Hello, This second version still has issues and those are similar to v1.
On Mon Oct 12, 2026 at 1:14 PM CEST, Roopa via lists.openembedded.org Kalmath wrote: > nfs_readlink_reply() validates rlen only against the incoming packet > length (inherited from CVE-2019-14195), but not against the destination > buffer nfs_path_buff[2048]. A malicious NFS server can send a valid > READLINK reply where pathlen + rlen exceeds sizeof(nfs_path_buff), > overflowing the BSS buffer into adjacent memory. This paragraph above is referencing upstream code. This is not what need explaining here. > > Reference: > [https://nvd.nist.gov/vuln/detail/cve-2026-29009] > [https://www.cve.org/CVERecord?id=CVE-2026-29009] > > Backport the patch to fix CVE-2026-29009: > [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc] ... instead, please explain why you think the above commit is the right one to fix this CVE? (e.g. it is referenced from a trusted source: NVD, Debian, ...) > > Signed-off-by: Roopa Kalmath <[email protected]> > --- > .../u-boot/files/CVE-2026-29009.patch | 38 +++++++++++++++++++ > meta/recipes-bsp/u-boot/u-boot_2026.01.bb | 4 +- > 2 files changed, 41 insertions(+), 1 deletion(-) > create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch > > diff --git a/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch > b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch > new file mode 100644 > index 0000000000..860e504414 > --- /dev/null > +++ b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch > @@ -0,0 +1,38 @@ > +From 2b88f08722584cf235f7dacaa190af3d24deb40f Mon Sep 17 00:00:00 2001 > +From: Roopa Kalmath <[email protected]> > +Date: Fri, 9 Oct 2026 08:38:23 +0000 > +Subject: [PATCH] u-boot:Fix CVE-2026-29009 Please keep the original: * Subject: " net: nfs: fix buffer overflow in nfs_readlink_reply() " * Author: "Sebastian Alba Vives" * Commit message "nfs_readlink_reply() validates rlen only against the incoming [...]" > + > +CVE: CVE-2026-29009 > + > +Upstream-Status: Backport > [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc] > + > +Fixes: cf3a4f1e86 ("net: nfs: Fix CVE-2019-14195") > +Cc: [email protected] > +Signed-off-by: Sebastian Alba Vives <[email protected]> > +Reviewed-by: Jerome Forissier <[email protected]> > +Signed-off-by: Roopa Kalmath <[email protected]> > +--- > + net/nfs.c | 4 ++++ > + 1 file changed, 4 insertions(+) Regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#247664): https://lists.openembedded.org/g/openembedded-core/message/247664 Mute This Topic: https://lists.openembedded.org/mt/121712892/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
