[OE-core][scarthgap][Patch 00/11] u-boot-tools: address multiple CVEs

[OE-core][scarthgap][Patch 00/11] u-boot-tools: address multiple CVEs

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

Address eleven U-Boot CVE findings for the U-Boot 2024.01 tools-only
build on scarthgap.

Backport the upstream fix for CVE-2026-46728. The fix rebuilds the FIT
signed-node list from the selected configuration instead of trusting
the attacker-controlled hashed-nodes property. Add the patch to both
the u-boot and u-boot-tools recipes because the affected FIT handling
is used by both builds.

Mark the remaining ten CVEs as not-applicable-config for u-boot-tools.
These vulnerabilities affect networking or target runtime code that is
not built into the tools-only configuration:

- CVE-2024-42040 affects the DHCP client.
- CVE-2024-57254, CVE-2024-57255, CVE-2024-57257 and CVE-2024-57259
  affect SquashFS runtime parsing.
- CVE-2024-57256 affects Ext4 runtime parsing.
- CVE-2024-57258 affects runtime allocator and target architecture code.
- CVE-2026-29007 and CVE-2026-29008 affect TCP processing.
- CVE-2026-29009 affects the NFS client.

The tools-only build disables CONFIG_NET and does not link the affected
SquashFS, Ext4, allocator, architecture, TCP or NFS runtime code.

Testing:
- Successfully applied the embedded CVE-2026-46728 patch to U-Boot
  2024.01 without conflicts or fuzz.
- u-boot-tools build completed successfully.
- u-boot build completed successfully.

Hetvi Thakar (11):
  u-boot, u-boot-tools: Fix CVE-2026-46728
  u-boot-tools: Ignore CVE-2024-42040
  u-boot-tools: Ignore CVE-2024-57254
  u-boot-tools: Ignore CVE-2024-57255
  u-boot-tools: Ignore CVE-2024-57256
  u-boot-tools: Ignore CVE-2024-57257
  u-boot-tools: Ignore CVE-2024-57258
  u-boot-tools: Ignore CVE-2024-57259
  u-boot-tools: Ignore CVE-2026-29007
  u-boot-tools: Ignore CVE-2026-29008
  u-boot-tools: Ignore CVE-2026-29009

 .../u-boot/files/CVE-2026-46728.patch         | 379 ++++++++++++++++++
 .../u-boot/u-boot-tools_2024.01.bb            |  13 +
 meta/recipes-bsp/u-boot/u-boot_2024.01.bb     |   1 +
 3 files changed, 393 insertions(+)
 create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-46728.patch


base-commit: 543550522f831479f07d332a40ba343c53ae1065
-- 
2.35.6

[OE-core][scarthgap][Patch 01/11] u-boot, u-boot-tools: Fix CVE-2026-46728

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

This patch applies the upstream U-Boot fix referenced by the advisory in
[2], using the commit shown in [1]. The fix rebuilds the FIT signed-node
list from the selected configuration instead of trusting the
attacker-controlled hashed-nodes property.

[1] https://github.com/u-boot/u-boot/commit/2092322b31cc
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-46728

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 .../u-boot/files/CVE-2026-46728.patch         | 379 ++++++++++++++++++
 .../u-boot/u-boot-tools_2024.01.bb            |   2 +
 meta/recipes-bsp/u-boot/u-boot_2024.01.bb     |   1 +
 3 files changed, 382 insertions(+)
 create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-46728.patch

diff --git a/meta/recipes-bsp/u-boot/files/CVE-2026-46728.patch b/meta/recipes-bsp/u-boot/files/CVE-2026-46728.patch
new file mode 100644
index 0000000000..e6737f38a6
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/CVE-2026-46728.patch
@@ -0,0 +1,379 @@
+From 2092322b31cc8b1f8c9e2e238d1043ae0637b241 Mon Sep 17 00:00:00 2001
+From: Simon Glass <simon.glass@canonical.com>
+Date: Thu, 5 Mar 2026 18:20:09 -0700
+Subject: [PATCH] boot: Add fit_config_get_hash_list() to build signed node
+ list
+
+The hashed-nodes property in a FIT signature node lists which FDT paths
+are included in the signature hash. It is intended as a hint so should
+not be used for verification.
+
+Add a function to build the node list from scratch by iterating the
+configuration's image references. Skip properties known not to be image
+references. For each image, collect the path plus all hash and cipher
+subnodes.
+
+Use the new function in fit_config_check_sig() instead of reading
+'hashed-nodes'.
+
+Update the test_vboot kernel@ test case: fit_check_sign now catches the
+attack at signature-verification time (the @-suffixed node is hashed
+instead of the real one, causing a mismatch) rather than at
+fit_check_format() time.
+
+Update the docs to cover this. The FIT spec can be updated separately.
+
+Signed-off-by: Simon Glass <simon.glass@canonical.com>
+Closes: https://lore.kernel.org/u-boot/20260302220937.3682128-1-trini@konsulko.com/
+Reported-by: Apple Security Engineering and Architecture (SEAR)
+Tested-by: Tom Rini <trini@konsulko.com>
+
+CVE: CVE-2026-46728
+Upstream-Status: Backport [https://github.com/u-boot/u-boot/commit/2092322b31cc8b1f8c9e2e238d1043ae0637b241]
+
+Backport Changes:
+- Use the v2024.01 FIT_COMP_PROP name for the compatible property.
+- Adapt test_vboot.py context to the v2024.01 test layout.
+
+(cherry picked from commit 2092322b31cc8b1f8c9e2e238d1043ae0637b241)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ boot/image-fit-sig.c        | 227 +++++++++++++++++++++++++++++-------
+ doc/usage/fit/signature.rst |  19 ++-
+ test/py/tests/test_vboot.py |   8 +-
+ 3 files changed, 201 insertions(+), 53 deletions(-)
+
+diff --git a/boot/image-fit-sig.c b/boot/image-fit-sig.c
+index 12369896..79e7ff93 100644
+--- a/boot/image-fit-sig.c
++++ b/boot/image-fit-sig.c
+@@ -19,6 +19,7 @@ DECLARE_GLOBAL_DATA_PTR;
+ #include <u-boot/hash-checksum.h>
+ 
+ #define IMAGE_MAX_HASHED_NODES		100
++#define FIT_MAX_HASH_PATH_BUF		4096
+ 
+ /**
+  * fit_region_make_list() - Make a list of image regions
+@@ -225,6 +226,179 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset,
+ 	return 0;
+ }
+ 
++/**
++ * fit_config_add_hash() - Add hash nodes for one image to the node list
++ *
++ * Adds the image path, all its hash-* subnode paths, and its cipher
++ * subnode path (if present) to the packed buffer.
++ *
++ * @fit:		FIT blob
++ * @image_noffset:	Image node offset (e.g. /images/kernel-1)
++ * @node_inc:		Array of path pointers to fill
++ * @count:		Pointer to current count (updated on return)
++ * @max_nodes:		Maximum entries in @node_inc
++ * @buf:		Buffer for packed path strings
++ * @buf_used:		Pointer to bytes used in @buf (updated on return)
++ * @buf_len:		Total size of @buf
++ * Return: 0 on success, -ve on error
++ */
++static int fit_config_add_hash(const void *fit, int image_noffset,
++			       char **node_inc, int *count, int max_nodes,
++			       char *buf, int *buf_used, int buf_len)
++{
++	int noffset, hash_count, ret, len;
++
++	if (*count >= max_nodes)
++		return -ENOSPC;
++
++	ret = fdt_get_path(fit, image_noffset, buf + *buf_used,
++			   buf_len - *buf_used);
++	if (ret < 0)
++		return -ENOENT;
++	len = strlen(buf + *buf_used) + 1;
++	node_inc[(*count)++] = buf + *buf_used;
++	*buf_used += len;
++
++	/* Add all this image's hash subnodes */
++	hash_count = 0;
++	for (noffset = fdt_first_subnode(fit, image_noffset);
++	     noffset >= 0;
++	     noffset = fdt_next_subnode(fit, noffset)) {
++		const char *name = fit_get_name(fit, noffset, NULL);
++
++		if (strncmp(name, FIT_HASH_NODENAME,
++			    strlen(FIT_HASH_NODENAME)))
++			continue;
++		if (*count >= max_nodes)
++			return -ENOSPC;
++		ret = fdt_get_path(fit, noffset, buf + *buf_used,
++				   buf_len - *buf_used);
++		if (ret < 0)
++			return -ENOENT;
++		len = strlen(buf + *buf_used) + 1;
++		node_inc[(*count)++] = buf + *buf_used;
++		*buf_used += len;
++		hash_count++;
++	}
++
++	if (!hash_count) {
++		printf("No hash nodes in image '%s'\n",
++		       fdt_get_name(fit, image_noffset, NULL));
++		return -ENOMSG;
++	}
++
++	/* Add this image's cipher node if present */
++	noffset = fdt_subnode_offset(fit, image_noffset, FIT_CIPHER_NODENAME);
++	if (noffset != -FDT_ERR_NOTFOUND) {
++		if (noffset < 0)
++			return -EIO;
++		if (*count >= max_nodes)
++			return -ENOSPC;
++		ret = fdt_get_path(fit, noffset, buf + *buf_used,
++				   buf_len - *buf_used);
++		if (ret < 0)
++			return -ENOENT;
++		len = strlen(buf + *buf_used) + 1;
++		node_inc[(*count)++] = buf + *buf_used;
++		*buf_used += len;
++	}
++
++	return 0;
++}
++
++/**
++ * fit_config_get_hash_list() - Build the list of nodes to hash
++ *
++ * Works through every image referenced by the configuration and collects the
++ * node paths: root + config + all referenced images with their hash and
++ * cipher subnodes.
++ *
++ * Properties known not to be image references (description, compatible,
++ * default, load-only) are skipped, so any new image type is covered by default.
++ *
++ * @fit:	FIT blob
++ * @conf_noffset: Configuration node offset
++ * @node_inc:	Array to fill with path string pointers
++ * @max_nodes:	Size of @node_inc array
++ * @buf:	Buffer for packed null-terminated path strings
++ * @buf_len:	Size of @buf
++ * Return: number of entries in @node_inc, or -ve on error
++ */
++static int fit_config_get_hash_list(const void *fit, int conf_noffset,
++				    char **node_inc, int max_nodes,
++				    char *buf, int buf_len)
++{
++	const char *conf_name;
++	int image_count;
++	int prop_offset;
++	int used = 0;
++	int count = 0;
++	int ret, len;
++
++	conf_name = fit_get_name(fit, conf_noffset, NULL);
++
++	/* Always include the root node and the configuration node */
++	if (max_nodes < 2)
++		return -ENOSPC;
++
++	len = 2;  /* "/" + nul */
++	if (len > buf_len)
++		return -ENOSPC;
++	strcpy(buf, "/");
++	node_inc[count++] = buf;
++	used += len;
++
++	len = snprintf(buf + used, buf_len - used, "%s/%s", FIT_CONFS_PATH,
++		       conf_name) + 1;
++	if (used + len > buf_len)
++		return -ENOSPC;
++	node_inc[count++] = buf + used;
++	used += len;
++
++	/* Process each image referenced by the config */
++	image_count = 0;
++	fdt_for_each_property_offset(prop_offset, fit, conf_noffset) {
++		const char *prop_name;
++		int img_count, i;
++
++		fdt_getprop_by_offset(fit, prop_offset, &prop_name, NULL);
++		if (!prop_name)
++			continue;
++
++		/* Skip properties that are not image references */
++		if (!strcmp(prop_name, FIT_DESC_PROP) ||
++		    !strcmp(prop_name, FIT_COMP_PROP) ||
++		    !strcmp(prop_name, FIT_DEFAULT_PROP))
++			continue;
++
++		img_count = fdt_stringlist_count(fit, conf_noffset, prop_name);
++		for (i = 0; i < img_count; i++) {
++			int noffset;
++
++			noffset = fit_conf_get_prop_node_index(fit,
++							       conf_noffset,
++							       prop_name, i);
++			if (noffset < 0)
++				continue;
++
++			ret = fit_config_add_hash(fit, noffset, node_inc,
++						  &count, max_nodes, buf, &used,
++						  buf_len);
++			if (ret < 0)
++				return ret;
++
++			image_count++;
++		}
++	}
++
++	if (!image_count) {
++		printf("No images in config '%s'\n", conf_name);
++		return -ENOMSG;
++	}
++
++	return count;
++}
++
+ /**
+  * fit_config_check_sig() - Check the signature of a config
+  *
+@@ -265,20 +439,16 @@ static int fit_config_check_sig(const void *fit, int noffset, int conf_noffset,
+ 		FIT_DATA_POSITION_PROP,
+ 		FIT_DATA_OFFSET_PROP,
+ 	};
+-
+-	const char *prop, *end, *name;
++	char *node_inc[IMAGE_MAX_HASHED_NODES];
++	char hash_buf[FIT_MAX_HASH_PATH_BUF];
+ 	struct image_sign_info info;
+ 	const uint32_t *strings;
+-	const char *config_name;
+ 	uint8_t *fit_value;
+ 	int fit_value_len;
+-	bool found_config;
+ 	int max_regions;
+-	int i, prop_len;
+ 	char path[200];
+ 	int count;
+ 
+-	config_name = fit_get_name(fit, conf_noffset, NULL);
+ 	debug("%s: fdt=%p, conf='%s', sig='%s'\n", __func__, key_blob,
+ 	      fit_get_name(fit, noffset, NULL),
+ 	      fit_get_name(key_blob, required_keynode, NULL));
+@@ -293,45 +463,12 @@ static int fit_config_check_sig(const void *fit, int noffset, int conf_noffset,
+ 		return -1;
+ 	}
+ 
+-	/* Count the number of strings in the property */
+-	prop = fdt_getprop(fit, noffset, "hashed-nodes", &prop_len);
+-	end = prop ? prop + prop_len : prop;
+-	for (name = prop, count = 0; name < end; name++)
+-		if (!*name)
+-			count++;
+-	if (!count) {
+-		*err_msgp = "Can't get hashed-nodes property";
+-		return -1;
+-	}
+-
+-	if (prop && prop_len > 0 && prop[prop_len - 1] != '\0') {
+-		*err_msgp = "hashed-nodes property must be null-terminated";
+-		return -1;
+-	}
+-
+-	/* Add a sanity check here since we are using the stack */
+-	if (count > IMAGE_MAX_HASHED_NODES) {
+-		*err_msgp = "Number of hashed nodes exceeds maximum";
+-		return -1;
+-	}
+-
+-	/* Create a list of node names from those strings */
+-	char *node_inc[count];
+-
+-	debug("Hash nodes (%d):\n", count);
+-	found_config = false;
+-	for (name = prop, i = 0; name < end; name += strlen(name) + 1, i++) {
+-		debug("   '%s'\n", name);
+-		node_inc[i] = (char *)name;
+-		if (!strncmp(FIT_CONFS_PATH, name, strlen(FIT_CONFS_PATH)) &&
+-		    name[sizeof(FIT_CONFS_PATH) - 1] == '/' &&
+-		    !strcmp(name + sizeof(FIT_CONFS_PATH), config_name)) {
+-			debug("      (found config node %s)", config_name);
+-			found_config = true;
+-		}
+-	}
+-	if (!found_config) {
+-		*err_msgp = "Selected config not in hashed nodes";
++	/* Build the node list from the config, ignoring hashed-nodes */
++	count = fit_config_get_hash_list(fit, conf_noffset,
++					 node_inc, IMAGE_MAX_HASHED_NODES,
++					 hash_buf, sizeof(hash_buf));
++	if (count < 0) {
++		*err_msgp = "Failed to build hash node list";
+ 		return -1;
+ 	}
+ 
+diff --git a/doc/usage/fit/signature.rst b/doc/usage/fit/signature.rst
+index 0804bffd..80373234 100644
+--- a/doc/usage/fit/signature.rst
++++ b/doc/usage/fit/signature.rst
+@@ -353,20 +353,27 @@ meantime.
+ Details
+ -------
+ The signature node contains a property ('hashed-nodes') which lists all the
+-nodes that the signature was made over.  The image is walked in order and each
+-tag processed as follows:
++nodes that the signature was made over.  The signer (mkimage) writes this
++property as a record of what was included in the hash.  During verification,
++however, U-Boot does not read 'hashed-nodes'. Instead it rebuilds the node
++list from the configuration's own image references (kernel, fdt, ramdisk,
++etc.), since 'hashed-nodes' is not itself covered by the signature. The
++rebuilt list always includes the root node, the configuration node, each
++referenced image node and its hash/cipher subnodes.
++
++The image is walked in order and each tag processed as follows:
+ 
+ DTB_BEGIN_NODE
+     The tag and the following name are included in the signature
+-    if the node or its parent are present in 'hashed-nodes'
++    if the node or its parent are present in the node list
+ 
+ DTB_END_NODE
+     The tag is included in the signature if the node or its parent
+-    are present in 'hashed-nodes'
++    are present in the node list
+ 
+ DTB_PROPERTY
+     The tag, the length word, the offset in the string table, and
+-    the data are all included if the current node is present in 'hashed-nodes'
++    the data are all included if the current node is present in the node list
+     and the property name is not 'data'.
+ 
+ DTB_END
+@@ -374,7 +381,7 @@ DTB_END
+ 
+ DTB_NOP
+     The tag is included in the signature if the current node is present
+-    in 'hashed-nodes'
++    in the node list
+ 
+ In addition, the signature contains a property 'hashed-strings' which contains
+ the offset and length in the string table of the strings that are to be
+diff --git a/test/py/tests/test_vboot.py b/test/py/tests/test_vboot.py
+index 04fa59f9..817eb980 100644
+--- a/test/py/tests/test_vboot.py
++++ b/test/py/tests/test_vboot.py
+@@ -362,10 +362,14 @@ def test_vboot(u_boot_console, name, sha_algo, padding, sign_options, required,
+             shutil.copyfile(fit, efit)
+             vboot_evil.add_evil_node(fit, efit, evil_kernel, 'kernel@')
+ 
+-            msg = 'Signature checking prevents use of unit addresses (@) in nodes'
++            # fit_check_sign catches this via signature mismatch (the @
++            # node is hashed instead of the real one)
+             util.run_and_log_expect_exception(
+                 cons, [fit_check_sign, '-f', efit, '-k', dtb],
+-                1, msg)
++                1, 'Failed to verify required signature')
++
++            # bootm catches it earlier, at fit_check_format() time
++            msg = 'Signature checking prevents use of unit addresses (@) in nodes'
+             run_bootm(sha_algo, 'evil kernel@', msg, False, efit)
+ 
+         # Create a new properly signed fit and replace header bytes
diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
index 7eaf721ca8..4b6d89ed4e 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
@@ -1,2 +1,4 @@
 require u-boot-common.inc
 require u-boot-tools.inc
+
+SRC_URI += "file://CVE-2026-46728.patch"
diff --git a/meta/recipes-bsp/u-boot/u-boot_2024.01.bb b/meta/recipes-bsp/u-boot/u-boot_2024.01.bb
index e412f503f1..7eaeed1004 100644
--- a/meta/recipes-bsp/u-boot/u-boot_2024.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot_2024.01.bb
@@ -12,4 +12,5 @@ SRC_URI += "file://CVE-2024-57254.patch \
             file://CVE-2024-57258-3.patch \
             file://CVE-2024-57259.patch \
             file://CVE-2024-42040.patch \
+            file://CVE-2026-46728.patch \
 "
-- 
2.35.6

[OE-core][scarthgap][Patch 02/11] u-boot-tools: Ignore CVE-2024-42040

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- CVE-2024-42040 affects the U-Boot DHCP client in net/bootp.c [1].
- u-boot-tools uses tools-only_defconfig, where CONFIG_NET is disabled
  [2].
- Hence ignore this CVE for u-boot-tools; the exclusion is
  configuration-based.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2024-42040
[2] https://github.com/u-boot/u-boot/blob/866ca972d6c3/configs/tools-only_defconfig

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
index 4b6d89ed4e..b5711e1f97 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
@@ -2,3 +2,5 @@ require u-boot-common.inc
 require u-boot-tools.inc
 
 SRC_URI += "file://CVE-2026-46728.patch"
+
+CVE_STATUS[CVE-2024-42040] = "not-applicable-config: DHCP client code in net/bootp.c is not built by tools-only_defconfig, which disables CONFIG_NET."
-- 
2.35.6

[OE-core][scarthgap][Patch 03/11] u-boot-tools: Ignore CVE-2024-57254

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- CVE-2024-57254 affects U-Boot SquashFS runtime parsing [1].
- The tools-only build graph does not link fs/squashfs into its host
  tools [2].
- Hence ignore this CVE for u-boot-tools; the exclusion is
  configuration-based.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2024-57254
[2] https://github.com/u-boot/u-boot/blob/866ca972d6c3/tools/Makefile

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
index b5711e1f97..2519dc521f 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
@@ -4,3 +4,4 @@ require u-boot-tools.inc
 SRC_URI += "file://CVE-2026-46728.patch"
 
 CVE_STATUS[CVE-2024-42040] = "not-applicable-config: DHCP client code in net/bootp.c is not built by tools-only_defconfig, which disables CONFIG_NET."
+CVE_STATUS[CVE-2024-57254] = "not-applicable-config: SquashFS runtime code is not built or linked into the host tools produced by tools-only_defconfig."
-- 
2.35.6

[OE-core][scarthgap][Patch 04/11] u-boot-tools: Ignore CVE-2024-57255

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- CVE-2024-57255 affects U-Boot SquashFS runtime parsing [1].
- The tools-only build graph does not link fs/squashfs into its host
  tools [2].
- Hence ignore this CVE for u-boot-tools; the exclusion is
  configuration-based.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2024-57255
[2] https://github.com/u-boot/u-boot/blob/866ca972d6c3/tools/Makefile

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
index 2519dc521f..6516d7698a 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
@@ -5,3 +5,4 @@ SRC_URI += "file://CVE-2026-46728.patch"
 
 CVE_STATUS[CVE-2024-42040] = "not-applicable-config: DHCP client code in net/bootp.c is not built by tools-only_defconfig, which disables CONFIG_NET."
 CVE_STATUS[CVE-2024-57254] = "not-applicable-config: SquashFS runtime code is not built or linked into the host tools produced by tools-only_defconfig."
+CVE_STATUS[CVE-2024-57255] = "not-applicable-config: SquashFS runtime code is not built or linked into the host tools produced by tools-only_defconfig."
-- 
2.35.6

[OE-core][scarthgap][Patch 05/11] u-boot-tools: Ignore CVE-2024-57256

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- CVE-2024-57256 affects U-Boot Ext4 runtime parsing [1].
- The tools-only build graph does not link fs/ext4 into its host tools
  [2].
- Hence ignore this CVE for u-boot-tools; the exclusion is
  configuration-based.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2024-57256
[2] https://github.com/u-boot/u-boot/blob/866ca972d6c3/tools/Makefile

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
index 6516d7698a..66e46fa7af 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
@@ -6,3 +6,4 @@ SRC_URI += "file://CVE-2026-46728.patch"
 CVE_STATUS[CVE-2024-42040] = "not-applicable-config: DHCP client code in net/bootp.c is not built by tools-only_defconfig, which disables CONFIG_NET."
 CVE_STATUS[CVE-2024-57254] = "not-applicable-config: SquashFS runtime code is not built or linked into the host tools produced by tools-only_defconfig."
 CVE_STATUS[CVE-2024-57255] = "not-applicable-config: SquashFS runtime code is not built or linked into the host tools produced by tools-only_defconfig."
+CVE_STATUS[CVE-2024-57256] = "not-applicable-config: Ext4 runtime code is not built or linked into the host tools produced by tools-only_defconfig."
-- 
2.35.6

[OE-core][scarthgap][Patch 06/11] u-boot-tools: Ignore CVE-2024-57257

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- CVE-2024-57257 affects U-Boot SquashFS runtime parsing [1].
- The tools-only build graph does not link fs/squashfs into its host
  tools [2].
- Hence ignore this CVE for u-boot-tools; the exclusion is
  configuration-based.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2024-57257
[2] https://github.com/u-boot/u-boot/blob/866ca972d6c3/tools/Makefile

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
index 66e46fa7af..5bf2ca0f91 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
@@ -7,3 +7,4 @@ CVE_STATUS[CVE-2024-42040] = "not-applicable-config: DHCP client code in net/boo
 CVE_STATUS[CVE-2024-57254] = "not-applicable-config: SquashFS runtime code is not built or linked into the host tools produced by tools-only_defconfig."
 CVE_STATUS[CVE-2024-57255] = "not-applicable-config: SquashFS runtime code is not built or linked into the host tools produced by tools-only_defconfig."
 CVE_STATUS[CVE-2024-57256] = "not-applicable-config: Ext4 runtime code is not built or linked into the host tools produced by tools-only_defconfig."
+CVE_STATUS[CVE-2024-57257] = "not-applicable-config: SquashFS runtime code is not built or linked into the host tools produced by tools-only_defconfig."
-- 
2.35.6

[OE-core][scarthgap][Patch 07/11] u-boot-tools: Ignore CVE-2024-57258

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- CVE-2024-57258 affects U-Boot runtime allocation and target code [1].
- The tools-only build does not link that runtime code into its host
  tools [2].
- Hence ignore this CVE for u-boot-tools; the exclusion is
  configuration-based.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2024-57258
[2] https://github.com/u-boot/u-boot/blob/866ca972d6c3/tools/Makefile

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
index 5bf2ca0f91..4b836fc989 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
@@ -8,3 +8,4 @@ CVE_STATUS[CVE-2024-57254] = "not-applicable-config: SquashFS runtime code is no
 CVE_STATUS[CVE-2024-57255] = "not-applicable-config: SquashFS runtime code is not built or linked into the host tools produced by tools-only_defconfig."
 CVE_STATUS[CVE-2024-57256] = "not-applicable-config: Ext4 runtime code is not built or linked into the host tools produced by tools-only_defconfig."
 CVE_STATUS[CVE-2024-57257] = "not-applicable-config: SquashFS runtime code is not built or linked into the host tools produced by tools-only_defconfig."
+CVE_STATUS[CVE-2024-57258] = "not-applicable-config: The U-Boot runtime allocator and affected target architecture code are not linked into the host tools produced by tools-only_defconfig."
-- 
2.35.6

[OE-core][scarthgap][Patch 08/11] u-boot-tools: Ignore CVE-2024-57259

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- CVE-2024-57259 affects U-Boot SquashFS runtime parsing [1].
- The tools-only build graph does not link fs/squashfs into its host
  tools [2].
- Hence ignore this CVE for u-boot-tools; the exclusion is
  configuration-based.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2024-57259
[2] https://github.com/u-boot/u-boot/blob/866ca972d6c3/tools/Makefile

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
index 4b836fc989..898b808063 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
@@ -9,3 +9,4 @@ CVE_STATUS[CVE-2024-57255] = "not-applicable-config: SquashFS runtime code is no
 CVE_STATUS[CVE-2024-57256] = "not-applicable-config: Ext4 runtime code is not built or linked into the host tools produced by tools-only_defconfig."
 CVE_STATUS[CVE-2024-57257] = "not-applicable-config: SquashFS runtime code is not built or linked into the host tools produced by tools-only_defconfig."
 CVE_STATUS[CVE-2024-57258] = "not-applicable-config: The U-Boot runtime allocator and affected target architecture code are not linked into the host tools produced by tools-only_defconfig."
+CVE_STATUS[CVE-2024-57259] = "not-applicable-config: SquashFS runtime code is not built or linked into the host tools produced by tools-only_defconfig."
-- 
2.35.6

[OE-core][scarthgap][Patch 09/11] u-boot-tools: Ignore CVE-2026-29007

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- CVE-2026-29007 affects U-Boot TCP processing in net/tcp.c [1].
- u-boot-tools uses tools-only_defconfig, where CONFIG_NET is disabled
  [2].
- Hence ignore this CVE for u-boot-tools; the exclusion is
  configuration-based.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-29007
[2] https://github.com/u-boot/u-boot/blob/866ca972d6c3/configs/tools-only_defconfig

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
index 898b808063..b13135c4de 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
@@ -10,3 +10,4 @@ CVE_STATUS[CVE-2024-57256] = "not-applicable-config: Ext4 runtime code is not bu
 CVE_STATUS[CVE-2024-57257] = "not-applicable-config: SquashFS runtime code is not built or linked into the host tools produced by tools-only_defconfig."
 CVE_STATUS[CVE-2024-57258] = "not-applicable-config: The U-Boot runtime allocator and affected target architecture code are not linked into the host tools produced by tools-only_defconfig."
 CVE_STATUS[CVE-2024-57259] = "not-applicable-config: SquashFS runtime code is not built or linked into the host tools produced by tools-only_defconfig."
+CVE_STATUS[CVE-2026-29007] = "not-applicable-config: TCP runtime code in net/tcp.c is not built by tools-only_defconfig, which disables CONFIG_NET."
-- 
2.35.6

[OE-core][scarthgap][Patch 10/11] u-boot-tools: Ignore CVE-2026-29008

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- CVE-2026-29008 affects the U-Boot TCP receive state machine in
  net/tcp.c [1].
- u-boot-tools uses tools-only_defconfig, where CONFIG_NET is disabled
  [2].
- Hence ignore this CVE for u-boot-tools; the exclusion is
  configuration-based.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-29008
[2] https://github.com/u-boot/u-boot/blob/866ca972d6c3/configs/tools-only_defconfig

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
index b13135c4de..8579e18d7b 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
@@ -11,3 +11,4 @@ CVE_STATUS[CVE-2024-57257] = "not-applicable-config: SquashFS runtime code is no
 CVE_STATUS[CVE-2024-57258] = "not-applicable-config: The U-Boot runtime allocator and affected target architecture code are not linked into the host tools produced by tools-only_defconfig."
 CVE_STATUS[CVE-2024-57259] = "not-applicable-config: SquashFS runtime code is not built or linked into the host tools produced by tools-only_defconfig."
 CVE_STATUS[CVE-2026-29007] = "not-applicable-config: TCP runtime code in net/tcp.c is not built by tools-only_defconfig, which disables CONFIG_NET."
+CVE_STATUS[CVE-2026-29008] = "not-applicable-config: TCP runtime code in net/tcp.c is not built by tools-only_defconfig, which disables CONFIG_NET."
-- 
2.35.6

[OE-core][scarthgap][Patch 11/11] u-boot-tools: Ignore CVE-2026-29009

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- CVE-2026-29009 affects nfs_readlink_reply() when CONFIG_CMD_NFS is
  enabled [1].
- u-boot-tools uses tools-only_defconfig, where CONFIG_NET is disabled
  and CONFIG_CMD_NFS is not enabled [2].
- Hence ignore this CVE for u-boot-tools; the exclusion is
  configuration-based.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-29009
[2] https://github.com/u-boot/u-boot/blob/866ca972d6c3/configs/tools-only_defconfig

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
index 8579e18d7b..b2c4275ab9 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
@@ -12,3 +12,4 @@ CVE_STATUS[CVE-2024-57258] = "not-applicable-config: The U-Boot runtime allocato
 CVE_STATUS[CVE-2024-57259] = "not-applicable-config: SquashFS runtime code is not built or linked into the host tools produced by tools-only_defconfig."
 CVE_STATUS[CVE-2026-29007] = "not-applicable-config: TCP runtime code in net/tcp.c is not built by tools-only_defconfig, which disables CONFIG_NET."
 CVE_STATUS[CVE-2026-29008] = "not-applicable-config: TCP runtime code in net/tcp.c is not built by tools-only_defconfig, which disables CONFIG_NET."
+CVE_STATUS[CVE-2026-29009] = "not-applicable-config: NFS client runtime code is not built by tools-only_defconfig, which disables CONFIG_NET and does not enable CONFIG_CMD_NFS."
-- 
2.35.6

Re: [OE-core][scarthgap][Patch 02/11] u-boot-tools: Ignore CVE-2024-42040

[Yoann Congal]

On Wed Aug 26, 2026 at 10:12 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Hetvi Thakar <hthakar@cisco.com>
>
> Analysis:
> - CVE-2024-42040 affects the U-Boot DHCP client in net/bootp.c [1].
> - u-boot-tools uses tools-only_defconfig, where CONFIG_NET is disabled
>   [2].
> - Hence ignore this CVE for u-boot-tools; the exclusion is
>   configuration-based.
>
> Reference:
> [1] https://nvd.nist.gov/vuln/detail/CVE-2024-42040
> [2] https://github.com/u-boot/u-boot/blob/866ca972d6c3/configs/tools-only_defconfig
>
> Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
> ---
>  meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
> index 4b6d89ed4e..b5711e1f97 100644
> --- a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
> +++ b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
> @@ -2,3 +2,5 @@ require u-boot-common.inc
>  require u-boot-tools.inc
>  
>  SRC_URI += "file://CVE-2026-46728.patch"
> +
> +CVE_STATUS[CVE-2024-42040] = "not-applicable-config: DHCP client code in net/bootp.c is not built by tools-only_defconfig, which disables CONFIG_NET."

Hello,

I don't think we need this because, even if the code is not compiled, it
has been fixed earlier in scarthgap:
See 5c086db3f44 (u-boot: fix CVE-2024-42040, 2025-10-29)
Same reasonning apply to other patches in this series. Can you check if
we really need those?

Thanks!
-- 
Yoann Congal
Smile ECS

Re: [OE-core][scarthgap][Patch 02/11] u-boot-tools: Ignore CVE-2024-42040

[Yoann Congal]

On Fri Sep 11, 2026 at 2:46 PM CEST, Yoann Congal wrote:
> On Wed Aug 26, 2026 at 10:12 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
>> From: Hetvi Thakar <hthakar@cisco.com>
>>
>> Analysis:
>> - CVE-2024-42040 affects the U-Boot DHCP client in net/bootp.c [1].
>> - u-boot-tools uses tools-only_defconfig, where CONFIG_NET is disabled
>>   [2].
>> - Hence ignore this CVE for u-boot-tools; the exclusion is
>>   configuration-based.
>>
>> Reference:
>> [1] https://nvd.nist.gov/vuln/detail/CVE-2024-42040
>> [2] https://github.com/u-boot/u-boot/blob/866ca972d6c3/configs/tools-only_defconfig
>>
>> Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
>> ---
>>  meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb | 2 ++
>>  1 file changed, 2 insertions(+)
>>
>> diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
>> index 4b6d89ed4e..b5711e1f97 100644
>> --- a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
>> +++ b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
>> @@ -2,3 +2,5 @@ require u-boot-common.inc
>>  require u-boot-tools.inc
>>  
>>  SRC_URI += "file://CVE-2026-46728.patch"
>> +
>> +CVE_STATUS[CVE-2024-42040] = "not-applicable-config: DHCP client code in net/bootp.c is not built by tools-only_defconfig, which disables CONFIG_NET."
>
> Hello,
>
> I don't think we need this because, even if the code is not compiled, it
> has been fixed earlier in scarthgap:
> See 5c086db3f44 (u-boot: fix CVE-2024-42040, 2025-10-29)
> Same reasonning apply to other patches in this series. Can you check if
> we really need those?
>
> Thanks!

In the meantime, I took 1/11 in my branch and held the rest (2-11/11).
Be aware of this if you send a new series.

Thanks!
-- 
Yoann Congal
Smile ECS