From: Hetvi Thakar <[email protected]> Address eleven U-Boot CVE findings for the U-Boot 2024.01 tools-only build on scarthgap.
Backport the upstream fix for CVE-2026-46728. The fix rebuilds the FIT signed-node list from the selected configuration instead of trusting the attacker-controlled hashed-nodes property. Add the patch to both the u-boot and u-boot-tools recipes because the affected FIT handling is used by both builds. Mark the remaining ten CVEs as not-applicable-config for u-boot-tools. These vulnerabilities affect networking or target runtime code that is not built into the tools-only configuration: - CVE-2024-42040 affects the DHCP client. - CVE-2024-57254, CVE-2024-57255, CVE-2024-57257 and CVE-2024-57259 affect SquashFS runtime parsing. - CVE-2024-57256 affects Ext4 runtime parsing. - CVE-2024-57258 affects runtime allocator and target architecture code. - CVE-2026-29007 and CVE-2026-29008 affect TCP processing. - CVE-2026-29009 affects the NFS client. The tools-only build disables CONFIG_NET and does not link the affected SquashFS, Ext4, allocator, architecture, TCP or NFS runtime code. Testing: - Successfully applied the embedded CVE-2026-46728 patch to U-Boot 2024.01 without conflicts or fuzz. - u-boot-tools build completed successfully. - u-boot build completed successfully. Hetvi Thakar (11): u-boot, u-boot-tools: Fix CVE-2026-46728 u-boot-tools: Ignore CVE-2024-42040 u-boot-tools: Ignore CVE-2024-57254 u-boot-tools: Ignore CVE-2024-57255 u-boot-tools: Ignore CVE-2024-57256 u-boot-tools: Ignore CVE-2024-57257 u-boot-tools: Ignore CVE-2024-57258 u-boot-tools: Ignore CVE-2024-57259 u-boot-tools: Ignore CVE-2026-29007 u-boot-tools: Ignore CVE-2026-29008 u-boot-tools: Ignore CVE-2026-29009 .../u-boot/files/CVE-2026-46728.patch | 379 ++++++++++++++++++ .../u-boot/u-boot-tools_2024.01.bb | 13 + meta/recipes-bsp/u-boot/u-boot_2024.01.bb | 1 + 3 files changed, 393 insertions(+) create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-46728.patch base-commit: 543550522f831479f07d332a40ba343c53ae1065 -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244327): https://lists.openembedded.org/g/openembedded-core/message/244327 Mute This Topic: https://lists.openembedded.org/mt/120933874/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
