mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-22 23:10:18 +00:00
Code Issues Projects Releases Wiki Activity

polkit: patch CVE-2026-4897 and CVE-2026-85498

Browse Source 
Pick patches mentioning these CVEs in their commit messages.
Note that patch for CVE-2026-4897 introduces CVE-2026-85498.
Also pick additional patch introduced between these commits which
touches the added code so the final patch applies cleanly.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
Peter Marko
2026-09-14 13:56:22 -07:00
committed by Khem Raj
parent e2d0044b92
commit 5a4fa2be12
4 changed files with 140 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-extended/polkit/files/CVE-2026-4897-01.patch
+64
View File
@@ -0,0 +1,64 @@
From 7e122c8a5120c2aae2d9d44a26796dc18f5b677c Mon Sep 17 00:00:00 2001
From: Jan Rybar <jrybar@redhat.com>
Date: Fri, 27 Mar 2026 15:57:01 +0100
Subject: [PATCH] CVE-2026-4897 - getline() string overflow
Report and fix by Aisle.com
Pavel Kohout, Aisle Research
Signed-off-by: Jan Rybar jrybar@redhat.com
CVE: CVE-2026-4897
Upstream-Status: Backport [https://github.com/polkit-org/polkit/commit/7e122c8a5120c2aae2d9d44a26796dc18f5b677c]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
src/polkitagent/polkitagenthelperprivate.c | 23 +++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)
diff --git a/src/polkitagent/polkitagenthelperprivate.c b/src/polkitagent/polkitagenthelperprivate.c
index 35bca85..7e4f94e 100644
--- a/src/polkitagent/polkitagenthelperprivate.c
+++ b/src/polkitagent/polkitagenthelperprivate.c
@@ -24,6 +24,7 @@
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
+#include <errno.h>
#include <unistd.h>
#ifndef HAVE_CLEARENV
@@ -59,21 +60,25 @@ read_cookie (int argc, char **argv)
return strdup (argv[2]);
else
{
- char *ret = NULL;
- size_t n = 0;
- ssize_t r = getline (&ret, &n, stdin);
- if (r == -1)
+ #define POLKIT_AGENT_MAX_COOKIE 4096
+ char buf[POLKIT_AGENT_MAX_COOKIE + 2]; /* +1 for newline, +1 for NUL */
+ if (fgets (buf, sizeof(buf), stdin) == NULL)
{
if (!feof (stdin))
- perror ("getline");
- free (ret);
+ perror ("fgets");
return NULL;
}
- else
+ if (buf[strlen (buf) - 1] != '\n')
{
- g_strchomp (ret);
- return ret;
+ /* Cookie too long - drain remaining input and reject */
+ int c;
+ while ((c = getchar ()) != '\n' && c != EOF)
+ ;
+ errno = EOVERFLOW;
+ return NULL;
}
+ g_strchomp (buf);
+ return strdup (buf);
}
}
meta-oe/recipes-extended/polkit/files/CVE-2026-4897-02.patch
+32
View File
@@ -0,0 +1,32 @@
From 39601309eb3e5e88a1c1fbda9a272ba8691f1bf3 Mon Sep 17 00:00:00 2001
From: Jan Rybar <jrybar@redhat.com>
Date: Wed, 13 May 2026 14:58:32 +0200
Subject: [PATCH] Draining loop can keep polkit busy
The draining loop is not really appropriate for pipe input, especially
in a daemon.
Co-authored-by: Frantisek Sumsal <fsumsal@redhat.com>
CVE: CVE-2026-4897
Upstream-Status: Backport [https://github.com/polkit-org/polkit/commit/39601309eb3e5e88a1c1fbda9a272ba8691f1bf3]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
src/polkitagent/polkitagenthelperprivate.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/src/polkitagent/polkitagenthelperprivate.c b/src/polkitagent/polkitagenthelperprivate.c
index 7e4f94e..c0a9825 100644
--- a/src/polkitagent/polkitagenthelperprivate.c
+++ b/src/polkitagent/polkitagenthelperprivate.c
@@ -70,10 +70,6 @@ read_cookie (int argc, char **argv)
}
if (buf[strlen (buf) - 1] != '\n')
{
- /* Cookie too long - drain remaining input and reject */
- int c;
- while ((c = getchar ()) != '\n' && c != EOF)
- ;
errno = EOVERFLOW;
return NULL;
}
meta-oe/recipes-extended/polkit/files/CVE-2026-85498.patch
+38
View File
@@ -0,0 +1,38 @@
From eea172967848bb4c5a407329f40c0e45de0d187e Mon Sep 17 00:00:00 2001
From: Jan Rybar <jrybar@redhat.com>
Date: Thu, 27 Aug 2026 15:02:45 +0200
Subject: [PATCH] CVE-2026-85498: Unsanitized underflow in cookie input
Credits for the report:
Sunwoo Lee, Korea Institute of Energy Technology (KENTECH)
Daeyoung Kang, Korea Institute of Energy Technology (KENTECH)
Haeryong Park, Korea Internet & Security Agency (KISA)
Hyuk Lim, Korea Institute of Energy Technology (KENTECH)
Seunghyun Yoon, Korea Institute of Energy Technology (KENTECH)
Juthawong Naisanguansee
Co-authored-by: Jan Rybar <jrybar@redhat.com>
CVE: CVE-2026-85498
Upstream-Status: Backport [https://github.com/polkit-org/polkit/commit/eea172967848bb4c5a407329f40c0e45de0d187e]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
src/polkitagent/polkitagenthelperprivate.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/polkitagent/polkitagenthelperprivate.c b/src/polkitagent/polkitagenthelperprivate.c
index c0a9825..e2d2c9b 100644
--- a/src/polkitagent/polkitagenthelperprivate.c
+++ b/src/polkitagent/polkitagenthelperprivate.c
@@ -68,6 +68,11 @@ read_cookie (int argc, char **argv)
perror ("fgets");
return NULL;
}
+ if (buf[0] == '\0')
+ {
+ errno = EINVAL;
+ return NULL;
+ }
if (buf[strlen (buf) - 1] != '\n')
{
errno = EOVERFLOW;
meta-oe/recipes-extended/polkit/polkit_127.bb
+6 -1
View File
@@ -5,7 +5,12 @@ LICENSE = "LGPL-2.0-or-later"
LIC_FILES_CHKSUM = "file://COPYING;md5=155db86cdbafa7532b41f390409283eb"
BUGTRACKER = "https://github.com/polkit-org/polkit/issues"
SRC_URI = "git://github.com/polkit-org/polkit.git;protocol=https;branch=main;tag=${PV}"
SRC_URI = "\
git://github.com/polkit-org/polkit.git;protocol=https;branch=main;tag=${PV} \
file://CVE-2026-4897-01.patch \
file://CVE-2026-4897-02.patch \
file://CVE-2026-85498.patch \
"
SRCREV = "9e4894c969eecf26a3ba762f4f7a268aa0fb3e51"