From 2af77e7bdce8770019cb15de98a3b638a3218d9f Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Thu, 29 Oct 2026 22:26:46 +1300 Subject: [PATCH] polkit: upgrade 127 -> 128 Dropped patched that are part of the upstream version. Changelog: https://github.com/polkit-org/polkit/blob/128/NEWS.md Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj --- .../polkit/files/CVE-2026-4897-01.patch | 64 ------------------- .../polkit/files/CVE-2026-4897-02.patch | 32 ---------- .../polkit/files/CVE-2026-85498.patch | 38 ----------- .../polkit/{polkit_127.bb => polkit_128.bb} | 5 +- 4 files changed, 1 insertion(+), 138 deletions(-) delete mode 100644 meta-oe/recipes-extended/polkit/files/CVE-2026-4897-01.patch delete mode 100644 meta-oe/recipes-extended/polkit/files/CVE-2026-4897-02.patch delete mode 100644 meta-oe/recipes-extended/polkit/files/CVE-2026-85498.patch rename meta-oe/recipes-extended/polkit/{polkit_127.bb => polkit_128.bb} (95%) diff --git a/meta-oe/recipes-extended/polkit/files/CVE-2026-4897-01.patch b/meta-oe/recipes-extended/polkit/files/CVE-2026-4897-01.patch deleted file mode 100644 index 96548ca771..0000000000 --- a/meta-oe/recipes-extended/polkit/files/CVE-2026-4897-01.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 7e122c8a5120c2aae2d9d44a26796dc18f5b677c Mon Sep 17 00:00:00 2001 -From: Jan Rybar -Date: Fri, 27 Mar 2026 15:57:01 +0100 -Subject: [PATCH] CVE-2026-4897 - getline() string overflow - -Report and fix by Aisle.com -Pavel Kohout, Aisle Research - -Signed-off-by: Jan Rybar jrybar@redhat.com - -CVE: CVE-2026-4897 -Upstream-Status: Backport [https://github.com/polkit-org/polkit/commit/7e122c8a5120c2aae2d9d44a26796dc18f5b677c] -Signed-off-by: Peter Marko ---- - src/polkitagent/polkitagenthelperprivate.c | 23 +++++++++++++--------- - 1 file changed, 14 insertions(+), 9 deletions(-) - -diff --git a/src/polkitagent/polkitagenthelperprivate.c b/src/polkitagent/polkitagenthelperprivate.c -index 35bca85..7e4f94e 100644 ---- a/src/polkitagent/polkitagenthelperprivate.c -+++ b/src/polkitagent/polkitagenthelperprivate.c -@@ -24,6 +24,7 @@ - #include - #include - #include -+#include - #include - - #ifndef HAVE_CLEARENV -@@ -59,21 +60,25 @@ read_cookie (int argc, char **argv) - return strdup (argv[2]); - else - { -- char *ret = NULL; -- size_t n = 0; -- ssize_t r = getline (&ret, &n, stdin); -- if (r == -1) -+ #define POLKIT_AGENT_MAX_COOKIE 4096 -+ char buf[POLKIT_AGENT_MAX_COOKIE + 2]; /* +1 for newline, +1 for NUL */ -+ if (fgets (buf, sizeof(buf), stdin) == NULL) - { - if (!feof (stdin)) -- perror ("getline"); -- free (ret); -+ perror ("fgets"); - return NULL; - } -- else -+ if (buf[strlen (buf) - 1] != '\n') - { -- g_strchomp (ret); -- return ret; -+ /* Cookie too long - drain remaining input and reject */ -+ int c; -+ while ((c = getchar ()) != '\n' && c != EOF) -+ ; -+ errno = EOVERFLOW; -+ return NULL; - } -+ g_strchomp (buf); -+ return strdup (buf); - } - } - diff --git a/meta-oe/recipes-extended/polkit/files/CVE-2026-4897-02.patch b/meta-oe/recipes-extended/polkit/files/CVE-2026-4897-02.patch deleted file mode 100644 index c47eee2014..0000000000 --- a/meta-oe/recipes-extended/polkit/files/CVE-2026-4897-02.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 39601309eb3e5e88a1c1fbda9a272ba8691f1bf3 Mon Sep 17 00:00:00 2001 -From: Jan Rybar -Date: Wed, 13 May 2026 14:58:32 +0200 -Subject: [PATCH] Draining loop can keep polkit busy - -The draining loop is not really appropriate for pipe input, especially -in a daemon. - -Co-authored-by: Frantisek Sumsal - -CVE: CVE-2026-4897 -Upstream-Status: Backport [https://github.com/polkit-org/polkit/commit/39601309eb3e5e88a1c1fbda9a272ba8691f1bf3] -Signed-off-by: Peter Marko ---- - src/polkitagent/polkitagenthelperprivate.c | 4 ---- - 1 file changed, 4 deletions(-) - -diff --git a/src/polkitagent/polkitagenthelperprivate.c b/src/polkitagent/polkitagenthelperprivate.c -index 7e4f94e..c0a9825 100644 ---- a/src/polkitagent/polkitagenthelperprivate.c -+++ b/src/polkitagent/polkitagenthelperprivate.c -@@ -70,10 +70,6 @@ read_cookie (int argc, char **argv) - } - if (buf[strlen (buf) - 1] != '\n') - { -- /* Cookie too long - drain remaining input and reject */ -- int c; -- while ((c = getchar ()) != '\n' && c != EOF) -- ; - errno = EOVERFLOW; - return NULL; - } diff --git a/meta-oe/recipes-extended/polkit/files/CVE-2026-85498.patch b/meta-oe/recipes-extended/polkit/files/CVE-2026-85498.patch deleted file mode 100644 index 891d9215c9..0000000000 --- a/meta-oe/recipes-extended/polkit/files/CVE-2026-85498.patch +++ /dev/null @@ -1,38 +0,0 @@ -From eea172967848bb4c5a407329f40c0e45de0d187e Mon Sep 17 00:00:00 2001 -From: Jan Rybar -Date: Thu, 27 Aug 2026 15:02:45 +0200 -Subject: [PATCH] CVE-2026-85498: Unsanitized underflow in cookie input - -Credits for the report: -Sunwoo Lee, Korea Institute of Energy Technology (KENTECH) -Daeyoung Kang, Korea Institute of Energy Technology (KENTECH) -Haeryong Park, Korea Internet & Security Agency (KISA) -Hyuk Lim, Korea Institute of Energy Technology (KENTECH) -Seunghyun Yoon, Korea Institute of Energy Technology (KENTECH) -Juthawong Naisanguansee - -Co-authored-by: Jan Rybar - -CVE: CVE-2026-85498 -Upstream-Status: Backport [https://github.com/polkit-org/polkit/commit/eea172967848bb4c5a407329f40c0e45de0d187e] -Signed-off-by: Peter Marko ---- - src/polkitagent/polkitagenthelperprivate.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/src/polkitagent/polkitagenthelperprivate.c b/src/polkitagent/polkitagenthelperprivate.c -index c0a9825..e2d2c9b 100644 ---- a/src/polkitagent/polkitagenthelperprivate.c -+++ b/src/polkitagent/polkitagenthelperprivate.c -@@ -68,6 +68,11 @@ read_cookie (int argc, char **argv) - perror ("fgets"); - return NULL; - } -+ if (buf[0] == '\0') -+ { -+ errno = EINVAL; -+ return NULL; -+ } - if (buf[strlen (buf) - 1] != '\n') - { - errno = EOVERFLOW; diff --git a/meta-oe/recipes-extended/polkit/polkit_127.bb b/meta-oe/recipes-extended/polkit/polkit_128.bb similarity index 95% rename from meta-oe/recipes-extended/polkit/polkit_127.bb rename to meta-oe/recipes-extended/polkit/polkit_128.bb index acd4386354..61dcdd0cb8 100644 --- a/meta-oe/recipes-extended/polkit/polkit_127.bb +++ b/meta-oe/recipes-extended/polkit/polkit_128.bb @@ -7,12 +7,9 @@ BUGTRACKER = "https://github.com/polkit-org/polkit/issues" SRC_URI = "\ git://github.com/polkit-org/polkit.git;protocol=https;branch=main;tag=${PV} \ - file://CVE-2026-4897-01.patch \ - file://CVE-2026-4897-02.patch \ - file://CVE-2026-85498.patch \ " -SRCREV = "9e4894c969eecf26a3ba762f4f7a268aa0fb3e51" +SRCREV = "e6373dc19975d8583568c6cd7025d03e682ca956" DEPENDS = "expat glib-2.0 duktape"