The CVE_STATUS entry for CVE-2025-14821 was added twice in the recipe.
Remove the duplicate entry to keep the recipe clean
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Since da15df26e6 ("jq: Fix CVE-2026-43895") "bitbake jq" fails with:
cc1: fatal error: src/parser.c: No such file or directory
That patch is the only jq patch touching both src/parser.c and
src/parser.y. git orders the diff alphabetically, so patch(1) writes
parser.y after parser.c and the shipped pre-generated parser looks
outdated. Maintainer mode is disabled, so make runs the no-op '.y.c'
rule; having "rebuilt" the target it stops resolving it through VPATH and
looks for it in ${B}, where it does not exist.
Touch the generated bison/flex sources before configure so they are never
considered stale. This also covers any future patch touching src/parser.y
or src/lexer.l.
With maintainer mode enabled bison will no longer regenerate parser.c,
which is fine: the CVE patches update the .y and the generated .c
consistently.
Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The function uio_line_from_file() fails to close the FILE pointer
when fgets() returns NULL, causing a file descriptor leak.
This can be triggered when reading from /sys files that return
empty content, leading to resource exhaustion over time.
Fix this by using goto-based error handling to ensure fclose()
is called on all exit paths.
Signed-off-by: Qliangw <qili00001@gmail.com>
(cherry picked from commit cd75edf25d)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit d97b5602d7)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The fixes are all part of v1.30.4, as explained in the release notes
[1].
I tested this with the configuration below:
BB_VERSION = "2.8.1"
BUILD_SYS = "x86_64-linux"
NATIVELSBSTRING = "fedora-39"
TARGET_SYS = "x86_64-oe-linux"
MACHINE = "qemux86-64"
DISTRO = "nodistro"
DISTRO_VERSION = "nodistro.0"
TUNE_FEATURES = "m64 core2"
TARGET_FPU = ""
meta = "scarthgap:3217490cc554069ae53aa54cf8ad7327ce85fa10"
For more details about the CVE: https://nvd.nist.gov/vuln/detail/CVE-2026-42533
[1] https://github.com/nginx/nginx/releases/tag/release-1.30.4
Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
===========
- Fixed timing leak vulnerability in EdDSA/Ed25519 signatures.
- Various minor documentation fixes.
- Various minor build system fixes.
- Various minor compiler warning fixes.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 25cfd0324c)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
A heap memory buffer overflow might occur in a worker process when using
a configuration with "ignore_invalid_headers off;" and
"large_client_header_buffers" with large configured values when
proxying a specially crafted request to gRPC backend, allowing an attacker
to cause worker process memory corruption or segmentation fault in a
worker process.
This is a partial cherry-pick of 131be8514da8985b15b74150521afedbf9cc4ea3
since ngx_http_proxy_v2_module.c does not exist in nginx 1.24
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Analysis:
- The Mbed TLS advisory states the issue occurs when LLVM
select-optimize is enabled. [1]
- The same advisory also states that Arm/x86 builds with
MBEDTLS_HAVE_ASM enabled are not affected. The default mbedtls
configuration in this branch enables MBEDTLS_HAVE_ASM.
- NVD also describes the issue as occurring only with LLVM's
select-optimize feature. [2]
- The mbedtls recipes now evaluate the effective build flags across
target, native, and nativesdk variants, handle the supported
-mllvm spellings, and only mark the CVE unpatched when the
vulnerable LLVM option combination is explicitly enabled and the
Arm/x86 MBEDTLS_HAVE_ASM carve-out does not apply.
- When those conditions are not met, the current mbedtls build
configuration is not affected.
- Hence ignoring/deferred the CVE for now.
Reference:
[1] https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-compiler-induced-constant-time-violations/
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-66442
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0eda0f3c55)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
CVE-2026-41401:
Fix incorrect metadata list pointer update in lyd_parse_set_data_flags()
when freeing the head metadata entry. Without this fix, crafted YANG XML
documents with specific metadata ordering can trigger invalid pointer
states in the metadata linked list.
CVE-2026-44673:
Fix integer overflow and OOM in the LYB binary parser. lyb_read_string()
wraps len + 1 to 0 when len == UINT64_MAX, and lyb_read_term_value()
truncates uint64_t to uint32_t causing undersized allocation. Both paths
are reachable via malformed LYB input with crafted length fields.
Signed-off-by: Yunseong Kim <yunseong.kim@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The onig_sys and blake3 crates build bundled C via cc crate. The build
path leaks into the the -dbg binary and trips the buildpaths QA check.
Add a -fdebug-prefix-map for ${CARGO_HOME} to CFLAGS to add a correct
mapping.
Signed-off-by: Esa Jaaskela <esa.jaaskela@suomi24.fi>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Prior to version 2.21, the `radvdump` utility shipped with radvd
contains a stack buffer overflow in the Route Information option
parser.
When processing a crafted ICMPv6 Router Advertisement, `print_ff()`
copies up to 2032 bytes from attacker-controlled packet data into a
16-byte `struct in6_addr` on the stack, overflowing by up to 2016
bytes.
Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This patch applies the upstream Samba security backport for
CVE-2026-4408. The upstream security bundle is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commit links are recorded in the embedded patch headers.
Only the CVE-2026-4408-relevant commits from [1] are backported:
[PATCH 11/31] through [PATCH 21/31] and [PATCH 25/31] through
[PATCH 31/31]. The remaining bundle commits are intentionally omitted
because they fix separate CVEs: CVE-2026-1933, CVE-2026-2340,
CVE-2026-3012, CVE-2026-3238, and CVE-2026-4480-only changes.
[1] https://www.samba.org/samba/ftp/patches/security/samba-4.22.9-security-2026-05-25.patch
[2] https://www.samba.org/samba/security/CVE-2026-4408.html
Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Ankur Tyagi
Vijay Anusuri
Hetvi Thakar
Darsh Kelaiya
Emanuele Ghidoli
Benjamin Bouvier
s-tokumoto
Adarsh Jagadish Kamini
Jason Schonberg
Qliangw
Joao Marcos Costa
Wang Mingyu
Khem Raj
Benjamin Robin (Schneider Electric)
Peter Marko
Deepak Rathore
Yunseong Kim
Esa Jaaskela
Etienne Cordonnier
Roland Kovacs
Ashishkumar Parmar
Sudhir Dumbhare