On Mon Oct 5, 2026 at 7:05 PM CEST, Peter Marko via lists.openembedded.org wrote: > From: Peter Marko <[email protected]> > > Pick patch referencing this CVE from 2.41.5 release. > Also pick patches implementing used helper functions and fixing > consequent build errors. > > Signed-off-by: Peter Marko <[email protected]> > --- > meta/recipes-core/util-linux/util-linux.inc | 5 + > ...ib-fileutils-add-ul_open_no_symlinks.patch | 98 +++++++++ > ...dd-ul_openat_resolve-openat2-wrapper.patch | 85 ++++++++ > ...x-RESOLVE_NO_SYMLINKS-fallback-value.patch | 71 +++++++ > ...x-unused-parameter-warnings-without-.patch | 64 ++++++ > .../util-linux/CVE-2026-53613.patch | 192 ++++++++++++++++++ > 6 files changed, 515 insertions(+) > create mode 100644 > meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_open_no_symlinks.patch > create mode 100644 > meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_openat_resolve-openat2-wrapper.patch > create mode 100644 > meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-fix-RESOLVE_NO_SYMLINKS-fallback-value.patch > create mode 100644 > meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-fix-unused-parameter-warnings-without-.patch > create mode 100644 > meta/recipes-core/util-linux/util-linux/CVE-2026-53613.patch > > diff --git a/meta/recipes-core/util-linux/util-linux.inc > b/meta/recipes-core/util-linux/util-linux.inc > index 70acf6dfec3..db698ef9367 100644 > --- a/meta/recipes-core/util-linux/util-linux.inc > +++ b/meta/recipes-core/util-linux/util-linux.inc > @@ -50,6 +50,11 @@ SRC_URI = > "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin > file://CVE-2026-13595.patch \ > file://CVE-2026-3184.patch \ > file://CVE-2026-53614.patch \ > + file://0001-lib-fileutils-add-ul_open_no_symlinks.patch \ > + > file://0001-lib-fileutils-add-ul_openat_resolve-openat2-wrapper.patch \ > + > file://0001-lib-fileutils-fix-unused-parameter-warnings-without-.patch \ > + > file://0001-lib-fileutils-fix-RESOLVE_NO_SYMLINKS-fallback-value.patch \ > + file://CVE-2026-53613.patch \ > " > > SRC_URI[sha256sum] = > "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f" > diff --git > a/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_openat_resolve-openat2-wrapper.patch > > b/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_openat_resolve-openat2-wrapper.patch > new file mode 100644 > index 00000000000..f8320ae82d5 > --- /dev/null > +++ > b/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_openat_resolve-openat2-wrapper.patch > @@ -0,0 +1,85 @@ > +From 4cccf4edc256507734e3484cfaedf5980945c2fa Mon Sep 17 00:00:00 2001 > +From: Karel Zak <[email protected]> > +Date: Mon, 20 Jul 2026 14:36:16 +0200 > +Subject: [PATCH] lib/fileutils: add ul_openat_resolve() openat2 wrapper > + > +Add ul_openat_resolve() as a generic openat2(2) wrapper with > +caller-specified resolve flags. No fallback to weaker alternatives -- > +returns -1/ENOSYS if openat2 is unavailable. > + > +Rewrite ul_open_no_symlinks() to use ul_openat_resolve() with > +RESOLVE_NO_SYMLINKS, dropping the unsafe O_NOFOLLOW fallback that > +only protected the final path component. > + > +Add fallback defines for RESOLVE_NO_SYMLINKS and RESOLVE_BENEATH > +in fileutils.h. > + > +Signed-off-by: Karel Zak <[email protected]> > +(cherry picked from commit b9e07ce6f5ad54c38cf3ebc7100101e487be91bd) > +(cherry picked from commit 1426aa06ff2f6a21cba9102c35e3577641b356ff) > + > +Upstream-Status: Backport > [https://github.com/util-linux/util-linux/commit/4cccf4edc256507734e3484cfaedf5980945c2fa] > +Signed-off-by: Peter Marko <[email protected]> > +--- > + include/fileutils.h | 9 +++++++++ > + lib/fileutils.c | 22 ++++++++++++++-------- > + 2 files changed, 23 insertions(+), 8 deletions(-) > + Hello
Isn't this patch similar to what caused https://bugzilla.yoctoproject.org/show_bug.cgi?id=16316 with tar? (implementing a "new" openat2 syscall not supported by pseudo) Is that safe to do here? We updated pseudo to fix that, but, I'd like to take some care to not re-introduce the bug... Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#247710): https://lists.openembedded.org/g/openembedded-core/message/247710 Mute This Topic: https://lists.openembedded.org/mt/121595316/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
