Hello, On Fri Oct 23, 2026 at 12:47 AM CEST, Peter Marko via lists.openembedded.org wrote: > From: Peter Marko <[email protected]> > > Pick patch [1] which is [2] backported to 3.41 (oldest release still ^ I think it should be 2.41 here, I fixed that on other patches of my branch.
> receiving security updates) which is mentioned in [3] and [4]. > > Additionally pick 3 patches for test harness to support new tests. > > [1] > https://sourceware.org/git/?p=glibc.git;a=commit;h=71648e80042658f23965924616fb7db9c2fccff9 > [2] > https://sourceware.org/git/?p=glibc.git;a=commit;h=ed0c137b97eb940b4b64981e84ed806d3276edd9 Those 2 commits are really different, can you check? > [3] https://security-tracker.debian.org/tracker/CVE-2026-86805 > [3] https://security-tracker.debian.org/tracker/CVE-2026-95818 ^ should be [4] > > Signed-off-by: Peter Marko <[email protected]> > --- > ...043-CVE-2026-86805-CVE-2026-95818-01.patch | 244 +++++ > ...044-CVE-2026-86805-CVE-2026-95818-02.patch | 298 ++++++ > ...045-CVE-2026-86805-CVE-2026-95818-03.patch | 115 +++ > ...046-CVE-2026-86805-CVE-2026-95818-04.patch | 862 ++++++++++++++++++ > meta/recipes-core/glibc/glibc_2.39.bb | 4 + > 5 files changed, 1523 insertions(+) > create mode 100644 > meta/recipes-core/glibc/glibc/0043-CVE-2026-86805-CVE-2026-95818-01.patch > create mode 100644 > meta/recipes-core/glibc/glibc/0044-CVE-2026-86805-CVE-2026-95818-02.patch > create mode 100644 > meta/recipes-core/glibc/glibc/0045-CVE-2026-86805-CVE-2026-95818-03.patch > create mode 100644 > meta/recipes-core/glibc/glibc/0046-CVE-2026-86805-CVE-2026-95818-04.patch > > diff --git > a/meta/recipes-core/glibc/glibc/0043-CVE-2026-86805-CVE-2026-95818-01.patch > b/meta/recipes-core/glibc/glibc/0043-CVE-2026-86805-CVE-2026-95818-01.patch > new file mode 100644 > index 00000000000..42294f02838 > --- /dev/null > +++ > b/meta/recipes-core/glibc/glibc/0043-CVE-2026-86805-CVE-2026-95818-01.patch > @@ -0,0 +1,244 @@ > +From 71648e80042658f23965924616fb7db9c2fccff9 Mon Sep 17 00:00:00 2001 > +From: Joe Simmons-Talbott <[email protected]> > +Date: Thu, 29 Feb 2024 19:55:58 +0000 > +Subject: [PATCH] rtld: Add glibc.rtld.enable_secure tunable. > + > +Add a tunable for setting __libc_enable_secure to 1. Do not set > +__libc_enable_secure to 0 if the tunable is set to 0. Ignore all > +tunables if glib.rtld.enable_secure is set. One use-case for this > +addition is to enable testing code paths that depend on > +__libc_enable_secure being set without the need to use setxid binaries. > + > +Reviewed-by: Siddhesh Poyarekar <[email protected]> > + > +CVE: CVE-2026-86805 > +CVE: CVE-2026-95818 > +Upstream-Status: Backport > [https://sourceware.org/git/?p=glibc.git;a=commit;h=71648e80042658f23965924616fb7db9c2fccff9] > +Signed-off-by: Peter Marko <[email protected]> > +--- > + NEWS | 5 ++ > + elf/Makefile | 2 + > + elf/dl-tunables.c | 10 +++ > + elf/dl-tunables.list | 6 ++ > + elf/tst-rtld-list-tunables.exp | 1 + > + elf/tst-tunables-enable_secure.c | 126 +++++++++++++++++++++++++++++++ > + 6 files changed, 150 insertions(+) > + create mode 100644 elf/tst-tunables-enable_secure.c > + > +diff --git a/NEWS b/NEWS > +index 2d8eaffc58..19f4e93ea3 100644 > +--- a/NEWS > ++++ b/NEWS > +@@ -177,6 +177,11 @@ Major new features: > + exp, expf, exp10, exp10f, exp2, exp2f, expm1, expm1f, log, logf, > + log10, log10f, log1p, log1pf, log2, log2f, sin, sinf, tan, tanf. > + > ++* A new tunable, glibc.rtld.enable_secure, used to run a program > ++ as if it were a setuid process. This is currently a testing tool to allow > ++ more extensive verification tests for AT_SECURE programs and not meant to > ++ be a security feature. > ++ > + Deprecated and removed features, and other changes affecting compatibility: > + > + * The ldconfig program now skips file names containing ';' or ending in > [...] > diff --git > a/meta/recipes-core/glibc/glibc/0044-CVE-2026-86805-CVE-2026-95818-02.patch > b/meta/recipes-core/glibc/glibc/0044-CVE-2026-86805-CVE-2026-95818-02.patch > new file mode 100644 > index 00000000000..bcb1e08a30f > --- /dev/null > +++ > b/meta/recipes-core/glibc/glibc/0044-CVE-2026-86805-CVE-2026-95818-02.patch > @@ -0,0 +1,298 @@ > +From 1e1ad714ee9a663eda0e2bffad1d9f258b00a4e9 Mon Sep 17 00:00:00 2001 > +From: Adhemerval Zanella <[email protected]> > +Date: Mon, 6 May 2024 13:18:47 -0300 > +Subject: [PATCH] support: Add envp argument to support_capture_subprogram > + > +So tests can specify a list of environment variables. > +Reviewed-by: Siddhesh Poyarekar <[email protected]> > + > +CVE: CVE-2026-86805 > +CVE: CVE-2026-95818 > +Upstream-Status: Backport > [https://sourceware.org/git/?p=glibc.git;a=commit;h=1e1ad714ee9a663eda0e2bffad1d9f258b00a4e9] > +Signed-off-by: Peter Marko <[email protected]> > +--- > + elf/tst-audit18.c | 2 +- > + elf/tst-audit19b.c | 2 +- > + elf/tst-audit22.c | 2 +- > + elf/tst-audit23.c | 2 +- > + elf/tst-audit25a.c | 4 ++-- > + elf/tst-audit25b.c | 4 ++-- > + elf/tst-glibc-hwcaps-2-cache.c | 2 +- > + elf/tst-rtld-run-static.c | 4 ++-- > + elf/tst-tunables-enable_secure.c | 2 +- > + elf/tst-tunables.c | 2 +- > + support/capture_subprocess.h | 9 +++++---- > + support/subprocess.h | 7 ++++--- > + support/support_capture_subprocess.c | 5 +++-- > + support/support_subprocess.c | 5 +++-- > + support/tst-support_capture_subprocess.c | 2 +- > + sysdeps/x86/tst-hwcap-tunables.c | 2 +- > + 16 files changed, 30 insertions(+), 26 deletions(-) > + > [...] > diff --git > a/meta/recipes-core/glibc/glibc/0045-CVE-2026-86805-CVE-2026-95818-03.patch > b/meta/recipes-core/glibc/glibc/0045-CVE-2026-86805-CVE-2026-95818-03.patch > new file mode 100644 > index 00000000000..bb39978881d > --- /dev/null > +++ > b/meta/recipes-core/glibc/glibc/0045-CVE-2026-86805-CVE-2026-95818-03.patch > @@ -0,0 +1,115 @@ > +From eeb687bb4b371d67abcd3c4c84d5990d8bc78b71 Mon Sep 17 00:00:00 2001 > +From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20B=C3=A9rat?= <[email protected]> > +Date: Fri, 29 Nov 2024 14:48:43 +0100 > +Subject: [PATCH] support: Add support_next_to_fault_before support function > + > +Refactor the support_next_to_fault and add the > +support_next_to_fault_before method returns a buffer with a protected > +page before it, to be able to test buffer underflow accesses. > + > +Reviewed-by: Tulio Magno Quites Machado Filho <[email protected]> > +(cherry picked from commit fa53723cdb6f0338558e57a2a0a6459c00a1bc5f) > + > +CVE: CVE-2026-86805 > +CVE: CVE-2026-95818 > +Upstream-Status: Backport > [https://sourceware.org/git/?p=glibc.git;a=commit;h=eeb687bb4b371d67abcd3c4c84d5990d8bc78b71] > +Signed-off-by: Peter Marko <[email protected]> > +--- > + support/next_to_fault.c | 44 +++++++++++++++++++++++++++++++---------- > + support/next_to_fault.h | 5 +++++ > + 2 files changed, 39 insertions(+), 10 deletions(-) > [...] > diff --git > a/meta/recipes-core/glibc/glibc/0046-CVE-2026-86805-CVE-2026-95818-04.patch > b/meta/recipes-core/glibc/glibc/0046-CVE-2026-86805-CVE-2026-95818-04.patch > new file mode 100644 > index 00000000000..f6c92a7a3a8 > --- /dev/null > +++ > b/meta/recipes-core/glibc/glibc/0046-CVE-2026-86805-CVE-2026-95818-04.patch > @@ -0,0 +1,862 @@ > +From 629565b0c91dc326ac622b05982f21a374cd03c4 Mon Sep 17 00:00:00 2001 > +From: Adhemerval Zanella <[email protected]> > +Date: Mon, 17 Aug 2026 15:15:32 -0300 > +Subject: [PATCH] elf: Open the normalized $ORIGIN rpath in AT_SECURE programs > + (BZ 34360) > + > +For AT_SECURE programs the loader honors $ORIGIN in DT_RPATH only when the > +expansion is rooted in a trusted directory, but it validated the lexically > +normalized path while opening the raw expansion. As "a/b/../c" only names > +"a/c" when "b" is not a symlink, an attacker who controls a component of > +$ORIGIN -- e.g. by hard-linking the setuid binary into an attacker-owned > +directory -- can make the opened path escape the trusted directory even > +though the check passed, loading an attacker-controlled object. > + > +Normalize the expansion in place and open that, so the path that is opened > +is exactly the path that was validated. _dl_normalize_path rewrites the > +string in place without ever advancing its write cursor past its read > +cursor or appending, so it stays within the original storage. > + > +Add elf/tst-origin-secure as a regression test. > + > +Reviewed-by: Florian Weimer <[email protected]> > +(cherry picked from commit ed0c137b97eb940b4b64981e84ed806d3276edd9) > + > +CVE: CVE-2026-86805 > +CVE: CVE-2026-95818 > +Upstream-Status: Backport > [https://sourceware.org/git/?p=glibc.git;a=commit;h=629565b0c91dc326ac622b05982f21a374cd03c4] > +Signed-off-by: Peter Marko <[email protected]> > +--- > + elf/Makefile | 18 ++ > + elf/dl-load.c | 74 +++------ > + elf/dl-path-normalize.h | 118 +++++++++++++ > + elf/libtst-origin-secure-mod.c | 25 +++ > + elf/tst-dl-path-normalize.c | 142 ++++++++++++++++ > + elf/tst-origin-secure-evilmod.c | 28 ++++ > + elf/tst-origin-secure-victim.c | 43 +++++ > + elf/tst-origin-secure.c | 203 +++++++++++++++++++++++ > + elf/tst-origin-secure.h | 41 +++++ > + elf/tst-origin-secure.root/postclean.req | 0 > + 10 files changed, 643 insertions(+), 49 deletions(-) > + create mode 100644 elf/dl-path-normalize.h > + create mode 100644 elf/libtst-origin-secure-mod.c > + create mode 100644 elf/tst-dl-path-normalize.c > + create mode 100644 elf/tst-origin-secure-evilmod.c > + create mode 100644 elf/tst-origin-secure-victim.c > + create mode 100644 elf/tst-origin-secure.c > + create mode 100644 elf/tst-origin-secure.h > + create mode 100644 elf/tst-origin-secure.root/postclean.req > + > +diff --git a/elf/Makefile b/elf/Makefile > +index d8a0c0c4ae..8a5aa0123a 100644 > +--- a/elf/Makefile > ++++ b/elf/Makefile > [...] > +diff --git a/elf/dl-load.c b/elf/dl-load.c > +index 7b21f1dffa..0d141a61c1 100644 > +--- a/elf/dl-load.c > ++++ b/elf/dl-load.c > +@@ -32,6 +32,7 @@ > + #include <sys/stat.h> > + #include <sys/types.h> > + #include <gnu/lib-names.h> > ++#include <dl-path-normalize.h> > + > + /* Type for the buffer we put the ELF header and hopefully the program > + header. This buffer does not really have to be too large. In most > +@@ -124,54 +125,24 @@ static const size_t system_dirs_len[] = > + }; > + #define nsystem_dirs_len array_length (system_dirs_len) > + > ++/* Return true if the normalized path NPATH of length NLEN is rooted in one > of > ++ the trusted system directories. The system_dirs entries carry a trailing > ++ '/'; NPATH matches an entry when it shares the entry's leading component > ++ sequence and then either ends or continues with '/'. For instance, > ++ "/lib64" and "/lib64/x" match "/lib64/" but "/lib64x" does not. */ > + static bool > +-is_trusted_path_normalize (const char *path, size_t len) > ++path_is_trusted (const char *npath, size_t nlen) > + { > +- if (len == 0) > +- return false; > +- > +- char *npath = (char *) alloca (len + 2); > +- char *wnp = npath; > +- while (*path != '\0') > +- { > +- if (path[0] == '/') > +- { > +- if (path[1] == '.') > +- { > +- if (path[2] == '.' && (path[3] == '/' || path[3] == '\0')) > +- { > +- while (wnp > npath && *--wnp != '/') > +- ; > +- path += 3; > +- continue; > +- } > +- else if (path[2] == '/' || path[2] == '\0') > +- { > +- path += 2; > +- continue; > +- } > +- } > +- > +- if (wnp > npath && wnp[-1] == '/') > +- { > +- ++path; > +- continue; > +- } > +- } > +- > +- *wnp++ = *path++; > +- } > +- > +- if (wnp == npath || wnp[-1] != '/') > +- *wnp++ = '/'; > +- > + const char *trun = system_dirs; > + > + for (size_t idx = 0; idx < nsystem_dirs_len; ++idx) > + { > +- if (wnp - npath >= system_dirs_len[idx] > +- && memcmp (trun, npath, system_dirs_len[idx]) == 0) > +- /* Found it. */ > ++ /* Compare against the entry without its trailing '/'. */ > ++ size_t dirlen = system_dirs_len[idx] - 1; > ++ > ++ if (nlen >= dirlen > ++ && memcmp (trun, npath, dirlen) == 0 > ++ && (npath[dirlen] == '/' || npath[dirlen] == '\0')) > + return true; > + > + trun += system_dirs_len[idx] + 1; > +@@ -361,16 +332,21 @@ _dl_dst_substitute (struct link_map *l, const char > *input, char *result) > + checked for trust, the authors of the binaries themselves are > + trusted to have designed this correctly. Only $ORIGIN is tested in > + this way because it may be manipulated in some ways with hard > +- links. */ > +- if (__glibc_unlikely (check_for_trusted) > +- && !is_trusted_path_normalize (result, wp - result)) > +- { > +- *result = '\0'; > +- return result; > +- } > ++ links. > ++ > ++ _dl_normalize_path replaces the expansion with its normalized form > ++ in place, so that the path that is opened is exactly the path that > ++ was validated. */ > + > + *wp = '\0'; > + > ++ if (__glibc_unlikely (check_for_trusted)) > ++ { > ++ size_t nlen = _dl_normalize_path (result); > ++ if (!path_is_trusted (result, nlen)) > ++ *result = '\0'; > ++ } > ++ If I understood correctly, the above hunk is the CVE fix (accompagnied by the _dl_normalize_path() definition below) everything else is test code and support to test code (including the new "tunable" in patch -01). Are you sure we need all of that? To me a new tunable (whatever that is) feels a bit much for "just" testing a CVE fix. > + return result; > + } > + > +diff --git a/elf/dl-path-normalize.h b/elf/dl-path-normalize.h > +diff --git a/elf/libtst-origin-secure-mod.c b/elf/libtst-origin-secure-mod.c > +diff --git a/elf/tst-dl-path-normalize.c b/elf/tst-dl-path-normalize.c > +diff --git a/elf/tst-origin-secure-evilmod.c > b/elf/tst-origin-secure-evilmod.c > +diff --git a/elf/tst-origin-secure-victim.c b/elf/tst-origin-secure-victim.c > +diff --git a/elf/tst-origin-secure.c b/elf/tst-origin-secure.c > +diff --git a/elf/tst-origin-secure.h b/elf/tst-origin-secure.h > +diff --git a/elf/tst-origin-secure.root/postclean.req > b/elf/tst-origin-secure.root/postclean.req > diff --git a/meta/recipes-core/glibc/glibc_2.39.bb > b/meta/recipes-core/glibc/glibc_2.39.bb > index 3b27328c21a..d8867bcff9a 100644 > --- a/meta/recipes-core/glibc/glibc_2.39.bb > +++ b/meta/recipes-core/glibc/glibc_2.39.bb > @@ -75,6 +75,10 @@ SRC_URI = > "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ > file://0040-CVE-2026-18374-01.patch \ > file://0041-CVE-2026-18374-02.patch \ > file://0042-CVE-2026-8674.patch \ > + file://0043-CVE-2026-86805-CVE-2026-95818-01.patch \ > + file://0044-CVE-2026-86805-CVE-2026-95818-02.patch \ > + file://0045-CVE-2026-86805-CVE-2026-95818-03.patch \ > + file://0046-CVE-2026-86805-CVE-2026-95818-04.patch \ > " > S = "${WORKDIR}/git" > B = "${WORKDIR}/build-${TARGET_SYS}" Other patches before this one in the series (1-11/15) look good to me, I will take those but hold this on (12/15). I will review 13-15/15 and take them if they apply cleanly. Regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#248975): https://lists.openembedded.org/g/openembedded-core/message/248975 Mute This Topic: https://lists.openembedded.org/mt/121892962/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
