From patchwork Fri Oct 2 10:56:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jakub Szczudlo (Nokia)" X-Patchwork-Id: 99878 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 37F9DCA5FD4 for ; Fri, 2 Oct 2026 10:56:45 +0000 (UTC) Received: from DUZPR83CU001.outbound.protection.outlook.com (DUZPR83CU001.outbound.protection.outlook.com [52.101.66.65]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.8819.1790938603250600215 for ; Fri, 02 Oct 2026 03:56:43 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=jIi0zHG6; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 52.101.66.65, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=BEFvpsjcFA2ptj8iCLn6vhY81MJvLt9PPwHF3eYykQZDwAbKAMq1V7t/bCUAxjEifoJ5HIgEUkGZ7MEdqbc11M6Wd2JYIvDt/FxgjHNuVq4v72UEvQcMKz2bolRIolnXbTqLyWHcmGTWzXAMkQMifHxWSO7BOK52Eww6E2nxyivE/txT+AnJCpMoryzffFsWhkHLYGTAGal9IuK34rCkRsl/1p2nS4Onxg88wydlizGnt0uFLyuITWNnvSQS5Pb93TETvqvi3I0ggClp3T/O8Pt0QpRibdTt9LMkhisX1V0JUyLDCcqUyONBO983qBzBcjrC7SLwohWsU21bAfhjjQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=qKWOiCNeW/GLtB6aD7cuMRzyWgvX8AdhUosOFWJYsAM=; b=ZJUBLdUbS1Vn0eVvywYQgyuqofT9n49HeuDf18paRkOcInQkH0PDIsdMAOgHlg+OOdrVN7NGFubeRsaDAHpMD/c1HSeJOl7daagVZbXzdmuaAMJ10HNKN/vKYUhrl77U58q/wQ5Z0drXSmJTtzKXwlVzd8HZ1zAKGHMpKHK+inH9tI7ZivLuayMnnTtgcVzyOxdpTf2OHcQw261JISWO8aeSx7md+95TOlOdxpNyb4ShJGDR6VI7YlKdycrTV+8XLIwWjzFwYn5c+Fkffv1hi/e/F+Oi4lGVIAN2ZY7CNPq/lFRB42hP0A4kcX4SpQe+r/K4km3aWW+XJTmU/9vPxg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qKWOiCNeW/GLtB6aD7cuMRzyWgvX8AdhUosOFWJYsAM=; b=jIi0zHG6qwAZ/s1Z+KroS8Cc+Ue196h9najkVGip+f/n/IFR1Zix4S9RQw0agSHxfF7Ay18xNRG0Aogyq/5RFE9mXdhIw6Xtd4FTvzOtcFDB9fUcpM4z2pX81veEVxyVTKyWzG1Z4AzKLGrZASuoJvRfLVv3/VLGCN3lgvnR8kxt2o/DFkOpEA4nBJcu3lPAXLaxe4SYlv+omURSHCPToOrwKw5eNz+PpY3TRzRfVYqS3u3aAnP1HfcLf+f84h/ZhUJVQksVddZE7YuigU5tXaQ0pzZr3u9f0trOjVP8tZ5T9976gSj6ui6fFGYk+byyxPki7zEOx/clZzR4S+A0ng== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by BESPR07MB196443.eurprd07.prod.outlook.com (2603:10a6:b10:130::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.18; Fri, 2 Oct 2026 10:56:39 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0472.016; Fri, 2 Oct 2026 10:56:39 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [PATCH] libarchive: fix CVE-2026-15028 Thread-Topic: [PATCH] libarchive: fix CVE-2026-15028 Thread-Index: AQHdUlyzF9XyTXGeEE6+ni9AlBZMIg== Date: Fri, 2 Oct 2026 10:56:39 +0000 Message-ID: <20261002105633.11220-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|BESPR07MB196443:EE_ x-ms-office365-filtering-correlation-id: 6b1faa57-94c1-43e2-2d00-08df2073d60a x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|23010399003|376014|366016|1800799024|18002099003|13003099007|38070700021|11063799006|56012099006|6133799003|12006099003|260925022911599003|10067099003|260925021311599003|260925021911599003; x-microsoft-antispam-message-info: M0MuK4wKzo9tnS0bMn9z1Y6pcDj/pM8BF2KPNtXwvo9yMDM61ti8pSPBZL4SV22Av4F58bDAiZbmsRf8igQCZpeZgcyVJJ3zifKcAu6NqqWaxCtPLqxijt07YhQzY5cZMWW81C3GoX7dWnXYCU0pWeeuGWlbmcCfYk6MiWGYJswit8TKv/2kyVd9oaESSyZ5kO6sE0JjdBvbLAYUqifHiHf/AwUsCVOhJYNwuKPloA+u2v0s33RnR1HN0u0xMW8Lx96BHTSLhPW2A5CRPVZm8yEQFCWzg9h2fPKoev3z1KqAy26ssfMuyzTgVxJqL+Lzau2hGEH7a0EOH9f50AWyC2rA8D7BnhmHuOz/GLuWwl1uENtrmwMuw16lI76JhrEbv9VYyRakk9Lciy8Wbongf8IyXSLYzDT4Y5t4HjH7mAveSbBN6icPa0FeMzgtJemNX2lyUjwWJHTV4Z6IwR69BdvKjkdeCLDTSN7S3irAbTOkOcWnmvZ2MsbqwFRm6Q6yFXDx8FdAVKJ+if4X94QRDQSiB6Wnplva2CZJwKjnFXs1uBscSjR6uVTtHIGdVaJ70tMc/1uvsyBmXz8FEZmxbkJ5A+JEtDWY2DpZKMPO8D/MLZ80Y1cNIB9wGqRV6+dpP8KLX9YA0YO1DZuzs/puARcZzVW3LxyvZV1IgKNsTuU= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(366016)(1800799024)(18002099003)(13003099007)(38070700021)(11063799006)(56012099006)(6133799003)(12006099003)(260925022911599003)(10067099003)(260925021311599003)(260925021911599003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?q?WpVwRn0k7fL7Lwe+zS3q2UjXPUrN?= =?utf-8?q?vS8nPvw5JUVWgJnk+gP0HXfikwnQVpLWtsKeB5ivyyPJIga+VNE1bJyibDrs5YvBd?= =?utf-8?q?CuYLlpspA866piEXa0RJwJV5ncKl1WgIYSLm6aba3ijyQ3b6afGCmSwFzsO6s38iu?= =?utf-8?q?aKeQZh5eVTavQ17OX9+MLpA025yyXaZS6sWJfNmloH2nqkeEAegRN68BTJNg849H6?= =?utf-8?q?aj6BTS2V3pFwoL+iOxymaxxunV3r3EfagXRkxQkiYJWC6giJnhmCHZvs50tohAXm1?= =?utf-8?q?jsYjIwjEkJL1t6L1DS7hzCY2k6SAW6CQ0zEUTckwEJZnEyEoJobvxMNc4XYIUswEB?= =?utf-8?q?K30CF66WITZDls4qwWtTMaRdaMaJdhgvvLA2jHg0Vw0sRPzcuQR/SWYm7Lq0DDPoD?= =?utf-8?q?4gO7f6DuSrZ08/QeUEV8bWQqkr1L5CXBaV8ZsmbYF+XsaJ2sdwmBIcmRCW8DTEzti?= =?utf-8?q?/Itsi8s33oT4gk69KDqJTzTJN4VQmdyIPWTaJOfL/+eEDj5B9Jcrul+EtpsfM47rE?= =?utf-8?q?VJq4Eli3YBJ8WEpds/toI8rAzemm3f3F6SAlDZUKf8uCCzg8LHhZ+TFh3fECyAknr?= =?utf-8?q?ZPzPPkUMwhnt4C1My7PjxlJRvBh0JlMArLVT/eAPktrXfqhTOB0gO3I50erfF3wzY?= =?utf-8?q?NjyRU3AKzHbORkq/1tVfnMamWbgflUOgKjUCHi2U1aH70vLQptW0GWEn18Wlj9v9q?= =?utf-8?q?LxbBlJzEzdI+j3PZuObI5hFrE3CmFooSMiaCADm6quLaAnod6PlbEknrbbLorObNL?= =?utf-8?q?WlY8ajSJN79zQehPaXqeb9HlhufqPjcMtGFp2Xgxr7NrzEsK2+wLcirBogQmeKzPN?= =?utf-8?q?KKkHt3l5cREqCv6IhHLxXNXX7g8hqguPgqP03HhK+GLxCT/Tp9BWBMm3BhH6UO5ir?= =?utf-8?q?6IufCk8YPi8zyAPt/xakeM1yG7vUCWwfGb2KWoHd3ALxUz2Ydvd0yPqQEdBqdsaN6?= =?utf-8?q?YNm5oKzuy71asqwXbyizJtAbwXTBBDbGqia6pr0BB7G657g3btaTNia+S1qtZOb7a?= =?utf-8?q?0yqjrQBt6Kiuqms1o7raxlsrxGD1dffBKwhxtAjEGqMgkMqHALQaHgQ6fbyUel5Ut?= =?utf-8?q?FFA+5lHTDXWlyrAhk+g+wNbmMhUQa6iR7cTysghvWgsM0LfyPROK6tjWocHsmIdXc?= =?utf-8?q?ImM71PVsX2AYlE01g+opc5ayHYUt3JhWrfd4r5dPlvZo+wtmo8ak++9cEY0xmHrDw?= =?utf-8?q?juFMc6QJquO6k1hAiFJWFPtFtnL4jhzkU5wA1N1565n7KGy8xIsdu3qQN6o+9vVgl?= =?utf-8?q?QniMhw/Z7/8uYfW5UOwy9eYhEgD/W2uVrJZxHckbOfda0Uq+PNaTIA1XPYxzArvH+?= =?utf-8?q?ftgyz/81DmhvJeybZQ/rBCeExdPc56XMGrfBDLTONxdz3kBIu1p9kJMTz9/5ejp1d?= =?utf-8?q?vf6mVQIE25CczYY306AROb0PoYyL3N8MGhVxIjP4PgI3VorhV9tTmDovu3oU1OWc0?= =?utf-8?q?fkxYY+hDhA+IcLym0TlebLzIQJC2R7z8FX3D/AgPazrjGG7ddiagHu3+ScfcrFeOc?= =?utf-8?q?cB/ruWQ8QPvsKrNjVWCefVaELfRpKhBZHWhn9mkoOoPvHHslJtw7pYGARSnzKbbXl?= =?utf-8?q?A61eVTZ+3MqT5FDGYnMeyDSaRXtqBLudEugF59zJ6NdM30BNQvgmPCqRLmyG7pV/G?= =?utf-8?q?ywkXrueSY1GALwiuk4At+uYw81r1Fj+g=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6b1faa57-94c1-43e2-2d00-08df2073d60a X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Oct 2026 10:56:39.3707 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: C9erSBu/ExWaaO6QiuDx6bi/8IkJTDKFK6CaEkF/fObiSrdatk+b4JCp/J5Js1aR0H2lrZLoVfWfX8KKWomZYFb7PrZXe7ZQHUv92Q+dI3Y= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BESPR07MB196443 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 02 Oct 2026 10:56:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247103 Backport patch to fix CVE-2026-15028. References: https://nvd.nist.gov/vuln/detail/CVE-2026-15028 Upstream fix: https://github.com/libarchive/libarchive/commit/40b92de1def08e4fc319d55702785f82cedb7ef2 Signed-off-by: Jakub Szczudlo --- .../libarchive/CVE-2026-15028.patch | 41 +++++++++++++++++++ .../libarchive/libarchive_3.7.9.bb | 1 + 2 files changed, 42 insertions(+) create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch new file mode 100644 index 0000000000..c63fcf22f2 --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch @@ -0,0 +1,41 @@ +From 40b92de1def08e4fc319d55702785f82cedb7ef2 Mon Sep 17 00:00:00 2001 +From: datauwu +Date: Mon, 6 Jul 2026 21:51:15 +0800 +Subject: [PATCH] tar: fix 1-byte OOB read in SUN.holesdata parsing + +header_pax_extension() passes PAX attribute values without the trailing +newline to pax_attribute(). The SUN.holesdata parser read one byte past +the supplied value when the last numeric field ended at the value +boundary. + +Handle length == 0 before checking *e. + +CVE: CVE-2026-15028 +Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/40b92de1def08e4fc319d55702785f82cedb7ef2] +Signed-off-by: Jakub Szczudlo +--- + libarchive/archive_read_support_format_tar.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/libarchive/archive_read_support_format_tar.c b/libarchive/archive_read_support_format_tar.c +index e07cfdb63b..1c0441db6c 100644 +--- a/libarchive/archive_read_support_format_tar.c ++++ b/libarchive/archive_read_support_format_tar.c +@@ -3448,13 +3448,10 @@ pax_attribute_SUN_holesdata(struct archive_read *a, struct tar *tar, + return (ARCHIVE_FATAL); + tar->sparse_last->hole = hole; + } +- if (length == 0 || *e == '\n') { +- if (length == 0 && *e == '\n') { +- return (ARCHIVE_OK); +- } else { +- return (ARCHIVE_WARN); +- } +- } ++ if (length == 0) ++ return (ARCHIVE_OK); ++ if (*e == '\n') ++ return (ARCHIVE_WARN); + p = e + 1; + length--; + hole = hole == 0; diff --git a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb index 2eb22e2d61..3719965eed 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb @@ -51,6 +51,7 @@ SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \ file://CVE-2026-4424-2.patch \ file://CVE-2026-5121-02.patch \ file://CVE-2026-5745.patch \ + file://CVE-2026-15028.patch \ " UPSTREAM_CHECK_URI = "http://libarchive.org/"