From patchwork Fri Oct 2 11:02:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jakub Szczudlo (Nokia)" X-Patchwork-Id: 99879 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3AEDBCA5FD4 for ; Fri, 2 Oct 2026 11:02:15 +0000 (UTC) Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.43]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.8889.1790938926273402694 for ; Fri, 02 Oct 2026 04:02:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=q9tytJqm; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 40.107.159.43, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=xoqc97ywnhxO1h0H/ZK36hF8Tgs2Zc5HHwbjXBYmo8S3yGn8di74VsNa75mXz4CccshKapiFQv5G53I66zFDklhzMHsW+31ssD21XrzdTXKPM4BnuZStFrim2yt90QiH2IPXGIgVWg7+nZ7g0nrJ3yFcVjKWJymGs4A2rkKa6ptFD53ll8GSWqdx1Ry+ahQT0f8LAhE6YQdzZBZdMLB5Y+NlgEzEu7u4lbsDc5VdHjModhYav8l2739Z5CJ3CtcK2bNat+qaGS2lpx0t6LDFcWQnepj3EVR50QLCEgTsLDnWnsUlF+w+OeREFONhtEF8Fd5Mhr/E8ju313jAkgNnHg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=qKWOiCNeW/GLtB6aD7cuMRzyWgvX8AdhUosOFWJYsAM=; b=cYRoh3HkZta6J8MISiKTaWNCTvuWmC1hpu+ZmDYNJJfXp3viQwyaoF1JdzVqcRn+2+hFqNerl/H+MSLMvoD1jqX2ph2i1c6Y3o7Lingx3PflrayHuub74KSoAjNtvrC965ewMT/e5hXdz82+8+05eBgoSlj0etoGZAS2K/VVQyhk35mF+5f/KeQ82dx9h/ZnjI/PNI2ucuMfqTnHHwNCn+tBi1LPoUGxstiKlChMHFIJ0+VxwySAKarZQcBO2yPjdXQJqJWkCzj3903ETpaDu8B/AGObsrrTo2+3XIVHmve0IKkAp9ALpOpnQa7Offtp+U28HMtA//xB/ey29MJYyw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qKWOiCNeW/GLtB6aD7cuMRzyWgvX8AdhUosOFWJYsAM=; b=q9tytJqmBNk0T7mixAGkIvt84otXn8dsC3mqYh/DLfaO4LLUIhRgqfHKKxEsF1Am0ozNzMVYVehe5+aucuqKu5eJs38amKFuhqG8LZCC397J5IDxTaBk2qDWxuBfzjZdna7iGohALdX9GgJNJfiZ1LL9gdbf2bmwSKKJU6TEaoZ7bH93aNNlGNr0XB8tL3XSGlLnhD5n5icmltB1JirvnhJaV8vUnVj3NRaYiKkm6aW/mI/ZOoFemPOQPWB5RyDaCQHe6c/al6SR8/Iwk8CBu87FW0D/ZcSthS3x/zEKQqqALlPYpzm2bAFhb9wlSmU7r+iJ/ZU+TQr4v1jESmO/fQ== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by BESPR07MB196443.eurprd07.prod.outlook.com (2603:10a6:b10:130::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.18; Fri, 2 Oct 2026 11:02:02 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0472.016; Fri, 2 Oct 2026 11:02:02 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [scarthgap][PATCH] libarchive: fix CVE-2026-15028 Thread-Topic: [scarthgap][PATCH] libarchive: fix CVE-2026-15028 Thread-Index: AQHdUl10roHPRWpju0iL+5O6fHHnFw== Date: Fri, 2 Oct 2026 11:02:02 +0000 Message-ID: <20261002110134.11564-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|BESPR07MB196443:EE_ x-ms-office365-filtering-correlation-id: 3ceba4ef-b6e9-45c2-9294-08df207496a0 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|23010399003|376014|366016|1800799024|18002099003|13003099007|38070700021|11063799006|56012099006|6133799003|12006099003|260925022911599003|10067099003|260925021311599003|260925021911599003; x-microsoft-antispam-message-info: VcsR/fmFJP70euGT8zufxRsPh2Exo4Tjo2Ufr1hW9f1SLYKn4Hqgx9eMZ02sRR573fVt/oBLdrFxp5up2TU5YE4QNKtrfgFmLEfUO7b/PsUC34bnXTmaxP6XDSvHoIrZPqdWcXArH7dyz/17ofM0sKo5zcfqJ/JmQ9qUW6MqcvE3cvDmAevrjmXKWuN8KkEWB9DJ/lQJ7E5Ds6+eeIZ02Y9tMXjrDrOu2eeoPAMb6dIFzpjh2Sfe/5FD4LVZjYKMMNzMvh5A+1XBa8z5k/oNL8ZvimhEL+M7k0OCb90ZEzWtVjEHhVkGXueD7wPY4qkMll6cNWU9XfXdkv5d4jtnWqtOZQVvej/E1pFuMNDmTCZA8q1mjd9e3MU4B7EA0k5g1/I35b7gyoYM55QBH/cCximsw7rUPx1pZTwn2nglhNMszSIO102Y4OoSIDFSa7WxSRQC22keg6Tf45gN8VjbW4wWJ0wHs2f1AGl7vL+YURp9jdpdYMUwIc3Ew5ncg6CASbYXTDfYpiXv5ZhZSaXlO6XgQrWNd0BThXAvWjsSNB+pYvILfDBmWvfx2ldEcXiHXSYGIKg+HPXnFe/7HwnECFu+jTj+AhX6WeVG8G0Bf+1+SVrjWLt2IQegxRerBf+TTvb9fwRnwTGe/LhW2C1AHJWHR3Pu8EEgOmCyuqWiCoA= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(366016)(1800799024)(18002099003)(13003099007)(38070700021)(11063799006)(56012099006)(6133799003)(12006099003)(260925022911599003)(10067099003)(260925021311599003)(260925021911599003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?q?whFIFNAQpxoJIC9NadJVQuwymx07?= =?utf-8?q?sJ/G/C0Mv3/OzwdVv7jpLhlHK0UxvyBcw4wjg9XYzJsuW40sooELF+HXU5DhfoNpu?= =?utf-8?q?56BwSYdDJO/ZTl23Fa44Wa+0t/maPpXFUQdVt1A+g7sUiorTaXUeekGcJTliN3LA/?= =?utf-8?q?BD+qoPNdC/AiW9iSVkBuOXI0bOczHMamtY9RAJ+Oafx/egaJ47/qte7LSKdYAU34E?= =?utf-8?q?9jQPGRfzNNXju4kWWm1zX1kXTdJlEPSyX8JaKXfEeFwZXv5SwnnwiS/W03VljZs6X?= =?utf-8?q?drN+/b7c5i0lq/FjHDGduhQrMkCd3UnJtzqu4zq7s44kiUoO/u/r7uD7HJiFVu6TV?= =?utf-8?q?c7wOnIU+S1scEPxtfqxG12TiYK/QXlYqSZWe3IXZgT6aq9k2fqrADPTYZpcy454fD?= =?utf-8?q?HtI1WuSaVYIoqKB18FD18wf3+YuN+mevJ08AUXnymgQKQgzE4vsdvSuhhDb1gy9q4?= =?utf-8?q?csVTdSJmmSOJqdlm70WEZ6+vFqfGebKEO1bOLVXk9CN8Fg52IkarOZwIbDBFSs67S?= =?utf-8?q?W52BzKiOauljdaWHlXiKUssZ1rO2PlCsx3DafKJ/6MpfJ933m4UN00YoNXli2b/cQ?= =?utf-8?q?KdZLZfq31hzH8gUcWQMIeKAXmHt8o7cwFk4bMzfnTyYND1Poa4z4BhHX73p2nrLOV?= =?utf-8?q?DaOotOvZ/XU/Jl8orsVuuEEG9I2MTKnSrj6d61JE1aj/A8lX0n8nk9T3qjMu81jPo?= =?utf-8?q?gsKUkoA+Qrn80Xb94THDyYpj2Hq2yN1anayQqkpReBggxyMqxd+sFqWl0YBmNgogj?= =?utf-8?q?AEaUD5aQzWoSnngh+YDqtTk3TEauO/8MBfEpEwW4LnKa8EexePUb2qte5U882Ukit?= =?utf-8?q?Sn1E4Lf0D8/vrq0deAoV4Yd2YFJq0nDLYOfFAiHqS0pJDHpxMnIqQC4OnnOnOQL7P?= =?utf-8?q?HcXzTtnSL8RjeyaJSJ/WCORRHXrvSC1qk8RTqWqJT8JjXa2L6z2NCD2Fa0pANqLPt?= =?utf-8?q?XcEtbRNT1wXvPDwogHecWOpGnZenwQhsJBeV90PX7+rUu9R82Hw3u5esKcpmxvXeZ?= =?utf-8?q?PGuFxpWf5Lu10TEhZyTsxqxhNx5ziX0EffkMS9eQi1dWcfDMSc5mS3ahP3WEL/qtk?= =?utf-8?q?xSaFJ3NR9r5k21ngAPbShlB3m03SXGQFsi6zQ8iljriklahUcZe2jqcliFysS3xRf?= =?utf-8?q?gNoaSKoonhKIrBWD2+8ih3LLcDqwNpjglVru2ccUgZqPNR2PFR7m3kJbSQIkICnVC?= =?utf-8?q?HVSST94F9vyQ+kH9B1czPBbMhq0sguGimw2qBm0wrLUNFvU2ILSqkKyvs7Vfngtvh?= =?utf-8?q?yUtSmsVk8/LW725IlAMWrHI1YrAF+LEcubEUTLOllX+GGoJpf/Gdejmj68o4zPq0G?= =?utf-8?q?OF4sFxMceVKNCuWmpkYz3Kx96ZZ6wyKCTphKd1N49eyQ19S8Vfa50nrFzGi2iwX06?= =?utf-8?q?gY4Gr1WiikaMArhdUo8K3hM4HnlRRmxw8kJ6GFPMjISVDCL+ATUFae8aCl3sR76er?= =?utf-8?q?mD2eFIUMZuO7J0Uo0UmBYzVtyZ3PZ91FSPdq1YHLgZtFfL9Hv2wq4SK5jgeuXDzy2?= =?utf-8?q?3VV2dKhpqjZcv4S7ipCXI3yS8yps+o2JBEajGZX3dPRijQO8MIovxAaj8ysfsIayd?= =?utf-8?q?e2/y3NaZtZDJscq+Xiv8bv8JM/FKXe76d4HJWfUti4Vf+ZsNlL/bebvqs9HZHRPyR?= =?utf-8?q?0xX8d7zpdRMkImvRz6AezLizsxT8vSTA=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 3ceba4ef-b6e9-45c2-9294-08df207496a0 X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Oct 2026 11:02:02.4726 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: khb7mlGGGKSyvp4GXTJEx2FN1+DNJzoKm4JT1xSHHOtt5by4o8MLqoHQcHd/Z3p7k7953tFBQrIjJblLaotJjMalbE4Pb0vdDUDKvnGw3OA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BESPR07MB196443 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 02 Oct 2026 11:02:15 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247107 Backport patch to fix CVE-2026-15028. References: https://nvd.nist.gov/vuln/detail/CVE-2026-15028 Upstream fix: https://github.com/libarchive/libarchive/commit/40b92de1def08e4fc319d55702785f82cedb7ef2 Signed-off-by: Jakub Szczudlo --- .../libarchive/CVE-2026-15028.patch | 41 +++++++++++++++++++ .../libarchive/libarchive_3.7.9.bb | 1 + 2 files changed, 42 insertions(+) create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch new file mode 100644 index 0000000000..c63fcf22f2 --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch @@ -0,0 +1,41 @@ +From 40b92de1def08e4fc319d55702785f82cedb7ef2 Mon Sep 17 00:00:00 2001 +From: datauwu +Date: Mon, 6 Jul 2026 21:51:15 +0800 +Subject: [PATCH] tar: fix 1-byte OOB read in SUN.holesdata parsing + +header_pax_extension() passes PAX attribute values without the trailing +newline to pax_attribute(). The SUN.holesdata parser read one byte past +the supplied value when the last numeric field ended at the value +boundary. + +Handle length == 0 before checking *e. + +CVE: CVE-2026-15028 +Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/40b92de1def08e4fc319d55702785f82cedb7ef2] +Signed-off-by: Jakub Szczudlo +--- + libarchive/archive_read_support_format_tar.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/libarchive/archive_read_support_format_tar.c b/libarchive/archive_read_support_format_tar.c +index e07cfdb63b..1c0441db6c 100644 +--- a/libarchive/archive_read_support_format_tar.c ++++ b/libarchive/archive_read_support_format_tar.c +@@ -3448,13 +3448,10 @@ pax_attribute_SUN_holesdata(struct archive_read *a, struct tar *tar, + return (ARCHIVE_FATAL); + tar->sparse_last->hole = hole; + } +- if (length == 0 || *e == '\n') { +- if (length == 0 && *e == '\n') { +- return (ARCHIVE_OK); +- } else { +- return (ARCHIVE_WARN); +- } +- } ++ if (length == 0) ++ return (ARCHIVE_OK); ++ if (*e == '\n') ++ return (ARCHIVE_WARN); + p = e + 1; + length--; + hole = hole == 0; diff --git a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb index 2eb22e2d61..3719965eed 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb @@ -51,6 +51,7 @@ SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \ file://CVE-2026-4424-2.patch \ file://CVE-2026-5121-02.patch \ file://CVE-2026-5745.patch \ + file://CVE-2026-15028.patch \ " UPSTREAM_CHECK_URI = "http://libarchive.org/"