summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* libx11: fix CVE-2022-3555 memory leak in _XFreeX11XCBStructure() of xcb_disp.cVivek Kumbhar2023-01-062-0/+39
| | | | | | | | (From OE-Core rev: f17a61d12ceb5be203e1a1af9125bb61673a8b41) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rsync: fix CVE-2022-29154 remote arbitrary files write inside the ↵Vivek Kumbhar2023-01-062-0/+335
| | | | | | | | | | directories of connecting peers (From OE-Core rev: d92312146832cd14963422b8c14b2f2c409821c7) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: fix CVE-2022-41717 Excessive memory use in got serverVivek Kumbhar2023-01-062-0/+76
| | | | | | | | (From OE-Core rev: a483f182676d87b7035e37fac8e21226fbd9fd63) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub2: CVE-2022-28735 shim_lock verifier allows non-kernel files to be loadedHitendra Prajapati2023-01-062-0/+272
| | | | | | | | | | Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=6fe755c5c07bb386fda58306bfd19e4a1c974c53 (From OE-Core rev: 17c3c6ce685ef5b8ff4266154ac830210b234708) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa/selftest/tinfoil: Add test for separate config_data with ↵Richard Purdie2022-12-231-0/+14
| | | | | | | | | | | | | | | | recipe_parse_file() We've seen two different regressions in this API since it is used by layer-index but not be the core code. Add a test for it to try and ensure we don't break it again. (From OE-Core rev: cc8ec63310f9a936371ea1070cb257c926808755) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit b07de5de43ec9c9a2c5d496a64940ccdc5b47cf8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* psplash: consider the situation of psplash not exist for systemdChen Qi2022-12-232-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | In current psplash framework, the psplash might not exist at all. For example, in case DSITRO is set to nodistro, the psplash does not exist. In our psplash recipe, we have: SPLASH_IMAGES = "file://psplash-poky-img.h;outsuffix=default" This variable is parsed to if psplash-poky-img.h exists, a package named psplash-default is created and is added to RDEPENDS:${PN}. We can see that the psplash-poky-img.h resides in meta-poky, and in psplash_git.bbappend file in meta-poky, we have: FILESEXTRAPATHS:prepend:poky := "${THISDIR}/files:" So this file is only available in case poky distro is used. To fix this issue, add condition check in the corresponding systemd services. (From OE-Core rev: bf9cb1a3d68da6463195f79caf8baf94cd01a30a) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 7a62ff9ed39c179d2b9b0c40f4f8423ced413063) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes: make TOOLCHAIN more permissive for kernelAlexey Smirnov2022-12-231-1/+1
| | | | | | | | | | | | | | Currently TOOLCHAIN is strictly set to gcc in kernel-arch.bbclass. And this prevents any TOOLCHAIN changes for any kernel recipe. This change makes TOOLCHAIN configurable as usual. (From OE-Core rev: 7d45d4696970c45534b905dc7a65418073108f97) Signed-off-by: Alexey Smirnov <pyih.soft@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit be1634fc35dcc81f0301d942064a6eed584e0704) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* opkg: Set correct info_dir and status_file in opkg.confHarald Seiler2022-12-231-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | Distros can customize the location of OPKG data using OPKGLIBDIR. In OE-Core commit 11f1956cf5d7 ("package_manager.py: define info_dir and status_file when OPKGLIBDIR isn't the default"), a fix was applied to correctly set the info_dir and status_file options relative to OPKGLIBDIR. However, as the commit message notes, the opkg.conf file deployed as part of the opkg package must also be adjusted to correctly reflect the changed location. Otherwise, opkg running inside the image cannot find its data. Fix this by also setting the info_dir and status_file options in opkg.conf to the correct location relative to OPKGLIBDIR. Fixes: 11f1956cf5d7 ("package_manager.py: define info_dir and status_file when OPKGLIBDIR isn't the default") (From OE-Core rev: 38224b19bda2592705ef4274c28cb250d9e980dc) Signed-off-by: Harald Seiler <hws@denx.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit adb939ae3635de6e02208859fbf29cf0ed39f565) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: upgrade 9.0.0820 -> 9.0.0947Qiu, Zheng2022-12-231-2/+2
| | | | | | | | | | | | | | | | Includes fixes for CVE-2022-4141 https://nvd.nist.gov/vuln/detail/CVE-2022-4141 For a short list of important changes, see: https://www.arp242.net/vimlog/ (From OE-Core rev: 64c323a444f43a7c7b3390720c4d1eafa3b982ac) Signed-off-by: Zheng Qiu <zheng.qiu@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 160f459febc7fb36cc0fe85c63eb26780ace3bfd) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: Fix CVE-2022-37454Pawan Badganchi2022-12-232-0/+106
| | | | | | | | | | | | | | | Add below patch to fix CVE-2022-37454 CVE-2022-37454.patch Link: https://security-tracker.debian.org/tracker/CVE-2022-37454 Link: https://github.com/python/cpython/commit/948c6794711458fd148a3fa62296cadeeb2ed631 (From OE-Core rev: 6a8ef6cc3604008860dcb6aa5d7155b914d7c391) Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com> Signed-off-by: pawan <badganchipv@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: CVE-2022-41715 regexp/syntax: limit memory used by parsing regexpsHitendra Prajapati2022-12-232-0/+272
| | | | | | | | | | Upstream-Status: Backport from https://github.com/golang/go/commit/e9017c2416ad0ef642f5e0c2eab2dbf3cba4d997 (From OE-Core rev: 2470c52db633f206dbfcd049fcca828d1ff5f82a) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dropbear: fix CVE-2021-36369Lee Chee Yang2022-12-232-0/+146
| | | | | | | | (From OE-Core rev: c0e44595555a81d1a1cd206c2235cbc419d02bd1) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sysstat: fix CVE-2022-39377Hitendra Prajapati2022-12-232-1/+95
| | | | | | | | (From OE-Core rev: 2e770eb2213f3d5ff25a75467395ed4738c756ea) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libarchive: CVE-2022-36227 NULL pointer dereference in archive_write.cHitendra Prajapati2022-12-232-0/+44
| | | | | | | | | | Upstream-Status: Backport from https://github.com/libarchive/libarchive/commit/bff38efe8c110469c5080d387bec62a6ca15b1a5 (From OE-Core rev: c39fd8264ac623f3cfb26305420b527dd9c4c891) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Fix CVE CVE-2022-35260Mathieu Dubois-Briand2022-12-232-0/+69
| | | | | | | | (From OE-Core rev: fe81ee17a2dc9924178fdd98614ed9e264204492) Signed-off-by: Mathieu Dubois-Briand <mbriand@witekio.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rpm: Fix rpm CVE CVE-2021-3521Riyaz Khan2022-12-235-0/+483
| | | | | | | | | | | | | | | | | | | Links: Dependent Patches: CVE-2021-3521-01 https://github.com/rpm-software-management/rpm/commit/b5e8bc74b2b05aa557f663fe227b94d2bc64fbd8 CVE-2021-3521-02 https://github.com/rpm-software-management/rpm/commit/9f03f42e2614a68f589f9db8fe76287146522c0c CVE-2021-3521-03 https://github.com/rpm-software-management/rpm/commit/5ff86764b17f31535cb247543a90dd739076ec38 CVE-2021-3521 https://github.com/rpm-software-management/rpm/commit/bd36c5dc9fb6d90c46fbfed8c2d67516fc571ec8 (From OE-Core rev: ddb4f775a86855e4ddc6c0d0d1f24a55e0ecbfe0) Signed-off-by: Riyaz Khan <Riyaz.Khan@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xserver-xorg: backport fixes for CVE-2022-3550, CVE-2022-3551 and CVE-2022-3553Minjae Kim2022-12-234-0/+156
| | | | | | | | | | | | | | | | | | | | | <CVE-2022-3550> xkb: proof GetCountedString against request length attacks Upstream-Status: Backport [https://cgit.freedesktop.org/xorg/xserver/commit/?id=11beef0b7f1ed290348e45618e5fa0d2bffcb72e] <CVE-2022-3551> xkb: fix some possible memleaks in XkbGetKbdByName Upstream-Status: Backport [https://cgit.freedesktop.org/xorg/xserver/commit/?id=18f91b950e22c2a342a4fbc55e9ddf7534a707d2] <CVE-2022-3553> xquartz: Fix a possible crash when editing the Application menu due to mutaing immutable arrays Upstream-Status: Backport[https://cgit.freedesktop.org/xorg/xserver/commit/?id=dfd057996b26420309c324ec844a5ba6dd07eda3] (From OE-Core rev: 081ac12677096886b25023a03df06b99585ef18c) Signed-off-by:Minjae Kim <flowergom@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* linux-yocto/5.4: update genericx86* machines to v5.4.219Ravula Adhitya Siddartha2022-12-191-4/+4
| | | | | | | | (From meta-yocto rev: 1a19e6d4eae26106378d28153db1fd44804770f1) Signed-off-by: Ravula Adhitya Siddartha <adhityax.siddartha.ravula@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dev-manual: update session about multiconfigMichael Opdenacker2022-12-081-37/+31
| | | | | | | | | | | Aligning with contents from the "master" branch. [YOCTO #14980] (From yocto-docs rev: 4961ddc9848f6569307107c10ff132532944ccaa) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Reported-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel.bbclass: make KERNEL_DEBUG_TIMESTAMPS work at rebuildChen Qi2022-12-071-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, the KERNEL_DEBUG_TIMESTAMPS is not working as expected at rebuild. That is, even if we set it to "1", the kernel build time is not changed. The problem could be reproduced by the following steps. 1. bitbake core-image-minimal; start image and check `uname -a` output. 2. set in local.conf: KERNEL_DEBUG_TIMESTAMPS = "1" 3. bitbake core-image-minimal; start image and check `uname -a` output. It's expected that after enabling KERNEL_DEBUG_TIMESTAMPS, the kernel build time will be set to current date. But it's not. This is because the compile.h was not re-generated when do_compile task was re-executed. In mkcompile_h, we have: """ # Only replace the real compile.h if the new one is different, # in order to preserve the timestamp and avoid unnecessary # recompilations. # We don't consider the file changed if only the date/time changed, # unless KBUILD_BUILD_TIMESTAMP was explicitly set (e.g. for # reproducible builds with that value referring to a commit timestamp). # A kernel config change will increase the generation number, thus # causing compile.h to be updated (including date/time) due to the # changed comment in the # first line. """ It has made it very clear that it will not be re-generated unless we have KBUILD_BUILD_TIMESTAMP set explicitly. So we set this variable explicitly in do_compile to fix this issue. (From OE-Core rev: e44f0cda8176186d42a752631810c1cb5f1971eb) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 1b68c2d2d385013a1c535ef81172494302a36d74) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel: improve transformation from KERNEL_IMAGETYPE_FOR_MAKEMike Crowe2022-12-071-3/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In 526bdd88ccd758204452579333ba188e29270bde the imageType loop in kernel_do_deploy was changed to use KERNEL_IMAGETYPE_FOR_MAKE rather than KERNEL_IMAGETYPES. This broke the special handling for fitImage immediately below because KERNEL_IMAGETYPE_FOR_MAKE never contains fitImage. It has always been my understanding that KERNEL_IMAGETYPE_FOR_MAKE controlled what was passed to make, but KERNEL_IMAGETYPE controlled what was installed/deployed. When the two are different then it's the responsibility of whoever set KERNEL_IMAGETYPE_FOR_MAKE to ensure that whatever comes out of the kernel build system has been transformed in to the requested form by the time of installation. This is what happens for kernel.bbclass's own support for vmlinux.gz. I think this means that for KERNEL_IMAGETYPE vmlinux.gz, kernel.bbclass is responsible for generating vmlinux.gz.initramfs[1] so that kernel_do_deploy can deploy it. This means that the change in 526bdd88ccd758204452579333ba188e29270bde can be reverted, fixing KERNEL_IMAGETYPE = "fitImage". In addition, it ought to be possible for recipes and other classes that use kernel.bbclass to hook into this mechanism by setting KERNEL_IMAGETYPE_FOR_MAKE and performing their own transformations. do_bundle_initramfs calls kernel_do_compile and we don't want it to transform vmlinux to vmlinux.gz at that point, since it will fight against the careful renaming and preserving that do_bundle_initramfs does. Let's separate the transformation out of kernel_do_compile to a new do_transform_kernel task that can be run at the right time. This means that it's also logical to perform the equivalent translation for the kernel with the initramfs in a separate do_transform_bundled_initramfs task too. This leaves two clear customisation points for recipes and other classes to hook into the process and perform their transformations: do_transform_kernel and do_transform_bundled_initramfs. (I care about this because our recipes that use kernel.bbclass also set KERNEL_IMAGETYPE_FOR_MAKE and transform vmlinux into a form suitable for our bootloader after do_compile and do_bundle_initramfs into the format matching KERNEL_IMAGETYPE. I'm unable to successfully bundle an initramfs after 526bdd88ccd758204452579333ba188e29270bde, but I didn't want to just revert that change to reintroduce the bug that it was fixing.) I can't say that I'm entirely happy with this change, but I'm unsure what to do to improve it. I find the way that both the bare kernel and the one with the initramfs both get deployed to be confusing, and a waste of build time. I would like to not actually generate a publishable kernel image at all during do_compile when an initramfs is in use, but I suspect that this would affect valid use cases that I'm not aware of. (From OE-Core rev: d9e9653616638f2b187d5e04540071ac34d99f56) Signed-off-by: Mike Crowe <mac@mcrowe.com> [1] It could be argued that this should be vmlinux.initramfs.gz, but that would require another special case in kernel_do_deploy and the filename is only visible within this class and the recipes that use it anyway. Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 10a4a132e87e835726bf5da81a60f6f509b90765) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mobile-broadband-provider-info: upgrade 20220725 -> 20221107Wang Mingyu2022-12-071-2/+2
| | | | | | | | | | (From OE-Core rev: 5d1add59695baf597ff52ae97844572215fa325b) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 7e12fa1e6250fc358ba159a6b626458d871f7ccf) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* linux-firmware: upgrade 20221012 -> 20221109Dmitry Baryshkov2022-12-071-2/+2
| | | | | | | | | | | License-Update: additional files (From OE-Core rev: bb804245dea980796e8f861fabef46cf3572e462) Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 6940f297243a66bd58d6adee7d690bcee9b9ccb2) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* linux-firmware: upgrade 20220913 -> 20221012Alexander Kanavin2022-12-071-3/+3
| | | | | | | | | | | | License-Update: copyright years, additional firmwares (From OE-Core rev: 2e31e08b5792828d7969f9642190b24e56319ab7) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 9f658c724b6635e5745f30b25601bcc51a004be4) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix CVE-2021-20196 block fdc null pointer dereference may lead to ↵Vivek Kumbhar2022-12-072-0/+63
| | | | | | | | | | | | guest crash Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/1ab95af033a419e7a64e2d58e67dd96b20af5233] (From OE-Core rev: 1523fcbb6fef60d30c07377673fca265c5c9781c) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pixman: backport fix for CVE-2022-44638Ross Burton2022-12-072-0/+35
| | | | | | | | | | | | | | | | (From OE-Core rev: 1d2e131d9ba55626354264d454b2808e84751600) (From OE-Core rev: fe5a5009939f056ff4d9d3426832d0b67a668ed6) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 23df4760ebc153c484d467e51b414910c570a6f8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 37595eeddfb01110d8cdc628be76a8bf6bde483a) Signed-off-by: Bhabu Bindu <bindu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sstate: Account for reserved characters when shortening sstate filenamesManuel Leonhardt2022-12-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Previously, when shortening sstate filenames, the reserved characters for .siginfo were not considered, when siginfo=False, resulting in differently shortend filenames for the sstate and siginfo files. With this change, the filenames of the truncated sstate and siginfo files have the same basename, just as is already the case for untruncated filenames. Making sure that the .siginfo files always have the filename of the corresponding sstate file plus its .siginfo suffix, also when being truncated, makes it easier to manage the sstate cache and an sstate mirror outside of Bitbake/Yocto. (From OE-Core rev: 408bf1b4bb4f4ed126c17fb3676f9fa0513065ba) Signed-off-by: Manuel Leonhardt <mleonhardt@arri.de> Cc: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c2e0e43b7123cf5149833e0072c8edaea3629112) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: upgrade 9.0.0614 -> 9.0.0820Tim Orling2022-12-071-2/+2
| | | | | | | | | | | | | | | | | Includes fixes for CVE-2022-3705 https://nvd.nist.gov/vuln/detail/CVE-2022-3705 For a short list of important changes, see: https://www.arp242.net/vimlog/ (From OE-Core rev: 3251dc441a31b2d4d7acb690bd6db13f0f99a1d0) Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f6d917bd0f8810b5ed8d403ad25d59cda2fc9574) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* maintainers: update gcc version to 9.5Steve Sakoman2022-12-071-1/+1
| | | | | SIgned-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gcc: upgrade to v9.5Sundeep KOKKONDA2022-12-0755-1636/+4
| | | | | | | | | | | | | gcc stable version upgraded from v9.3 to v9.5 Below is the bug fix list for v9.5 https://gcc.gnu.org/bugzilla/buglist.cgi?bug_status=RESOLVED&resolution=FIXED&target_milestone=9.5 (From OE-Core rev: 698c3323fd95592e815345acd9070e5089a1bd00) Signed-off-by: Sundeep KOKKONDA <sundeep.kokkonda@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: ignore CVE-2022-30630Ralph Siemsen2022-12-071-0/+3
| | | | | | | | | | | | | | The CVE is in the io/fs package, which first appeared in go1.16. Since dunfell is using go1.14, this issue does not apply. CVE was fixed in fa2d41d0ca736f3ad6b200b2a4e134364e9acc59 Original code in b64202bc29b9c1cf0118878d1c0acc9cdb2308f6 (From OE-Core rev: 1e258940e9a6fabda6e7e60841082c113fdf9500) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: ignore CVE-2022-30580Ralph Siemsen2022-12-071-0/+1
| | | | | | | | | | | | | | | | Only affects Windows platform, as per the release announcement [1]: "If, on Windows, Cmd.Run, cmd.Start, cmd.Output, or cmd.CombinedOutput are executed when Cmd.Path is unset and, in the working directory, there are binaries named either "..com" or "..exe", they will be executed." [1] https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ (From OE-Core rev: 54c40730bc54aa2b2c12b37decbcc99bbcafd07a) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: ignore CVE-2021-41772Ralph Siemsen2022-12-071-0/+3
| | | | | | | | | | | | | | | | | Dunfell uses golang 1.14 which does not contain the affected code (it was introduced in golang 1.16). From the golang announcement [1] "Reader.Open (the API implementing io/fs.FS introduced in Go 1.16) can be made to panic by an attacker providing either a crafted ZIP archive containing completely invalid names or an empty filename argument. [1] https://groups.google.com/g/golang-announce/c/0fM21h43arc (From OE-Core rev: 2329902f994b631d6b77e8bd501d5599db6d5306) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: ignore CVE-2021-33194Ralph Siemsen2022-12-071-0/+3
| | | | | | | | | | | | | This is a bug in golang.org/x/net/html/parse.go. The golang compiler includes a partial copy of this under src/vendor/golang.org/x/net/ however the "html" subdirectory is not included. So this bug does not apply to the compiler itself. (From OE-Core rev: b8a851faef9990ccb41ded875fc79cf28abd4a4e) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: ignore CVE-2022-29804Ralph Siemsen2022-12-071-0/+1
| | | | | | | | | | | | | | | The issue only affects Windows per the golang announcement [1]: On Windows, the filepath.Clean function could convert an invalid path to a valid, absolute path. For example, Clean(`.\c:`) returned `c:`. [1] https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg (From OE-Core rev: bca720eca95929752436b56aa01e7fddfa1c834f) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2022-28327Ralph Siemsen2022-12-072-0/+37
| | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/7139e8b024604ab168b51b99c6e8168257a5bf58] CVE: CVE-2022-28327 (From OE-Core rev: aab2a343be4b0b21dcaf22a7fbf77007d48c08d6) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2022-28131Ralph Siemsen2022-12-072-0/+105
| | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/58facfbe7db2fbb9afed794b281a70bdb12a60ae] CVE: CVE-2022-28131 (From OE-Core rev: 09a820fe21d7884c6733d569f6560ef1ded5435d) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2022-24291Ralph Siemsen2022-12-072-0/+199
| | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/2b65cde5868d8245ef8a0b8eba1e361440252d3b] CVE: CVE-2022-24921 (From OE-Core rev: a2d3d80a7df5b8f57105ef2b680e9e01a9da6486) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2021-44716Ralph Siemsen2022-12-072-0/+94
| | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/d0aebe3e74fe14799f97ddd3f01129697c6a290a] CVE: CVE-2021-44716 (From OE-Core rev: c5ec3e8701a1b81d8e5b17d2521530345892a09b) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2021-33198Ralph Siemsen2022-12-072-0/+114
| | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/df9ce19db6df32d94eae8760927bdfbc595433c3] CVE: CVE-2021-33198 (From OE-Core rev: 078260dd63e205d3a433b03357f2332f44daa397) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: fix CVE-2021-33195Ralph Siemsen2022-12-072-0/+374
| | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/31d60cda1f58b7558fc5725d2b9e4531655d980e] CVE: CVE-2021-33195 (From OE-Core rev: f1051e11fd0eb5b0e9924a0acdcb078ddc8f9772) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Fix CVE-2022-40304Bhabu Bindu2022-12-072-0/+105
| | | | | | | | | | | | | | Fix dict corruption caused by entity reference cycles Link: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b Upstream-Status: Pending (From OE-Core rev: 8e195f0a01b4cc1017bf9df67ffc3c6d6c15d24a) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Fix CVE-2022-40303Bhabu Bindu2022-12-072-0/+624
| | | | | | | | | | | | | | Fix integer overflows with XML_PARSE_HUGE Link: https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0 Upstream-Status: Pending (From OE-Core rev: d16d5660a32386158632ee5599ad92a9f2dc08dd) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libtasn1: fix CVE-2021-46848 off-by-one in asn1_encode_simple_derVivek Kumbhar2022-12-072-0/+46
| | | | | | | | | | Upstream-Status: Backport [https://gitlab.com/gnutls/libtasn1/-/commit/44a700d2051a666235748970c2df047ff207aeb5] (From OE-Core rev: 305f1c56121436da7be39c5980fc11f779188ab7) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: Fix CVE-2022-45061Omkar2022-12-072-0/+101
| | | | | | | | | | | | | Fix CVE-2022-45061, referenced as https://github.com/python/cpython/issues/98433 patch taken from https://github.com/python/cpython/pull/99231/commits/064ec20bf7a181ba5fa961aaa12973812aa6ca5d (From OE-Core rev: 4498ca9a299bd5d9a7173ec67daf17cb66b6d286) Signed-off-by: Omkar <omkarpatil10.93@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Fix CVE-2022-3821 issueRanjitsinh Rathod2022-12-072-0/+48
| | | | | | | | | | | | | | | An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service. Add a patch to solve above CVE issue Link: https://github.com/systemd/systemd/commit/9102c625a673a3246d7e73d8737f3494446bad4e (From OE-Core rev: e2db40ca49b8ed217f14c7f861087837e8b3f389) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sudo: CVE-2022-43995 heap-based overflow with very small passwordsHitendra Prajapati2022-12-072-0/+60
| | | | | | | | | | Upstream-Status: Backport from https://github.com/sudo-project/sudo/commit/bd209b9f16fcd1270c13db27ae3329c677d48050 (From OE-Core rev: d1bdb663e6a69993d3f42547a27296b606965d47) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.21dunfell-23.0.21Richard Purdie2022-11-221-1/+1
| | | | | | (From OE-Core rev: 1ee082e979baaba871bbe1d91181bb04951faf3b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: utils: Fix lockfile path length issuesRichard Purdie2022-11-221-3/+6
| | | | | | | | | | | | | | | | If the path to bitbake.lock is in a deep directory, bitbake will hang. The reason was that the max file length limiting code (to 255 chars) was including the directory name and it should only act on the filename within the directory. Fix it to just use the base filename. [YOCTO #14766] (Bitbake rev: e3db9c2e9eded3c5cb6040714a6054b44f6b3880) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 89d70e7b71eecfe06592202f326e566c579ba01d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: utils: Handle lockfile filenames that are too long for filesystemsRichard Purdie2022-11-221-1/+5
| | | | | | | | | | | | | | | | The fetcher mirror code can go crazy creating lock filenames which exceed the filesystem limits. When this happens, the code will loop/hang. Handle the filename too long exception correctly but also truncate lockfile lengths to under 256 since the worst case situation is lockfile overlap and lack of parallelism. (Bitbake rev: 30d42ef030d03e11322b6b05ea7bbb64ab3d6f21) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 63baf3440b16e41ac6601de21ced94a94bdf1509) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-09 20:30:19 +0000