From: Peter Marko <[email protected]> Pick patch referencing this CVE from 2026.90 release.
Signed-off-by: Peter Marko <[email protected]> --- .../dropbear/dropbear/CVE-2026-35385.patch | 42 +++++++++++++++++++ .../recipes-core/dropbear/dropbear_2022.83.bb | 1 + 2 files changed, 43 insertions(+) create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch diff --git a/meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch b/meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch new file mode 100644 index 00000000000..e220bf3a60b --- /dev/null +++ b/meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch @@ -0,0 +1,42 @@ +From 443ccc1fd1b9a4e3747f6b5cd644b7af49064308 Mon Sep 17 00:00:00 2001 +From: Matt Johnston <[email protected]> +Date: Sat, 2 May 2026 08:17:25 +0800 +Subject: [PATCH] scp: clear setuid/setgid bits on received files + +From openssh-portable 487e8ac146f7d6616f65c125d5edb210519b833a +Tracked as CVE-2026-35385 + +upstream: when downloading files as root in legacy (-O) mode and + +without the -p (preserve modes) flag set, clear setuid/setgid bits from +downloaded files as one might expect. + +AFAIK this bug dates back to the original Berkeley rcp program. + +Reported by Christos Papakonstantinou of Cantina and Spearbit. + +OpenBSD-Commit-ID: 49e902fca8dd933a92a9b547ab31f63e86729fa1 + +CVE: CVE-2026-35385 +Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/443ccc1fd1b9a4e3747f6b5cd644b7af49064308] +Signed-off-by: Peter Marko <[email protected]> +--- + scp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/scp.c b/scp.c +index 09297a5b..79b0a12d 100644 +--- a/scp.c ++++ b/scp.c +@@ -1111,8 +1111,10 @@ sink(int argc, char **argv, const char *src) + + setimes = targisdir = 0; + mask = umask(0); +- if (!pflag) ++ if (!pflag) { ++ mask |= 07000; + (void) umask(mask); ++ } + if (argc != 1) { + run_err("ambiguous target"); + exit(1); diff --git a/meta/recipes-core/dropbear/dropbear_2022.83.bb b/meta/recipes-core/dropbear/dropbear_2022.83.bb index d0256f21211..ed68abce8ed 100644 --- a/meta/recipes-core/dropbear/dropbear_2022.83.bb +++ b/meta/recipes-core/dropbear/dropbear_2022.83.bb @@ -33,6 +33,7 @@ SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \ file://CVE-2019-6111-02.patch \ file://CVE-2019-6111-03.patch \ file://CVE-2019-6111-04.patch \ + file://CVE-2026-35385.patch \ " SRC_URI[sha256sum] = "bc5a121ffbc94b5171ad5ebe01be42746d50aa797c9549a4639894a16749443b"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#248564): https://lists.openembedded.org/g/openembedded-core/message/248564 Mute This Topic: https://lists.openembedded.org/mt/121906327/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
