summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools
Commit message (Collapse)AuthorAgeFilesLines
...
* qemu: fix CVE-2024-7409Hitendra Prajapati2024-09-075-0/+625
| | | | | | | | | | | | | | | | | | | | A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-7409 Upstream Patches: https://github.com/qemu/qemu/commit/fb1c2aaa981e0a2fa6362c9985f1296b74f055ac https://github.com/qemu/qemu/commit/c8a76dbd90c2f48df89b75bef74917f90a59b623 https://gitlab.com/qemu-project/qemu/-/commit/b9b72cb3ce15b693148bd09cef7e50110566d8a0 https://gitlab.com/qemu-project/qemu/-/commit/3e7ef738c8462c45043a1d39f702a0990406a3b3 (From OE-Core rev: d84ab04dc66cb83638f96fcd2f4c67e67489c410) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: add PACKAGECONFIG[editline]Leon Anavi2024-08-281-2/+3
| | | | | | | | | | | | | Backport PACKAGECONFIG[editline] from Scarthgap to Kirkstone because libedit has feature parity with readline but is more permissively licensed (BSD verses GPLv3). This patch provides means of enabling editline in a distribution without GPLv3 and in this case improves Python REPL keyboard support. (From OE-Core rev: 12dc7d2081a1aaec90ffb3ed6718d757ce14b5ab) Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-pycryptodome(x): use python_setuptools_build_meta build classRoss Burton2024-08-162-2/+2
| | | | | | | | | | | This package can be built using pep517 classes now. (From OE-Core rev: 6c1000a2bbfe5e618e42bc5be2058332337d4177) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a32fa3e64d1daf5846c29403e9f258aea42212d3) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* orc: upgrade 0.4.32 -> 0.4.39Vijay Anusuri2024-08-161-1/+1
| | | | | | | | | | | Include security fix CVE-2024-40897 Ref: https://github.com/GStreamer/orc/blob/0.4.39/RELEASE (From OE-Core rev: 4fc3f804c0963e4421b8066425cc6780a6901ace) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-certifi: Fix CVE-2024-39689Soumya Sambu2024-08-162-0/+70
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.07.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.07.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.07.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.07.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues." References: https://nvd.nist.gov/vuln/detail/CVE-2024-39689 Upstream-patch: https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463 (From OE-Core rev: 96c1e12dc6cb4c321a09a6ddcc4c9f27c30b4564) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2024-24791Archana Polampalli2024-08-162-0/+360
| | | | | | | (From OE-Core rev: f012f6a6e1d3111d6cae74c9c846d8bd0fca5dd5) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Fix CVE-2024-24789Soumya Sambu2024-08-082-0/+79
| | | | | | | | | | | | | | | | | | | The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors. References: https://nvd.nist.gov/vuln/detail/CVE-2024-24789 Upstream-patch: https://github.com/golang/go/commit/c8e40338cf00f3c1d86c8fb23863ad67a4c72bcc (From OE-Core rev: f198fdc392c6e3b99431383ab6577749e83f1cb3) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc-runtime: remove bashismPeter Marko2024-08-051-1/+1
| | | | | | | | | | | | | | | | | Debian 12 no longer supports replacing dash with bash as default shell. Therefore to achieve compatibility with Debian 12, all bashisms need to be removed. Shell comparison via == gives an error with dash and thus the condition is always false. (From OE-Core rev: 3723b26f82219ff71823335d550dbf29086d63d4) (From OE-Core rev: c6cafd2aa50357c80fbab79741d575ff567c5766) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* llvm: Fix CVE-2024-31852Deepthi Hemraj2024-08-053-0/+204
| | | | | | | (From OE-Core rev: c001e2af10d8afa13c8f50632a074c5a9a00d7bb) Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* llvm: Fix CVE-2023-46049Deepthi Hemraj2024-08-052-0/+35
| | | | | | | | | | | [Bitcode] Add some missing GetTypeByID failure checks Print an error instead of crashing. (From OE-Core rev: 9cc4518226488693942ad325d6264e52006bd061) Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-jinja2: Upgrade 3.1.3 -> 3.1.4Vijay Anusuri2024-07-241-4/+4
| | | | | | | | | | | | | | | | | | | Switch to use flit core since upstream changed. They also changed the capitalisation under pypi. The license didn't change but the file was renamed, probably as it wasn't rst. (From OE-Core rev: 58ee84c274b0c93902aad5d4f434daec5da55134) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e352680528b18c3cdae26233bef7cddc2771d42d) Upgrade fixes CVE-2024-34064 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ruby: backport fix for CVE-2024-27282Ashish Sharma2024-07-242-0/+30
| | | | | | | | Upstream-Status: Backport [https://github.com/ruby/ruby/commit/989a2355808a63fc45367785c82ffd46d18c900a] (From OE-Core rev: 94a0350058e51c4b05bf5d4e02d048c2e6256725) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ruby: fix CVE-2024-27280Yogita Urade2024-06-262-0/+88
| | | | | | | | | | | | | | | | | | | A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fixed version; however, for Ruby 3.0 users, a fixed version is stringio 3.0.1.1, and for Ruby 3.1 users, a fixed version is stringio 3.0.1.2. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-27280 (From OE-Core rev: 729310d17310dff955c51811ff3339fdbc017b95) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* git: Fix multiple CVEsSoumya Sambu2024-06-0112-0/+1498
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2024-32002: Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources. CVE-2024-32004: Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources. CVE-2024-32020: Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may end up hardlinking files into the target repository's object database when source and target repository reside on the same disk. If the source repository is owned by a different user, then those hardlinked files may be rewritten at any point in time by the untrusted user. Cloning local repositories will cause Git to either copy or hardlink files of the source repository into the target repository. This significantly speeds up such local clones compared to doing a "proper" clone and saves both disk space and compute time. When cloning a repository located on the same disk that is owned by a different user than the current user we also end up creating such hardlinks. These files will continue to be owned and controlled by the potentially-untrusted user and can be rewritten by them at will in the future. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. CVE-2024-32021: Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the `objects/` directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary user-owned files on the same filesystem in the target Git repository's `objects/` directory. When cloning a repository over the filesystem (without explicitly specifying the `file://` protocol or `--no-local`), the optimizations for local cloning will be used, which include attempting to hard link the object files instead of copying them. While the code includes checks against symbolic links in the source repository, which were added during the fix for CVE-2022-39253, these checks can still be raced because the hard link operation ultimately follows symlinks. If the object on the filesystem appears as a file during the check, and then a symlink during the operation, this will allow the adversary to bypass the check and create hardlinks in the destination objects directory to arbitrary, user-readable files. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. CVE-2024-32465: Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone --no-local` to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but vulnerabilities allow those protections to be bypassed. In the context of cloning local repositories owned by other users, this vulnerability has been covered in CVE-2024-32004. But there are circumstances where the fixes for CVE-2024-32004 are not enough: For example, when obtaining a `.zip` file containing a full copy of a Git repository, it should not be trusted by default to be safe, as e.g. hooks could be configured to run within the context of that repository. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid using Git in repositories that have been obtained via archives from untrusted sources. References: https://nvd.nist.gov/vuln/detail/CVE-2024-32002 https://nvd.nist.gov/vuln/detail/CVE-2024-32004 https://nvd.nist.gov/vuln/detail/CVE-2024-32020 https://nvd.nist.gov/vuln/detail/CVE-2024-32021 https://nvd.nist.gov/vuln/detail/CVE-2024-32465 (From OE-Core rev: 209c41377abf6853455b00af3923f1b244a3766b) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Rename CVE-2022-38126 patch to CVE-2022-35205Vijay Anusuri2024-05-292-2/+3
| | | | | | | | | | | | | | | | CVE-2022-38126 has been marked "REJECT" in the CVE List by NVD. Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-38126 As commit changes in 0016-CVE-2022-38126.patch fixes CVE-2022-35205. Hence renamed the patch. Link: https://ubuntu.com/security/CVE-2022-35205 (From OE-Core rev: d91af23e4fef0f1999c18fc3a43085b70e98dfd5) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: Upgrade 3.10.13 -> 3.10.14Peter Marko2024-05-151-1/+1
| | | | | | | | | | | | | Addresses CVEs: * CVE-2023-52425 (bundled expat) * CVE-2023-6597 (https://github.com/python/cpython/pull/112840) News: https://github.com/python/cpython/blob/3.10/Misc/NEWS.d/3.10.14.rst (From OE-Core rev: e0b77aa347c03f520802c8235ae0389bb855c146) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Fix for CVE-2023-45288Vijay Anusuri2024-05-022-0/+96
| | | | | | | | | Upstream-Status: Backport from https://github.com/golang/go/commit/e55d7cf8435ba4e58d4a5694e63b391821d4ee9b (From OE-Core rev: 9ad10bf355665ff799cefd40fb0d1938b0104b08) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* valgrind: skip intermittently failing ptestSteve Sakoman2024-04-211-0/+2
| | | | | | | | | | | Intermittent failures on autobuilder: AssertionError: Failed ptests: {'valgrind': ['memcheck/tests/linux/timerfd-syscall']} (From OE-Core rev: 19e7d5e717e6d28e0b64bd382f07b8e709526474) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust: add CVE_CHECK_IGNORE for CVE-2024-24576Harish Sadineni2024-04-211-0/+3
| | | | | | | | | | CVE-2024-24576 only applies when invoking batch files (with the `bat` and `cmd` extensions) on Windows & No other platform or use is affected. More details about CVE is here: https://nvd.nist.gov/vuln/detail/CVE-2024-24576 (From OE-Core rev: 44e0b6b028657d32de5971d6a42a88767ef8c710) Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ruby: fix CVE-2024-27281Yogita Urade2024-04-212-0/+98
| | | | | | | | | | | | | ruby: RCE vulnerability with .rdoc_options in RDoc References: https://github.com/ruby/ruby/pull/10316 https://security-tracker.debian.org/tracker/CVE-2024-27281 (From OE-Core rev: d01b73c51ceead4911a9a9306dbe728f1db2e029) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tcl: skip async and event tests in run-ptestRoss Burton2024-04-191-2/+2
| | | | | | | | | | | | | | These test suites are full of timing-sensitive test cases, so skip them too. [ YOCTO #15321 ] (From OE-Core rev: f94c74cee8b2650dd3211a49dc7e88bf60d2e6a7) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit dd06c3668dbe9ec1cf9a0a84d7a6bc9851f9c662) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tcl: skip timing-dependent tests in run-ptestRoss Burton2024-04-191-1/+5
| | | | | | | | | | | | | | There are several tests in the test suite which are very dependent on timing and fail on a loaded host system, so skip them. [ YOCTO #14825 #14882 #15081 ] (From OE-Core rev: 161d336a6c57fddb36a0c4e8c2def84ce70128e3) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 68beb4f4b5a0bea5d431decddf7656f18ac7a04a) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tcl: Add a way to skip ptestsKhem Raj2024-04-192-2/+7
| | | | | | | | | | | | | | | Some tests hardcode assumptions on locales, which may not be present in musl systems e.g., therefore add a way to skip such tests using -skip option. Skip unixInit-3* test on musl (From OE-Core rev: a70f9039259d7d38c5a3e50f7003d3228d1ab692) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit fa66f1cee2d88c2276442e8b4aaeccde5490f9ea) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* perl: ignore CVE-2023-47100Alex Stewart2024-04-191-0/+3
| | | | | | | | | | | CVE-2023-47100 is a duplicate of CVE-2023-47038. They have the same advertised fix commit, which has already been merged into the perl_5.34.3 sources used in kirkstone. (From OE-Core rev: 8df158f39f1eed1e3ae88ddf935c67e067b72525) Signed-off-by: Alex Stewart <alex.stewart@ni.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc: Backport sanitizer fix for 32-bit ALSRClaus Stovgaard2024-04-052-0/+64
| | | | | | | | | | | | | | | | When using the gcc-sanitizers as part of the SDK on a Linux with a newer kernel, the ASAN fails randomly. This was seen on Ubuntu 22.04. This is also described at https://stackoverflow.com/questions/77894856/possible-bug-in-gcc-sanitizers Backport the fix from LLVM project, as gcc has not yet backported anything for the 11 series. (From OE-Core rev: 7af8e24d6c60a01e398b10a57939947fb156feec) Signed-off-by: Claus Stovgaard <claus.stovgaard@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-urllib3: update to v1.26.18Tan Wen Yan2024-04-051-1/+1
| | | | | | | | | | | | | | | | https://github.com/urllib3/urllib3/releases/tag/1.26.18 Major changes in python3-urllib3 1.26.18: - Made body stripped from HTTP requests changing the request method to GET after HTTP 303 "See Other" redirect responses. (CVE-2023-45803) (cherry picked from OE-Core rev: 74da05b63634c248910594456dae286947f33da5) (From OE-Core rev: c473f32184ea0ab41f6eb4c8dcc1d7bb5fd7b16f) Signed-off-by: Tan Wen Yan <wen.yan.tan@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: Fix for CVE-2023-6683Vijay Anusuri2024-04-052-0/+93
| | | | | | | | | | | Upstream-Status: Backport from https://gitlab.com/qemu-project/qemu/-/commit/405484b29f6548c7b86549b0f961b906337aa68a Reference: https://security-tracker.debian.org/tracker/CVE-2023-6683 (From OE-Core rev: f099f9ff95c42444cbfa63630a6f160fd98997ed) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-cryptography: Backport fix for CVE-2024-26130Vijay Anusuri2024-03-252-0/+67
| | | | | | | | | Upstream-Status: Backport from https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55 (From OE-Core rev: 7864c4605cde4851df644dd1d2867bd28d155710) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Backport fix CVE-2024-24784 & CVE-2024-24785Vivek Kumbhar2024-03-133-0/+405
| | | | | | | | | | | | Backport fixes for : CVE-2024-24784 - Upstream-Status: Backport from https://github.com/golang/go/commit/5330cd225ba54c7dc78c1b46dcdf61a4671a632c CVE-2024-24785 - Upstream-Status: Backport from https://github.com/golang/go/commit/056b0edcb8c152152021eebf4cf42adbfbe77992 (From OE-Core rev: 408f86a5268cadd680f45e2d934451a321241706) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* golang: Fix CVE-2023-45289 & CVE-2023-45290Hitendra Prajapati2024-03-123-0/+393
| | | | | | | | | | | Backport fixes for: CVE-2023-45289 - Upstream-Status: Backport from https://github.com/golang/go/commit/3a855208e3efed2e9d7c20ad023f1fa78afcc0be CVE-2023-45290 - Upstream-Status: Backport from https://github.com/golang/go/commit/041a47712e765e94f86d841c3110c840e76d8f82 (From OE-Core rev: e5aae8a371717215a7d78459788ad67dfaefe37e) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: Fix CVE-2023-42467Poonam Jadhav2024-03-074-0/+170
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. scsi-disk: allow MODE SELECT block descriptor to set the block size Link: https://github.com/qemu/qemu/commit/356c4c441ec01910314c5867c680bef80d1dd373 The MODE SELECT command can contain an optional block descriptor that can be used to set the device block size. If the block descriptor is present then update the block size on the SCSI device accordingly. This allows CDROMs to be used with A/UX which requires a CDROM drive which is capable of switching from a 2048 byte sector size to a 512 byte sector size. 2. scsi-disk: ensure block size is non-zero and changes limited to bits 8-15 Link: https://github.com/qemu/qemu/commit/55794c904df723109b228da28b5db778e0df3110 The existing code assumes that the block size can be generated from p[1] << 8 in multiple places which ignores the top and bottom 8 bits. If the block size is allowed to be set to an arbitrary value then this causes a mismatch between the value written by the guest in the block descriptor and the value subsequently read back using READ CAPACITY causing the guest to generate requests that can crash QEMU. For now restrict block size changes to bits 8-15 and also ignore requests to set the block size to 0 which causes the SCSI emulation to crash in at least one place with a divide by zero error. 3. Disallow block sizes smaller than 512 [CVE-2023-42467] Link: https://gitlab.com/qemu-project/qemu/-/commit/7cfcc79b0ab800959716738aff9419f53fc68c9c We are doing things like nb_sectors /= (s->qdev.blocksize / BDRV_SECTOR_SIZE); in the code here (e.g. in scsi_disk_emulate_mode_sense()), so if the blocksize is smaller than BDRV_SECTOR_SIZE (=512), this crashes with a division by 0 exception. Thus disallow block sizes of 256 bytes to avoid this situation. (From OE-Core rev: e9af3d328db8a32c22bb0798fa8dbb749e3f607b) Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: Backport fix CVE-2023-6693Vivek Kumbhar2024-03-072-0/+75
| | | | | | | | | Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/2220e8189fb94068dbad333228659fbac819abb0] (From OE-Core rev: e993720fc31dbf94bed138b76ce33cbcd61ab9a5) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: Fix for CVE-2024-24474Vijay Anusuri2024-03-072-0/+45
| | | | | | | | | | Upstream-Status: Backport [https://github.com/qemu/qemu/commit/77668e4b9bca03a856c27ba899a2513ddf52bb52] (From OE-Core rev: 71600de72c602e6d1ae2c3b13af6c59440affdb6) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cmake: Unset CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIESZahir Hussain2024-02-281-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | As discussion in [YOCTO #14717] cmake contains a OEToolchainConfig.cmake file to configure the toolchain correctly in cross-compile build for recipes using cmake. The variable CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIES value updates incorrectly during do_compile the code. Due to this getting sporadic error like below, fatal error: stdlib.h: No such file or directory | 75 | #include_next <stdlib.h> | | ^~~~~~~~~~ | compilation terminated. | ninja: build stopped: subcommand failed. | WARNING: exit code 1 from a shell command. As cmake already correctly initializes the variable from environment, So we have to unset it in the toolchain file to avoid overwriting the variable definition again. (From OE-Core rev: 2b0b47fd0cafdb9de5025efda4140e11ea447afa) Signed-off-by: aszh07 <mail2szahir@gmail.com> Signed-off-by: Zahir Hussain <zahir.basha@kpit.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5aeada5793af53e8c93940952d4f314474dca4c2) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: add a complementary fix for CVE-2023-29406Ming Liu2024-02-283-1/+116
| | | | | | | | | | The original CVE-2023-29406.patch is not complete, causing docker failures at runtime, backport a complementary fix from golang upstream. (From OE-Core rev: 973901530c98bc3f1b10d8bb89d55decf6848713) Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-pycryptodome: Fix CVE-2023-52323Narpat Mali2024-02-154-0/+875
| | | | | | | | | | | | | | PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack. References: https://security-tracker.debian.org/tracker/CVE-2023-52323 https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst (From OE-Core rev: 04c9b6b081914005209bac8eeb9f417e7b989cca) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Fix CVE-2023-45285 and CVE-2023-45287Soumya Sambu2024-02-153-0/+1807
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2023-45285: Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off). CVE-2023-45287: Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels. References: https://nvd.nist.gov/vuln/detail/CVE-2023-45285 https://nvd.nist.gov/vuln/detail/CVE-2023-45287 https://security-tracker.debian.org/tracker/CVE-2023-45285 https://security-tracker.debian.org/tracker/CVE-2023-45287 (From OE-Core rev: 616857b9918e8d2e576239b3db2f9f077d1a7222) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc-shared-source: ignore CVE-2023-4039Peter Marko2024-02-091-0/+3
| | | | | | | | | | | | Concept of gcc-source prevents cve-check to detect existing CVE patch file. So ignore this CVE in all recipes using gcc-source via this include file. (From OE-Core rev: 04511734c6dc8c7dda3a943b385cd273d012d8c7) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gdb: Fix CVE-2023-39130Deepthi Hemraj2024-02-092-0/+327
| | | | | | | | CVE: CVE-2023-39130 (From OE-Core rev: 7b93bb0ba1513a60cf75ebe55b29723831dfb79a) Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gdb: Fix CVE-2023-39129Deepthi Hemraj2024-02-092-0/+51
| | | | | | | | CVE: CVE-2023-39129 (From OE-Core rev: 67b62fd57d7073b42db2747227d07841d0d064e3) Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: internal gdb: Fix CVE-2023-39130Deepthi Hemraj2024-02-092-0/+327
| | | | | | | | CVE: CVE-2023-39130 (From OE-Core rev: 97b5bf2505d68bea6d1c2a66318cfbc51335463a) Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: internal gdb: Fix CVE-2023-39129Deepthi Hemraj2024-02-092-0/+51
| | | | | | | | CVE: CVE-2023-39129 (From OE-Core rev: fd3f20e1e8bcd63b75e8800fe60d6194a4fd6bd4) Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-jinja2: upgrade 3.1.2 -> 3.1.3Wang Mingyu2024-02-071-1/+1
| | | | | | | | | | | | | | | | | | Changelog: ========== -Fix compiler error when checking if required blocks in parent templates are empty. -xmlattr filter does not allow keys with spaces. -Make error messages stemming from invalid nesting of {% trans %} blocks more helpful (cherry picked from OE-Core rev: 8a0524464583d69df7746253f5020c2c125a8e1f) (From OE-Core rev: 0f0dcf520505d809599a63961ecb5b1e74053b24) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-jinja2: upgrade 3.1.1 -> 3.1.2Alexander Kanavin2024-02-071-1/+1
| | | | | | | | | | | | (cherry picked from OE-Core rev: 1e58fa1fff649a4ab07290d2b0e5a8d69d51ef16) (From OE-Core rev: 90960bdef877c5dc03cc2cb03c77139d6d1e2f8f) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* elfutils: Disable stringop-overflow warning for build hostKhem Raj2024-01-041-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some distributions shipping gcc12 end up with stringop-overflow warnings e.g. /usr/include/bits/unistd.h:74:10: error: ‘__pread_alias’ specified size between 9223372036854775813 and 18446744073709551615 exceeds maximum object size 9223372036854775807 [-Werror=stringop-overflow=] 74 | return __glibc_fortify (pread, __nbytes, sizeof (char), | ^~~~~~~~~~~~~~~ Until fixed, lets not treat this warning as hard error MJ: this is needed e.g. on ubuntu 24.04 after gcc was upgraded from 13.2.0-8ubuntu1 to 13.2.0-9ubuntu1 which includes switch _FORTIFY_SOURCE to 3: https://changelogs.ubuntu.com/changelogs/pool/main/g/gcc-13/gcc-13_13.2.0-9ubuntu1/changelog elfutils config.log then shows: configure:6762: checking whether to add -D_FORTIFY_SOURCE=2 to CFLAGS configure:6779: gcc -c -D_FORTIFY_SOURCE=2 -isystem/work/x86_64-linux/elfutils-native/0.186-r0/recipe-sysroot-native/usr/include -O2 -pipe -Werror -isystem/work/x86_64-linux/elfutils-native/0.186-r0/recipe-sysroot-native/usr/include conftest.c >&5 <command-line>: error: "_FORTIFY_SOURCE" redefined [-Werror] <built-in>: note: this is the location of the previous definition cc1: all warnings being treated as errors configure:6786: result: no and -D_FORTIFY_SOURCE=2 missing in CFLAGS later causes the above error in do_compile (From OE-Core rev: 94d1640d374c9a8827957cba8dbc1c1f978701b5) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-ptest: skip test_storlinesTrevor Gamblin2023-12-222-0/+33
| | | | | | | | | | | | | | [YOCTO #14933] test_storlines is yet another Python ptest that fails intermittently on the Yocto AB, so disable it during ptests for now. (From OE-Core rev: b71d5ec10f8e64fc6102c66dfc36151f2b0b3c86) Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit d7b9f8157e6214a83b5495e8a32e11540ae65ff8) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* perl: update 5.34.1 -> 5.34.3Soumya Sambu2023-12-223-4/+4
| | | | | | | | | | | | This includes security fix for CVE-2023-47038 Changes: https://metacpan.org/release/PEVANS/perl-5.34.3/changes (From OE-Core rev: d1bc5fb1d090cf93b9014a050b418499c0209080) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Fix CVE-2023-39326Soumya Sambu2023-12-222-0/+183
| | | | | | | | | | | | | | | | | | | | | | | | A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small. References: https://nvd.nist.gov/vuln/detail/CVE-2023-39326 https://security-tracker.debian.org/tracker/CVE-2023-39326 (From OE-Core rev: 448df3bb9277287dd8586987199223b7314fdd01) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: Fix CVE-2023-5088Sourav Pramanik2023-12-222-0/+113
| | | | | | | | | | | | | | | | A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This change is to fix CVE-2023-5088. Link: https://gitlab.com/qemu-project/qemu/-/commit/7d7512019fc40c577e2bdd61f114f31a9eb84a8e (From OE-Core rev: aa84c668bfe2436d36f49a422c775119e2412c8b) Signed-off-by: Sourav Pramanik <sourav.pramanik@kpit.com> Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust-cross: Simplfy the rust_gen_target callsRichard Purdie2023-12-122-18/+10
| | | | | | | | | | | | Match the code in rust-cross-canadian so that further simplifications can be considered in future. (From OE-Core rev: 9fb5f81f58306b2d355049698b6a17d045bd5e1e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5cb62d0a33777cb9afb1eea5f736a2580ce50dc7) Signed-off-by: Jermain Horsman <jermain.horsman@nedap.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-05 21:33:06 +0000