U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets that are appended without cumulative length validation. Attackers can send two or more READLINK responses containing relative symlink targets of approximately 1100 bytes each to corrupt adjacent BSS variables including nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id, potentially achieving memory corruption and control over the NFS client state machine.
Reference: [https://www.cve.org/CVERecord?id=CVE-2026-29009] Backport the patch to fix CVE-2026-29009: [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc] Signed-off-by: Roopa Kalmath <[email protected]> --- .../u-boot/files/CVE-2026-29009.patch | 34 +++++++++++++++++++ meta/recipes-bsp/u-boot/u-boot_2026.01.bb | 4 ++- 2 files changed, 37 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch diff --git a/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch new file mode 100644 index 0000000000..1e04562ede --- /dev/null +++ b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch @@ -0,0 +1,34 @@ +From 2b88f08722584cf235f7dacaa190af3d24deb40f Mon Sep 17 00:00:00 2001 +From: Roopa Kalmath <[email protected]> +Date: Fri, 9 Oct 2026 08:38:23 +0000 +Subject: [PATCH] u-boot:Fix CVE-2026-29009 + +CVE: CVE-2026-29009 + +Upstream-Status: Backport [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc] + +Signed-off-by: Roopa Kalmath <[email protected]> +--- + net/nfs.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/nfs.c b/net/nfs.c +index 537d4c62..9b628ecf 100644 +--- a/net/nfs.c ++++ b/net/nfs.c +@@ -698,11 +698,15 @@ static int nfs_readlink_reply(uchar *pkt, unsigned len) + + strcat(nfs_path, "/"); + pathlen = strlen(nfs_path); ++ if (pathlen + rlen >= sizeof(nfs_path_buff)) ++ return -NFS_RPC_DROP; + memcpy(nfs_path + pathlen, + (uchar *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset]), + rlen); + nfs_path[pathlen + rlen] = 0; + } else { ++ if (rlen >= sizeof(nfs_path_buff)) ++ return -NFS_RPC_DROP; + memcpy(nfs_path, + (uchar *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset]), + rlen); diff --git a/meta/recipes-bsp/u-boot/u-boot_2026.01.bb b/meta/recipes-bsp/u-boot/u-boot_2026.01.bb index 9610d9e8fe..8dd15cf9cd 100644 --- a/meta/recipes-bsp/u-boot/u-boot_2026.01.bb +++ b/meta/recipes-bsp/u-boot/u-boot_2026.01.bb @@ -3,7 +3,9 @@ require u-boot.inc DEPENDS += "bc-native dtc-native gnutls-native python3-pyelftools-native" -SRC_URI += "file://CVE-2026-46728.patch" +SRC_URI += "file://CVE-2026-46728.patch \ + file://CVE-2026-29009.patch \ +" CVE_STATUS[CVE-2026-33243] = "cpe-incorrect: NVD currently maps this CVE to denx:u-boot, but that mapping is incorrect for U-Boot; the U-Boot-side FIT issue is tracked separately as CVE-2026-46728 and is fixed by the included U-Boot backport." -- 2.49.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#247472): https://lists.openembedded.org/g/openembedded-core/message/247472 Mute This Topic: https://lists.openembedded.org/mt/121670283/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
