From patchwork Fri Oct 2 11:02:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jakub Szczudlo (Nokia)" X-Patchwork-Id: 99880 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3CE65CA5FD4 for ; Fri, 2 Oct 2026 11:02:25 +0000 (UTC) Received: from DU2PR03CU002.outbound.protection.outlook.com (DU2PR03CU002.outbound.protection.outlook.com [52.101.65.22]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.8916.1790938941428428743 for ; Fri, 02 Oct 2026 04:02:21 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=Hv0u9ORX; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 52.101.65.22, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=amNMxPKsuhJ1uQNmuy01Bs7u0Pjyetzs8Mv2NohlXW7M8+LokENvywlebMRYO7UcHQIvfgy+TAWgQscTDQbNWp/kQ5X6UU/NuU2k3ACCWq8z5/xZK+pSRJzA02s0JVnHuk2braCB1prii1HjCu7gfovvTmK8Q9bYsFPpK+GjVbk0LiayyS3yoX8UNVkBeCqgGF0JlYMO2JQc+jImb0fj9LfZqEx1Rnginb9B1I+oiv21dw5ODb2gqMCQyYTWt7H+8zcbp1wawj1kDpZFpGO1JHYtIuyogEF70DISeiJI1bKbuEi7RHXxpU2MLB24y7zKRwzo7LXcI5XIlvPb1cF6+A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=0a6Agzd/i8O5Y84x+R4oAwO/q6Q98ghg5V86Vxg3kfE=; b=itI5KlNIpKwYel2tdytn8iyhwjPJGHP8rnVWcx+LwYmieGFqSxh5xw0s2Fucq1qD3H+Ls14cOC6klCBvEppRVgOyOvVC3xISkc61t66/DSIU7o4S5SK2x0vFx3yWjDpzNbY+TVzpC/WiN2HT1r2SSL37wv3zlS8+Rfmt0lc8bXCIGe3mJznPozScKNWqGDxcKyJS/HQDW827jf1syaAWiJ/V6kiBZzK1b4lX44+qx5rWAhsF3TGjsUXZa/957Y8agrGJ4dRHkfYIHL1S4Q8d2A8NkO12J6l3jXuygBBI8la8aVdaCkPJB0SrGzsJS7RUjg5DumEpXaRChyAZiRR07w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=0a6Agzd/i8O5Y84x+R4oAwO/q6Q98ghg5V86Vxg3kfE=; b=Hv0u9ORXwHgwjWgt9VP0ecYbblFyZvAkKtASOUsVL16vOjhJkL9lZS5v6x5SLyDau6CGFZ7q1L7NVYm4WgXwVB5YsXVMcZkrUpi8cDQRJf2glWwCNSddcmR81mz/Qa4s19dWKGtqeAdt6qo4fcJDK86bX6GGv93YWhP/jY4BiuJWV4ScU+pHxxREdm/0rvS6F43UXIVFXzUWkF3afyvt9NG9tTYPlaWuDiT+yrV5HvYjmSqPtSQ99hxLEEXfvLRGPBObSLin+1WdDj6n0/tLr3yy3WMmefT4ZPKlkh9Nla9DZ2ib1iEte3QfVq/7iGcxq14dffdFmuy1PZjztQuypQ== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by BESPR07MB196443.eurprd07.prod.outlook.com (2603:10a6:b10:130::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.18; Fri, 2 Oct 2026 11:02:18 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0472.016; Fri, 2 Oct 2026 11:02:17 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [wrynose][PATCH] libarchive: fix CVE-2026-15028 Thread-Topic: [wrynose][PATCH] libarchive: fix CVE-2026-15028 Thread-Index: AQHdUl19HDOevGxmcka0yDdok1Utuw== Date: Fri, 2 Oct 2026 11:02:17 +0000 Message-ID: <20261002110211.11669-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|BESPR07MB196443:EE_ x-ms-office365-filtering-correlation-id: b52cc640-9504-4f23-ab76-08df20749fd0 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|23010399003|376014|366016|1800799024|18002099003|13003099007|38070700021|11063799006|56012099006|6133799003|12006099003|260925022911599003|10067099003|260925021311599003|260925021911599003; x-microsoft-antispam-message-info: WzwoCXmjEk4oyKx+xmOIn/tbDgynrVsZ+SmjZDQsw7HzOs5wvH9YEP6QbVqKfo9U6XJ2DRo2BzZmEx1XKc67eCAvobFGo0baA3vryjfxfX518qUUdWv0MikLpXFy5VqqZ+DcK3zzk0lRpFR5+L8u3zxiyVWLJCF1YEwuh4A4b8ESMAew72aFLYzoX1VgPDBTxITCe+IEyZdr6y0+yd5/OIseECHu2ZXR+i31YdxSIDT/rdyZhoudkp7++4H9+rzBnjPTGQDq7KxSFhsf7pQFMdw7q4OlEfHN+P9TZ5Cz/6lKtWPfcxFXHesDgHrnM2ebADzhNuJOFPbe/MhUiF6hL/dYBIYo45RFF8mdiAWf5azZqhz0rMF6yVinco4WbmP/l4c4h0EqY4bxrfYRdsFPN7fjlrdkNklt+kgWeCkge79YrDC8Nr4ptyE7klrYjDhvp0SDyXPc6HDc5/PqVnwVdoKzBTCHQBztXBXnGSbwoYUQrnrLkEtJYalTdC7aDxesURveGDkLa+fSZAdf7cTals3Jnas/gOuKrp39oR6CAvlz6k6BW4fnJAOt/7Mb3sf2F8PxjfxaAYLwzSVVVTRHJoJO6M2k2AdnMkf6NPtK07FmJeBpJGpgKVPRNyag+5sLWytvNocs4ZYGsxLHC3ajOjlpr5hA6PN2nWicBVGQQbY= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(366016)(1800799024)(18002099003)(13003099007)(38070700021)(11063799006)(56012099006)(6133799003)(12006099003)(260925022911599003)(10067099003)(260925021311599003)(260925021911599003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?q?TXGjxW6evW/gHWkMQIXXesB33Rbk?= =?utf-8?q?72a9QWWWNrnrKJtl0xiH5ZJ79Argy1Xlt0tKSrqkGuPCF8mzi95H/YvGo9PZyMI9r?= =?utf-8?q?qml5XzApYi8aMu8ZKk4Ozb2kqy2CHRMllS43Udw/IXSxgcSKLTHRn4pfBYH/ASwaz?= =?utf-8?q?KOU1OaoRE9Szi7Rwjs7Of1EHoKW61fd3/yHKD9fwNMPpImO8NcE6rFA1+VToL31S+?= =?utf-8?q?OBWB103Y2KZpRz6vhG6g658iZLfmf5giE0l0PRZwHdfzkWM++WFGHdzM4Kqm61AZ6?= =?utf-8?q?LItuuEdlIiDI0IdgPTqr05kUXmAW1MYbABZf6AxjHwtJcVCd1pDRQxvmhVnlgKccz?= =?utf-8?q?lGs4/ROVzqcjsGYtsxYgDRyrIQBlYfyvFO2wWgRgoCVXs99m3Z02k/fGtAmaF3/7G?= =?utf-8?q?dd61qlZjJKIMHu3iK5q/usP++9jDKH+SEH59SWh2kNi0roCurUEYamvkPxFYJgXTV?= =?utf-8?q?vIGHJl0fWDtq87pDlLjDZQysGLHcBFNhbxI0ONneN5pOnFCF+PrjWaTRdFxF9hI4j?= =?utf-8?q?uzapTAKFbE2/jC37FQYJ3vJKVAYNqMdZzKhf3BEsVOYOPY+puTpOQgIsEnjv1tbVy?= =?utf-8?q?HTs0efQk6NvNTWkvDIazdg6JLLkw6iT7oUcyLi6ANjAluqUK490P905v65zfu6xUc?= =?utf-8?q?t+3TNBYUeVfNbdMqbnthWWbC7k2045sFFB8tRVCdaikRVMwHYAjoRRTlIiI5sadQY?= =?utf-8?q?gZ/GeNz7nY/q/wD7U9F0eww604IfmAVNh2zhaMeteF45a9YAJwTSUeWQ+ToWFHFoe?= =?utf-8?q?6cjzD9MrQ9z8IMvaLiEHn2dcVB5EUqR2hNZGjzbgmRTjj/KaVLLK3XysgtBZOI6/Q?= =?utf-8?q?T0Dk1HZKcf+I6KsbFScUV6RIPg5FL+2VS1pQGdU1a3Q81WOvlY5wA3FnjvwpArRF2?= =?utf-8?q?Z8nZNXY9e4PiBKi4UHI1bauDJb95Dl4IS/GD+IdMkPo2gj27UlqT6DtW8FZYeH8AJ?= =?utf-8?q?RtQLza0NSJjzRhsvxqo/j+pV5Ner2EvlFxXiPACc/ew6sDxz5Es8fxcEThBqlgQhS?= =?utf-8?q?GQva+zg5xHX53INsOj39Qbbpt9U73/+DDN1tSSt+lD1eUVn5ydfUEWQis49933VMC?= =?utf-8?q?qS4BN5PZLPCWaiIJ6G5NColnQrGOvovK7gHeXOPdxlFgo6zTNONUPuVtwNKpxOG/5?= =?utf-8?q?oJW55wN2Ov5IgdrRos9v+LWNYtJq6SYrf43HxtSrqp9Q8Ki12LPSWuvXnwE/ZcfvI?= =?utf-8?q?eaXajgWixLP314myQ6mcGNo3wZxxbxYuG/oHtpI16O5XREP9LmNe4l/KCFKVdLy7a?= =?utf-8?q?lgTOGwwkhLB5PgdYuU8+EqY/6dq0yP8ML5kIgGN9zkRxPbkmBNkUW0HCcj6l/XOjw?= =?utf-8?q?/Y9ekVlwkZkWUCN968+129NeD/LgLsSCFoqz/ZfbAXWxAVu2ERcz8biyrlfRZTZrK?= =?utf-8?q?AiZOKfteAJ92v6RKldkrWyej8IAt5oTLW9nKRceEfXKiASElgyQ+5QRZHysDqlxtv?= =?utf-8?q?Bi9+nGQz2NZqwTxLfkg3JvqDc3RcsUjMJQKtIh4sQ8JpkkEiowXlLWZUp/L1FjyCW?= =?utf-8?q?3SyR1j0MxG9Vj6otiG8waRJVm8Azne3i299/jM5chg8sIsAcUngIiSRWMi5TugjIL?= =?utf-8?q?RxbsUsBAHnUIt4ZcuVfPC+Tlddqm0KXJpgs3if/LfRQKh/RM2e0CXk10vdXF4vFXL?= =?utf-8?q?Vev4nGmc7b2mYGgGEpCRdRgdxlis3RvQ=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: b52cc640-9504-4f23-ab76-08df20749fd0 X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Oct 2026 11:02:17.9094 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: Hrtmac5jxohUjGk62CWLDhqI8FGQLQn91y/x71pYGWLc0yAcPMf0128qhIWHGJnhkst5Mij8AM9Br2dc5xSO0biAo5k1mvs1wt+dTCGXMoc= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BESPR07MB196443 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 02 Oct 2026 11:02:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247108 Backport patch to fix CVE-2026-15028. References: https://nvd.nist.gov/vuln/detail/CVE-2026-15028 Upstream fix: https://github.com/libarchive/libarchive/commit/40b92de1def08e4fc319d55702785f82cedb7ef2 Signed-off-by: Jakub Szczudlo --- .../libarchive/CVE-2026-15028.patch | 41 +++++++++++++++++++ .../libarchive/libarchive_3.8.7.bb | 1 + 2 files changed, 42 insertions(+) create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch new file mode 100644 index 0000000000..c63fcf22f2 --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch @@ -0,0 +1,41 @@ +From 40b92de1def08e4fc319d55702785f82cedb7ef2 Mon Sep 17 00:00:00 2001 +From: datauwu +Date: Mon, 6 Jul 2026 21:51:15 +0800 +Subject: [PATCH] tar: fix 1-byte OOB read in SUN.holesdata parsing + +header_pax_extension() passes PAX attribute values without the trailing +newline to pax_attribute(). The SUN.holesdata parser read one byte past +the supplied value when the last numeric field ended at the value +boundary. + +Handle length == 0 before checking *e. + +CVE: CVE-2026-15028 +Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/40b92de1def08e4fc319d55702785f82cedb7ef2] +Signed-off-by: Jakub Szczudlo +--- + libarchive/archive_read_support_format_tar.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/libarchive/archive_read_support_format_tar.c b/libarchive/archive_read_support_format_tar.c +index e07cfdb63b..1c0441db6c 100644 +--- a/libarchive/archive_read_support_format_tar.c ++++ b/libarchive/archive_read_support_format_tar.c +@@ -3448,13 +3448,10 @@ pax_attribute_SUN_holesdata(struct archive_read *a, struct tar *tar, + return (ARCHIVE_FATAL); + tar->sparse_last->hole = hole; + } +- if (length == 0 || *e == '\n') { +- if (length == 0 && *e == '\n') { +- return (ARCHIVE_OK); +- } else { +- return (ARCHIVE_WARN); +- } +- } ++ if (length == 0) ++ return (ARCHIVE_OK); ++ if (*e == '\n') ++ return (ARCHIVE_WARN); + p = e + 1; + length--; + hole = hole == 0; diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb index afc06f85d4..d4cd0b5b01 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb @@ -31,6 +31,7 @@ EXTRA_OECONF += "--enable-largefile --without-iconv" SRC_URI = "https://libarchive.org/downloads/libarchive-${PV}.tar.gz \ file://run-ptest \ + file://CVE-2026-15028.patch \ " UPSTREAM_CHECK_URI = "https://www.libarchive.org/"