From: Hetvi Thakar <[email protected]> CVE-2026-33243 is assigned to barebox, but NVD currently also maps it to denx:u-boot. That U-Boot mapping is incorrect because the U-Boot-side FIT hashed-nodes verification issue is tracked separately as CVE-2026-46728. A correction request has been sent to NVD to remove the incorrect denx:u-boot mapping. The existing patch backports U-Boot commit 2092322b31cc8b1f8c9e2e238d1043ae0637b241 [3], which is the U-Boot fix referenced by CVE-2026-46728 [2].
Rename the patch and update its CVE tag so the filename and metadata identify the affected U-Boot vendor correctly. Apply the same patch to u-boot-tools because that recipe builds fit_check_sign, which uses the affected FIT signature-verification path. The bootloader recipe already carried the backport, but u-boot-tools did not. [1] https://github.com/barebox/barebox/security/advisories/GHSA-3fvj-q26p-j6h4 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-46728 [3] https://github.com/u-boot/u-boot/commit/2092322b31cc8b1f8c9e2e238d1043ae0637b241 Signed-off-by: Hetvi Thakar <[email protected]> Signed-off-by: Yoann Congal <[email protected]> --- .../{CVE-2026-33243.patch => CVE-2026-46728.patch} | 11 ++++++++--- meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb | 4 ++++ meta/recipes-bsp/u-boot/u-boot_2026.01.bb | 4 +++- 3 files changed, 15 insertions(+), 4 deletions(-) rename meta/recipes-bsp/u-boot/files/{CVE-2026-33243.patch => CVE-2026-46728.patch} (98%) diff --git a/meta/recipes-bsp/u-boot/files/CVE-2026-33243.patch b/meta/recipes-bsp/u-boot/files/CVE-2026-46728.patch similarity index 98% rename from meta/recipes-bsp/u-boot/files/CVE-2026-33243.patch rename to meta/recipes-bsp/u-boot/files/CVE-2026-46728.patch index c7086e183fb..4e582d529ea 100644 --- a/meta/recipes-bsp/u-boot/files/CVE-2026-33243.patch +++ b/meta/recipes-bsp/u-boot/files/CVE-2026-46728.patch @@ -28,11 +28,16 @@ Closes: https://lore.kernel.org/u-boot/[email protected] Reported-by: Apple Security Engineering and Architecture (SEAR) Tested-by: Tom Rini <[email protected]> -[YB: Removed a skippable condition in fit_config_get_hash_list. - This flag is not available in this version] -CVE: CVE-2026-33243 +CVE: CVE-2026-46728 Upstream-Status: Backport [https://github.com/u-boot/u-boot/commit/2092322b31cc8b1f8c9e2e238d1043ae0637b241] + +Backport Changes: +Dropped the FIT_COMPAT_PROP condition because this macro is not +available in U-Boot v2026.01. + +(cherry picked from commit 2092322b31cc8b1f8c9e2e238d1043ae0637b241) Signed-off-by: Yanis Binard <[email protected]> +Signed-off-by: Hetvi Thakar <[email protected]> --- boot/image-fit-sig.c | 226 +++++++++++++++++++++++++++++------- doc/usage/fit/signature.rst | 19 ++- diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb index 5e2ed063868..77e086815c1 100644 --- a/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb +++ b/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb @@ -1,6 +1,10 @@ require u-boot-common.inc require u-boot-tools.inc +SRC_URI += "file://CVE-2026-46728.patch" + +CVE_STATUS[CVE-2026-33243] = "cpe-incorrect: NVD currently maps this CVE to denx:u-boot, but that mapping is incorrect for U-Boot; the U-Boot-side FIT issue is tracked separately as CVE-2026-46728 and is fixed by the included U-Boot backport." + CVE_STATUS[CVE-2026-29007] = "not-applicable-config: tools-only_defconfig disables networking; net/tcp.c is not compiled into u-boot-tools." CVE_STATUS[CVE-2026-29008] = "not-applicable-config: tools-only_defconfig disables networking; net/tcp.c is not compiled into u-boot-tools." CVE_STATUS[CVE-2026-29009] = "not-applicable-config: tools-only_defconfig disables networking; net/nfs.c is not compiled into u-boot-tools." diff --git a/meta/recipes-bsp/u-boot/u-boot_2026.01.bb b/meta/recipes-bsp/u-boot/u-boot_2026.01.bb index 6d9bc126a16..9610d9e8fe0 100644 --- a/meta/recipes-bsp/u-boot/u-boot_2026.01.bb +++ b/meta/recipes-bsp/u-boot/u-boot_2026.01.bb @@ -3,7 +3,9 @@ require u-boot.inc DEPENDS += "bc-native dtc-native gnutls-native python3-pyelftools-native" -SRC_URI += "file://CVE-2026-33243.patch" +SRC_URI += "file://CVE-2026-46728.patch" + +CVE_STATUS[CVE-2026-33243] = "cpe-incorrect: NVD currently maps this CVE to denx:u-boot, but that mapping is incorrect for U-Boot; the U-Boot-side FIT issue is tracked separately as CVE-2026-46728 and is fixed by the included U-Boot backport." # workarounds for aarch64 kvm qemu boot regressions SRC_URI:append:qemuarm64 = " file://disable-CONFIG_BLOBLIST.cfg"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245439): https://lists.openembedded.org/g/openembedded-core/message/245439 Mute This Topic: https://lists.openembedded.org/mt/121158868/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
