| Message ID | 20261013095833.780884-1-Roopa.Kalmath@windriver.com |
|---|---|
| State | Changes Requested, archived |
| Delegated to: | Yoann Congal |
| Headers | show |
| Series | [wrynose,v3] u-boot: fix CVE-2026-29009 | expand |
On Tue Oct 13, 2026 at 11:58 AM CEST, Roopa via lists.openembedded.org Kalmath wrote: > Backport commit[1] which fixes this vulnerability as mentioned NVD > report in [2]. > > [1] https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc > [2] https://nvd.nist.gov/vuln/detail/cve-2026-29009 > > Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com> > --- > .../u-boot/files/CVE-2026-29009.patch | 38 +++++++++++++++++++ > meta/recipes-bsp/u-boot/u-boot_2026.01.bb | 4 +- > 2 files changed, 41 insertions(+), 1 deletion(-) > create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch > > diff --git a/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch > new file mode 100644 > index 0000000000..afdbc80519 > --- /dev/null > +++ b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch > @@ -0,0 +1,38 @@ > +From 2b88f08722584cf235f7dacaa190af3d24deb40f Mon Sep 17 00:00:00 2001 > +From: Roopa Kalmath <Roopa.Kalmath@windriver.com> ^ (again) please keep the original author > +Date: Fri, 9 Oct 2026 08:38:23 +0000 > +Subject: net: nfs: fix buffer overflow in nfs_readlink_reply() > + (again) please keep the original commit message > +CVE: CVE-2026-29009 > + > +Upstream-Status: Backport [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc] > + > +Fixes: cf3a4f1e86 ("net: nfs: Fix CVE-2019-14195") > +Cc: stable@vger.kernel.org > +Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com> > +Reviewed-by: Jerome Forissier <jerome.forissier@arm.com> > +Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
diff --git a/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch new file mode 100644 index 0000000000..afdbc80519 --- /dev/null +++ b/meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch @@ -0,0 +1,38 @@ +From 2b88f08722584cf235f7dacaa190af3d24deb40f Mon Sep 17 00:00:00 2001 +From: Roopa Kalmath <Roopa.Kalmath@windriver.com> +Date: Fri, 9 Oct 2026 08:38:23 +0000 +Subject: net: nfs: fix buffer overflow in nfs_readlink_reply() + +CVE: CVE-2026-29009 + +Upstream-Status: Backport [https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc] + +Fixes: cf3a4f1e86 ("net: nfs: Fix CVE-2019-14195") +Cc: stable@vger.kernel.org +Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com> +Reviewed-by: Jerome Forissier <jerome.forissier@arm.com> +Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com> +--- + net/nfs.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/nfs.c b/net/nfs.c +index 537d4c62..9b628ecf 100644 +--- a/net/nfs.c ++++ b/net/nfs.c +@@ -698,11 +698,15 @@ static int nfs_readlink_reply(uchar *pkt, unsigned len) + + strcat(nfs_path, "/"); + pathlen = strlen(nfs_path); ++ if (pathlen + rlen >= sizeof(nfs_path_buff)) ++ return -NFS_RPC_DROP; + memcpy(nfs_path + pathlen, + (uchar *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset]), + rlen); + nfs_path[pathlen + rlen] = 0; + } else { ++ if (rlen >= sizeof(nfs_path_buff)) ++ return -NFS_RPC_DROP; + memcpy(nfs_path, + (uchar *)&(rpc_pkt.u.reply.data[2 + nfsv3_data_offset]), + rlen); diff --git a/meta/recipes-bsp/u-boot/u-boot_2026.01.bb b/meta/recipes-bsp/u-boot/u-boot_2026.01.bb index 9610d9e8fe..8dd15cf9cd 100644 --- a/meta/recipes-bsp/u-boot/u-boot_2026.01.bb +++ b/meta/recipes-bsp/u-boot/u-boot_2026.01.bb @@ -3,7 +3,9 @@ require u-boot.inc DEPENDS += "bc-native dtc-native gnutls-native python3-pyelftools-native" -SRC_URI += "file://CVE-2026-46728.patch" +SRC_URI += "file://CVE-2026-46728.patch \ + file://CVE-2026-29009.patch \ +" CVE_STATUS[CVE-2026-33243] = "cpe-incorrect: NVD currently maps this CVE to denx:u-boot, but that mapping is incorrect for U-Boot; the U-Boot-side FIT issue is tracked separately as CVE-2026-46728 and is fixed by the included U-Boot backport."
Backport commit[1] which fixes this vulnerability as mentioned NVD report in [2]. [1] https://git.u-boot-project.org/u-boot/u-boot/-/commit/d6694018eaddefac6aae974f9cec72fd6e58f1bc [2] https://nvd.nist.gov/vuln/detail/cve-2026-29009 Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com> --- .../u-boot/files/CVE-2026-29009.patch | 38 +++++++++++++++++++ meta/recipes-bsp/u-boot/u-boot_2026.01.bb | 4 +- 2 files changed, 41 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-29009.patch