mbox series

[scarthgap,00/11] u-boot-tools: address multiple CVEs

Message ID cover.1787731424.git.hthakar@cisco.com
Headers show
Series u-boot-tools: address multiple CVEs | expand

Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) Aug. 26, 2026, 8:12 a.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

Address eleven U-Boot CVE findings for the U-Boot 2024.01 tools-only
build on scarthgap.

Backport the upstream fix for CVE-2026-46728. The fix rebuilds the FIT
signed-node list from the selected configuration instead of trusting
the attacker-controlled hashed-nodes property. Add the patch to both
the u-boot and u-boot-tools recipes because the affected FIT handling
is used by both builds.

Mark the remaining ten CVEs as not-applicable-config for u-boot-tools.
These vulnerabilities affect networking or target runtime code that is
not built into the tools-only configuration:

- CVE-2024-42040 affects the DHCP client.
- CVE-2024-57254, CVE-2024-57255, CVE-2024-57257 and CVE-2024-57259
  affect SquashFS runtime parsing.
- CVE-2024-57256 affects Ext4 runtime parsing.
- CVE-2024-57258 affects runtime allocator and target architecture code.
- CVE-2026-29007 and CVE-2026-29008 affect TCP processing.
- CVE-2026-29009 affects the NFS client.

The tools-only build disables CONFIG_NET and does not link the affected
SquashFS, Ext4, allocator, architecture, TCP or NFS runtime code.

Testing:
- Successfully applied the embedded CVE-2026-46728 patch to U-Boot
  2024.01 without conflicts or fuzz.
- u-boot-tools build completed successfully.
- u-boot build completed successfully.

Hetvi Thakar (11):
  u-boot, u-boot-tools: Fix CVE-2026-46728
  u-boot-tools: Ignore CVE-2024-42040
  u-boot-tools: Ignore CVE-2024-57254
  u-boot-tools: Ignore CVE-2024-57255
  u-boot-tools: Ignore CVE-2024-57256
  u-boot-tools: Ignore CVE-2024-57257
  u-boot-tools: Ignore CVE-2024-57258
  u-boot-tools: Ignore CVE-2024-57259
  u-boot-tools: Ignore CVE-2026-29007
  u-boot-tools: Ignore CVE-2026-29008
  u-boot-tools: Ignore CVE-2026-29009

 .../u-boot/files/CVE-2026-46728.patch         | 379 ++++++++++++++++++
 .../u-boot/u-boot-tools_2024.01.bb            |  13 +
 meta/recipes-bsp/u-boot/u-boot_2024.01.bb     |   1 +
 3 files changed, 393 insertions(+)
 create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-46728.patch


base-commit: 543550522f831479f07d332a40ba343c53ae1065