Re: [OE-core] [PATCH] glibc: Fix CVE-2021-27645

["Anatol Belski" <anbelski@linux.microsoft.com>]

Hi,

On 3/15/2021 10:36 PM, Denys Dmytriyenko wrote:
> https://wiki.yoctoproject.org/wiki/Stable_Release_and_LTS#Stable.2FLTS_Patch_Acceptance_Policies
>
> Stable/LTS Patch Acceptance Policies
>
> Potentially Acceptable:
> * Bug fix only version upgrades for upstreams with a good stable process
>
> Unacceptable:
> * General version upgrades
>
>
> So, unless there's a bugfix-only minor release of glibc, e.g. 2.31.1,
> upgrading to 2.32 or 2.33 in stable branches is highly unlikely, as both
> 2.32 and 2.33 have long lists of major changes:
>
> https://sourceware.org/pipermail/libc-announce/2020/000029.html
> https://sourceware.org/pipermail/libc-announce/2021/000030.html

thanks for linking the LTS doc.

My suggestion was to pull the latest upstream from 2.31 actually, not 
upgrading the glibc version. As per

http://git.yoctoproject.org/clean/cgit.cgi/poky/tree/meta/recipes-core/glibc/glibc-version.inc?h=dunfell

we consume from the branch release/2.31/master. It already contains the 
backported patch fixing this CVE.

There doesn't seem to be a release process in terms of versions, but it 
regularly receives backports. In fact,

there are already some bug and CVE fixes between the current SRCREV used 
and HEAD.

Regards

Anatol