfile/0001-PATCH-fix-gcc-15-compiling-error-too-many-arguments-.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 73e62a08022bf8e5edad250f8c1452f0be3771a3 Mon Sep 17 00:00:00 2001
-From: Coiby Xu <coxu@redhat.com>
-Date: Thu, 23 Jan 2025 17:47:10 +0800
-Subject: [PATCH] [PATCH] fix gcc-15 compiling error: too many arguments to function eppic_init
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2340813
-
-When building makekdumpfile against gcc-15, the following error is
-shown,
-
- erase_info.c: In function ‘process_eppic_file’:
- erase_info.c:2226:13: error: too many arguments to function ‘eppic_init’; expected 0, have 1
- 2226 | if (eppic_init(&eppic_cb)) {
- | ^~~~~~~~~~ ~~~~~~~~~
- make: *** [Makefile:109: erase_info.o] Error 1
-
-Upstream-Status: Backport [https://github.com/makedumpfile/makedumpfile/commit/73e62a08022bf8e5edad250f8c1452f0be3771a3]
-
-Signed-off-by: Coiby Xu <coxu@redhat.com>
-Signed-off-by: Coiby Xu <coiby.xu@gmail.com>
----
- erase_info.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/erase_info.c b/erase_info.c
-index cbe1681..af6bfae 100644
---- a/erase_info.c
-+++ b/erase_info.c
-@@ -2192,7 +2192,7 @@ process_eppic_file(char *name_config)
- {
- void *handle;
- void (*eppic_load)(char *), (*eppic_unload)(char *);
-- int (*eppic_init)();
-+ int (*eppic_init)(struct call_back *);
-
- /*
- * Dynamically load the eppic_makedumpfile.so library.
---
-2.48.1
-
diff --git a/meta/recipes-kernel/makedumpfile/makedumpfile_1.7.6.bb b/meta/recipes-kernel/makedumpfile/makedumpfile_1.7.7.bb
similarity index 92%
rename from meta/recipes-kernel/makedumpfile/makedumpfile_1.7.6.bb
rename to meta/recipes-kernel/makedumpfile/makedumpfile_1.7.7.bb
index 46be13e7d0..23fcef9569 100644
--- a/meta/recipes-kernel/makedumpfile/makedumpfile_1.7.6.bb
+++ b/meta/recipes-kernel/makedumpfile/makedumpfile_1.7.7.bb
@@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=751419260aa954499f7abaabaa882bbe"
LICENSE = "GPL-2.0-only"
SRCBRANCH ?= "master"
-SRCREV = "97a89484e2c960dd64933e1cea7a7248138f8a76"
+SRCREV = "e4ae6b5ee04edeeb03db89bee372904157e3378d"
DEPENDS = "bzip2 zlib elfutils xz"
RDEPENDS:${PN}-tools = "perl ${PN}"
@@ -26,7 +26,6 @@ FILES:${PN}-tools = "${bindir}/*.pl"
SRC_URI = "\
git://github.com/makedumpfile/makedumpfile;branch=${SRCBRANCH};protocol=https \
file://0001-makedumpfile-replace-hardcode-CFLAGS.patch \
- file://0001-PATCH-fix-gcc-15-compiling-error-too-many-arguments-.patch \
"
S = "${WORKDIR}/git"
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* [OE-core][walnascar 4/8] openssh: Upgrade 9.9p2 -> 10.0p1
2025-05-20 19:48 [OE-core][walnascar 0/8] Patch review Steve Sakoman
` (2 preceding siblings ...)
2025-05-20 19:48 ` [OE-core][walnascar 3/8] makedumpfile: upgrade 1.7.6 -> 1.7.7 Steve Sakoman
@ 2025-05-20 19:48 ` Steve Sakoman
2025-05-21 6:42 ` Gyorgy Sarvari
2025-05-20 19:48 ` [OE-core][walnascar 5/8] ruby: upgrade 3.4.2 -> 3.4.3 Steve Sakoman
` (3 subsequent siblings)
7 siblings, 1 reply; 13+ messages in thread
From: Steve Sakoman @ 2025-05-20 19:48 UTC (permalink / raw)
To: openembedded-core
From: Richard Purdie <richard.purdie@linuxfoundation.org>
Fix sshd by ensuring the agent daemon is included.
Internally, this release is versioned as 10.0p2 but upstream don't plan to
change this or re-release.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 2a4dd93e98ca9e61644213aa00c1cb837fb27316)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...gress-test-exec-use-the-absolute-path-in-the-SSH-e.patch | 6 +++---
.../openssh/{openssh_9.9p2.bb => openssh_10.0p1.bb} | 4 ++--
2 files changed, 5 insertions(+), 5 deletions(-)
rename meta/recipes-connectivity/openssh/{openssh_9.9p2.bb => openssh_10.0p1.bb} (98%)
diff --git a/meta/recipes-connectivity/openssh/openssh/0001-regress-test-exec-use-the-absolute-path-in-the-SSH-e.patch b/meta/recipes-connectivity/openssh/openssh/0001-regress-test-exec-use-the-absolute-path-in-the-SSH-e.patch
index b90cd2e69d..360b62af34 100644
--- a/meta/recipes-connectivity/openssh/openssh/0001-regress-test-exec-use-the-absolute-path-in-the-SSH-e.patch
+++ b/meta/recipes-connectivity/openssh/openssh/0001-regress-test-exec-use-the-absolute-path-in-the-SSH-e.patch
@@ -1,4 +1,4 @@
-From fb762172fb678fe29327b667f8fe7380962a4540 Mon Sep 17 00:00:00 2001
+From 9dcccafe44ea17e972e7cddea205bbe9fe71d8d6 Mon Sep 17 00:00:00 2001
From: Jose Quaresma <jose.quaresma@foundries.io>
Date: Mon, 15 Jul 2024 18:43:08 +0100
Subject: [PATCH] regress/test-exec: use the absolute path in the SSH env
@@ -18,10 +18,10 @@ Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
1 file changed, 5 insertions(+)
diff --git a/regress/test-exec.sh b/regress/test-exec.sh
-index 7afc2807..175f554b 100644
+index 8a00c72..2891f27 100644
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
-@@ -175,6 +175,11 @@ if [ "x$TEST_SSH_OPENSSL" != "x" ]; then
+@@ -179,6 +179,11 @@ if [ "x$TEST_SSH_OPENSSL" != "x" ]; then
fi
# Path to sshd must be absolute for rexec
diff --git a/meta/recipes-connectivity/openssh/openssh_9.9p2.bb b/meta/recipes-connectivity/openssh/openssh_10.0p1.bb
similarity index 98%
rename from meta/recipes-connectivity/openssh/openssh_9.9p2.bb
rename to meta/recipes-connectivity/openssh/openssh_10.0p1.bb
index 5191725796..a044aec063 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.9p2.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.0p1.bb
@@ -26,7 +26,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \
file://0001-regress-test-exec-use-the-absolute-path-in-the-SSH-e.patch \
"
-SRC_URI[sha256sum] = "91aadb603e08cc285eddf965e1199d02585fa94d994d6cae5b41e1721e215673"
+SRC_URI[sha256sum] = "021a2e709a0edf4250b1256bd5a9e500411a90dddabea830ed59cef90eb9d85c"
CVE_STATUS[CVE-2007-2768] = "not-applicable-config: This CVE is specific to OpenSSH with the pam opie which we don't build/use here."
@@ -197,7 +197,7 @@ FILES:${PN}-scp = "${bindir}/scp.${BPN}"
FILES:${PN}-ssh = "${bindir}/ssh.${BPN} ${sysconfdir}/ssh/ssh_config"
FILES:${PN}-sshd = "${sbindir}/sshd ${libexecdir}/sshd-session ${sysconfdir}/init.d/sshd ${systemd_system_unitdir}"
FILES:${PN}-sshd += "${sysconfdir}/ssh/moduli ${sysconfdir}/ssh/sshd_config ${sysconfdir}/ssh/sshd_config_readonly ${sysconfdir}/default/volatiles/99_sshd ${sysconfdir}/pam.d/sshd"
-FILES:${PN}-sshd += "${libexecdir}/${BPN}/sshd_check_keys"
+FILES:${PN}-sshd += "${libexecdir}/${BPN}/sshd_check_keys ${libexecdir}/sshd-auth"
FILES:${PN}-sftp = "${bindir}/sftp"
FILES:${PN}-sftp-server = "${libexecdir}/sftp-server"
FILES:${PN}-misc = "${bindir}/ssh* ${libexecdir}/ssh*"
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* [OE-core][walnascar 5/8] ruby: upgrade 3.4.2 -> 3.4.3
2025-05-20 19:48 [OE-core][walnascar 0/8] Patch review Steve Sakoman
` (3 preceding siblings ...)
2025-05-20 19:48 ` [OE-core][walnascar 4/8] openssh: Upgrade 9.9p2 -> 10.0p1 Steve Sakoman
@ 2025-05-20 19:48 ` Steve Sakoman
2025-05-20 19:48 ` [OE-core][walnascar 6/8] libxml2: upgrade 2.13.6 -> 2.13.8 Steve Sakoman
` (2 subsequent siblings)
7 siblings, 0 replies; 13+ messages in thread
From: Steve Sakoman @ 2025-05-20 19:48 UTC (permalink / raw)
To: openembedded-core
From: Divya Chellam <divya.chellam@windriver.com>
This includes CVE-fix for CVE-2025-27219, CVE-2025-27220 and
CVE-2025-27221
Changes between 3.4.2 -> 3.4.3
==============================
https://github.com/ruby/ruby/compare/v3_4_2...v3_4_3
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d739c52558af986c2ce4c65e1197e8d524d14d22)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/ruby/{ruby_3.4.2.bb => ruby_3.4.3.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-devtools/ruby/{ruby_3.4.2.bb => ruby_3.4.3.bb} (98%)
diff --git a/meta/recipes-devtools/ruby/ruby_3.4.2.bb b/meta/recipes-devtools/ruby/ruby_3.4.3.bb
similarity index 98%
rename from meta/recipes-devtools/ruby/ruby_3.4.2.bb
rename to meta/recipes-devtools/ruby/ruby_3.4.3.bb
index aa22ef3992..45047b8859 100644
--- a/meta/recipes-devtools/ruby/ruby_3.4.2.bb
+++ b/meta/recipes-devtools/ruby/ruby_3.4.3.bb
@@ -48,7 +48,7 @@ do_configure:prepend() {
DEPENDS:append:libc-musl = " libucontext"
-SRC_URI[sha256sum] = "41328ac21f2bfdd7de6b3565ef4f0dd7543354d37e96f157a1552a6bd0eb364b"
+SRC_URI[sha256sum] = "55a4cd1dcbe5ca27cf65e89a935a482c2bb2284832939266551c0ec68b437f46"
PACKAGECONFIG ??= ""
PACKAGECONFIG += "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}"
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* [OE-core][walnascar 6/8] libxml2: upgrade 2.13.6 -> 2.13.8
2025-05-20 19:48 [OE-core][walnascar 0/8] Patch review Steve Sakoman
` (4 preceding siblings ...)
2025-05-20 19:48 ` [OE-core][walnascar 5/8] ruby: upgrade 3.4.2 -> 3.4.3 Steve Sakoman
@ 2025-05-20 19:48 ` Steve Sakoman
2025-05-20 19:48 ` [OE-core][walnascar 7/8] glibc: stable 2.41 branch update Steve Sakoman
2025-05-20 19:48 ` [OE-core][walnascar 8/8] gcc: Fix LDRD register overlap in register-indexed mode Steve Sakoman
7 siblings, 0 replies; 13+ messages in thread
From: Steve Sakoman @ 2025-05-20 19:48 UTC (permalink / raw)
To: openembedded-core
From: Divya Chellam <divya.chellam@windriver.com>
This includes CVE-fix for CVE-2025-32414 and CVE-2025-32415.
Changelog:
===========
https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.7
https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8
Regressions
* tree: Fix xmlTextMerge with NULL args
* io: Fix compressed flag for uncompressed stdin
* parser: Fix parsing of DTD content
Security
* [CVE-2025-32415] schemas: Fix heap buffer overflow inxmlSchemaIDCFillNodeTables
* [CVE-2025-32414] python: Read at most len/4 characters. (Maks Verver)
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 0b24113405ab0bbb3200bb47fa8ed6abeaa7481b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libxml/{libxml2_2.13.6.bb => libxml2_2.13.8.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-core/libxml/{libxml2_2.13.6.bb => libxml2_2.13.8.bb} (97%)
diff --git a/meta/recipes-core/libxml/libxml2_2.13.6.bb b/meta/recipes-core/libxml/libxml2_2.13.8.bb
similarity index 97%
rename from meta/recipes-core/libxml/libxml2_2.13.6.bb
rename to meta/recipes-core/libxml/libxml2_2.13.8.bb
index 3b3ca87e96..e82e0e8ec3 100644
--- a/meta/recipes-core/libxml/libxml2_2.13.6.bb
+++ b/meta/recipes-core/libxml/libxml2_2.13.8.bb
@@ -19,7 +19,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
file://install-tests.patch \
"
-SRC_URI[archive.sha256sum] = "f453480307524968f7a04ec65e64f2a83a825973bcd260a2e7691be82ae70c96"
+SRC_URI[archive.sha256sum] = "277294cb33119ab71b2bc81f2f445e9bc9435b893ad15bb2cd2b0e859a0ee84a"
SRC_URI[testtar.sha256sum] = "c6b2d42ee50b8b236e711a97d68e6c4b5c8d83e69a2be4722379f08702ea7273"
# Disputed as a security issue, but fixed in d39f780
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* [OE-core][walnascar 7/8] glibc: stable 2.41 branch update
2025-05-20 19:48 [OE-core][walnascar 0/8] Patch review Steve Sakoman
` (5 preceding siblings ...)
2025-05-20 19:48 ` [OE-core][walnascar 6/8] libxml2: upgrade 2.13.6 -> 2.13.8 Steve Sakoman
@ 2025-05-20 19:48 ` Steve Sakoman
2025-05-20 19:48 ` [OE-core][walnascar 8/8] gcc: Fix LDRD register overlap in register-indexed mode Steve Sakoman
7 siblings, 0 replies; 13+ messages in thread
From: Steve Sakoman @ 2025-05-20 19:48 UTC (permalink / raw)
To: openembedded-core
From: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Below commits on glibc-2.41 stable branch are updated.
5cb575ca9a elf: tst-audit10: split AVX512F code into dedicated functions [BZ #32882]
046b33800c x86: Detect Intel Diamond Rapids
a53e764657 x86: Handle unknown Intel processor with default tuning
aca31d2712 x86: Add ARL/PTL/CWF model detection support
f68b407d4b x86: Optimize xstate size calculation
d6d56af6e7 elf: Fix arm-linux-gnueabihf build break from b861755a84
b861755a84 elf: Extend glibc.rtld.execstack tunable to force executable stack (BZ 32653)
200d20123c x86: Link tst-gnu2-tls2-x86-noxsave{,c,xsavec} with libpthread
80cd656649 x86: Use separate variable for TLSDESC XSAVE/XSAVEC state size (bug 32810)
a282e2c0ae x86: Skip XSAVE state size reset if ISA level requires XSAVE
bcd4cf9d5f x86_64: Add atanh with FMA
7e72fa7577 x86_64: Add sinh with FMA
6a3a4a5e58 x86_64: Add tanh with FMA
ce9b765522 nptl: Check if thread is already terminated in sigcancel_handler (BZ 32782)
98c712855d nptl: PTHREAD_COND_INITIALIZER compatibility with pre-2.41 versions (bug 32786)
e22c132484 nptl: clear the whole rseq area before registration
33bfd9020f Linux: Remove attribute access from sched_getattr (bug 32781)
66fc3bd758 math: Remove an extra semicolon in math function declarations
1a3083b999 posix: Move environ helper variables next to environ definition (bug 32541)
91f8cff2c4 configure: Fix spelling of -Wl,--no-error-execstack option
fd202462c5 elf: Check if __attribute__ ((aligned (65536))) is supported
746ef8e939 static-pie: Skip the empty PT_LOAD segment at offset 0 [BZ #32763]
56609f8df1 Pass -Wl,--no-error-execstack for tests where -Wl,-z,execstack is used [PR32717]
89be78704e AArch64: Use prefer_sve_ifuncs for SVE memset
c47c3890f1 AArch64: Add SVE memset
e0bc5f64ea math: Improve layout of exp/exp10 data
009c5a2dca aarch64: Add GCS test with signal handler
8d98ee8d70 aarch64: Add GCS tests for dlopen
61ba3cdfa9 aarch64: Add GCS tests for transitive dependencies
fda5730898 aarch64: Add tests for Guarded Control Stack
6d1f97bb06 aarch64: Add configure checks for GCS support
7774a9d07a AArch64: Improve codegen for SVE powf
2025e27a81 AArch64: Improve codegen for SVE pow
f3d9c116cb AArch64: Improve codegen for SVE erfcf
94859e8680 Aarch64: Improve codegen in SVE exp and users, and update expf_inline
7c9a086807 Aarch64: Improve codegen in SVE asinh
30992cb5e9 RISC-V: Fix IFUNC resolver cannot access gp pointer
07288c7445 math: Add optimization barrier to ensure a1 + u.d is not reused [BZ #30664]
2cb04444b9 math: Fix `unknown type name '__float128'` for clang 3.4 to 3.8.1 (bug 32694)
a900dbaf70 x86 (__HAVE_FLOAT128): Defined to 0 for Intel SYCL compiler [BZ #32723]
1e0e33e1b1 Fix tst-aarch64-pkey to handle ENOSPC as not supported
69fda28279 assert: Add test for CVE-2025-0395
cf88351b68 math: Fix tanf for some inputs (BZ 32630)
cb7f206537 nptl: Correct stack size attribute when stack grows up [BZ #32574]
d85a771953 math: Fix sinhf for some inputs (BZ 32627)
bdccbfbc52 math: Fix log10p1f internal table value (BZ 32626)
Testresults:
Before update |After update |Difference
PASS: 5816 |PASS: 5826 |PASS: +10
FAIL: 239 |FAIL: 239 |FAIL: 0
XPASS: 4 |XPASS: 4 |XPASS: 0
XFAIL: 16 |XFAIL: 16 |XFAIL: 0
UNSUPPORTED: 164|UNSUPPORTED: 164|UNSUPPORTED: 0
Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-core/glibc/glibc-version.inc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc
index 4d28affed9..d84106fb95 100644
--- a/meta/recipes-core/glibc/glibc-version.inc
+++ b/meta/recipes-core/glibc/glibc-version.inc
@@ -1,6 +1,6 @@
SRCBRANCH ?= "release/2.41/master"
PV = "2.41+git"
-SRCREV_glibc ?= "0a7c7a3e283a55d1bfaa48fdef063a32a4689a2b"
+SRCREV_glibc ?= "5b4c4617016d28569106549dff6f9fec73eed5ce"
SRCREV_localedef ?= "fab74f31b3811df543e24b6de47efdf45b538abc"
GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https"
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* [OE-core][walnascar 8/8] gcc: Fix LDRD register overlap in register-indexed mode
2025-05-20 19:48 [OE-core][walnascar 0/8] Patch review Steve Sakoman
` (6 preceding siblings ...)
2025-05-20 19:48 ` [OE-core][walnascar 7/8] glibc: stable 2.41 branch update Steve Sakoman
@ 2025-05-20 19:48 ` Steve Sakoman
7 siblings, 0 replies; 13+ messages in thread
From: Steve Sakoman @ 2025-05-20 19:48 UTC (permalink / raw)
To: openembedded-core
From: Khem Raj <raj.khem@gmail.com>
Issue is seen with nodejs ending with Illegal instruction on OE
Its also in QT5base and perhaps many other packages using 64bit
atomics.
Thanks to jeroen (oe IRC) to report and help reduce the problem.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/gcc/gcc-14.2.inc | 1 +
...m-Fix-LDRD-register-overlap-PR117675.patch | 148 ++++++++++++++++++
2 files changed, 149 insertions(+)
create mode 100644 meta/recipes-devtools/gcc/gcc/0001-arm-Fix-LDRD-register-overlap-PR117675.patch
diff --git a/meta/recipes-devtools/gcc/gcc-14.2.inc b/meta/recipes-devtools/gcc/gcc-14.2.inc
index 3d65bed92a..f4e364f692 100644
--- a/meta/recipes-devtools/gcc/gcc-14.2.inc
+++ b/meta/recipes-devtools/gcc/gcc-14.2.inc
@@ -71,6 +71,7 @@ SRC_URI = "${BASEURI} \
file://0026-gcc-Fix-c-tweak-for-Wrange-loop-construct.patch \
file://0027-gcc-backport-patch-to-fix-data-relocation-to-ENDBR-s.patch \
file://gcc.git-ab884fffe3fc82a710bea66ad651720d71c938b8.patch \
+ file://0001-arm-Fix-LDRD-register-overlap-PR117675.patch \
"
S = "${TMPDIR}/work-shared/gcc-${PV}-${PR}/${SOURCEDIR}"
diff --git a/meta/recipes-devtools/gcc/gcc/0001-arm-Fix-LDRD-register-overlap-PR117675.patch b/meta/recipes-devtools/gcc/gcc/0001-arm-Fix-LDRD-register-overlap-PR117675.patch
new file mode 100644
index 0000000000..e3d887a135
--- /dev/null
+++ b/meta/recipes-devtools/gcc/gcc/0001-arm-Fix-LDRD-register-overlap-PR117675.patch
@@ -0,0 +1,148 @@
+From 9366c328518766d896155388726055624716c0af Mon Sep 17 00:00:00 2001
+From: Wilco Dijkstra <wilco.dijkstra@arm.com>
+Date: Tue, 10 Dec 2024 14:22:48 +0000
+Subject: [PATCH] arm: Fix LDRD register overlap [PR117675]
+
+The register indexed variants of LDRD have complex register overlap constraints
+which makes them hard to use without using output_move_double (which can't be
+used for atomics as it doesn't guarantee to emit atomic LDRD/STRD when required).
+Add a new predicate and constraint for plain LDRD/STRD with base or base+imm.
+This blocks register indexing and fixes PR117675.
+
+gcc:
+ PR target/117675
+ * config/arm/arm.cc (arm_ldrd_legitimate_address): New function.
+ * config/arm/arm-protos.h (arm_ldrd_legitimate_address): New prototype.
+ * config/arm/constraints.md: Add new Uo constraint.
+ * config/arm/predicates.md (arm_ldrd_memory_operand): Add new predicate.
+ * config/arm/sync.md (arm_atomic_loaddi2_ldrd): Use
+ arm_ldrd_memory_operand and Uo.
+
+gcc/testsuite:
+ PR target/117675
+ * gcc.target/arm/pr117675.c: Add new test.
+
+(cherry picked from commit 21fbfae2e55e1a153820acc6fbd922e66f67e65b)
+
+Upstream-Status: Backport [https://gcc.gnu.org/bugzilla/show_bug.cgi?id=117675]
+---
+ gcc/config/arm/arm-protos.h | 1 +
+ gcc/config/arm/arm.cc | 24 ++++++++++++++++++++++++
+ gcc/config/arm/constraints.md | 8 +++++++-
+ gcc/config/arm/predicates.md | 4 ++++
+ gcc/config/arm/sync.md | 2 +-
+ gcc/testsuite/gcc.target/arm/pr117675.c | 17 +++++++++++++++++
+ 6 files changed, 54 insertions(+), 2 deletions(-)
+ create mode 100644 gcc/testsuite/gcc.target/arm/pr117675.c
+
+--- a/gcc/config/arm/arm-protos.h
++++ b/gcc/config/arm/arm-protos.h
+@@ -202,6 +202,7 @@ extern rtx arm_load_tp (rtx);
+ extern bool arm_coproc_builtin_available (enum unspecv);
+ extern bool arm_coproc_ldc_stc_legitimate_address (rtx);
+ extern rtx arm_stack_protect_tls_canary_mem (bool);
++extern bool arm_ldrd_legitimate_address (rtx);
+
+
+ #if defined TREE_CODE
+--- a/gcc/config/arm/arm.cc
++++ b/gcc/config/arm/arm.cc
+@@ -34523,6 +34523,30 @@ arm_coproc_ldc_stc_legitimate_address (r
+ return false;
+ }
+
++/* Return true if OP is a valid memory operand for LDRD/STRD without any
++ register overlap restrictions. Allow [base] and [base, imm] for now. */
++bool
++arm_ldrd_legitimate_address (rtx op)
++{
++ if (!MEM_P (op))
++ return false;
++
++ op = XEXP (op, 0);
++ if (REG_P (op))
++ return true;
++
++ if (GET_CODE (op) != PLUS)
++ return false;
++ if (!REG_P (XEXP (op, 0)) || !CONST_INT_P (XEXP (op, 1)))
++ return false;
++
++ HOST_WIDE_INT val = INTVAL (XEXP (op, 1));
++
++ if (TARGET_ARM)
++ return IN_RANGE (val, -255, 255);
++ return IN_RANGE (val, -1020, 1020) && (val & 3) == 0;
++}
++
+ /* Return the diagnostic message string if conversion from FROMTYPE to
+ TOTYPE is not allowed, NULL otherwise. */
+
+--- a/gcc/config/arm/constraints.md
++++ b/gcc/config/arm/constraints.md
+@@ -39,7 +39,7 @@
+ ;; in all states: Pg
+
+ ;; The following memory constraints have been used:
+-;; in ARM/Thumb-2 state: Uh, Ut, Uv, Uy, Un, Um, Us, Up, Uf, Ux, Ul
++;; in ARM/Thumb-2 state: Uh, Ut, Uv, Uy, Un, Um, Us, Uo, Up, Uf, Ux, Ul, Uz
+ ;; in ARM state: Uq
+ ;; in Thumb state: Uu, Uw
+ ;; in all states: Q
+@@ -585,6 +585,12 @@
+ (and (match_code "mem")
+ (match_test "arm_coproc_ldc_stc_legitimate_address (op)")))
+
++(define_memory_constraint "Uo"
++ "@internal
++ A memory operand for Arm/Thumb-2 LDRD/STRD"
++ (and (match_code "mem")
++ (match_test "arm_ldrd_legitimate_address (op)")))
++
+ ;; We used to have constraint letters for S and R in ARM state, but
+ ;; all uses of these now appear to have been removed.
+
+--- a/gcc/config/arm/predicates.md
++++ b/gcc/config/arm/predicates.md
+@@ -849,6 +849,10 @@
+ (and (match_operand 0 "memory_operand")
+ (match_code "reg" "0")))
+
++;; True if the operand is memory reference suitable for a ldrd/strd.
++(define_predicate "arm_ldrd_memory_operand"
++ (match_test "arm_ldrd_legitimate_address (op)"))
++
+ ;; Predicates for parallel expanders based on mode.
+ (define_special_predicate "vect_par_constant_high"
+ (match_code "parallel")
+--- a/gcc/config/arm/sync.md
++++ b/gcc/config/arm/sync.md
+@@ -161,7 +161,7 @@
+ (define_insn "arm_atomic_loaddi2_ldrd"
+ [(set (match_operand:DI 0 "register_operand" "=r")
+ (unspec_volatile:DI
+- [(match_operand:DI 1 "memory_operand" "m")]
++ [(match_operand:DI 1 "arm_ldrd_memory_operand" "Uo")]
+ VUNSPEC_LDRD_ATOMIC))]
+ "ARM_DOUBLEWORD_ALIGN && TARGET_HAVE_LPAE"
+ "ldrd\t%0, %H0, %1"
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/arm/pr117675.c
+@@ -0,0 +1,17 @@
++/* { dg-do compile } */
++/* { dg-options "-O2 -marm" } */
++/* { dg-require-effective-target arm_arch_v7ve_neon_ok } */
++/* { dg-add-options arm_arch_v7ve_neon } */
++/* { dg-final { check-function-bodies "**" "" "" } } */
++
++/*
++** f1:
++** add r0, r0, r1
++** ldrd r0, r1, \[r0\]
++** bx lr
++*/
++long long f1 (char *p, int i)
++{
++ return __atomic_load_n ((long long *)(p + i), __ATOMIC_RELAXED);
++}
++
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread