From patchwork Mon Oct 12 10:59:31 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jakub Szczudlo X-Patchwork-Id: 100436 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B5B1FCA9ED0 for ; Mon, 12 Oct 2026 10:59:38 +0000 (UTC) Received: from AM0PR83CU005.outbound.protection.outlook.com (AM0PR83CU005.outbound.protection.outlook.com [52.101.69.36]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10892.1791802776622534089 for ; Mon, 12 Oct 2026 03:59:37 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=LxEFUJMD; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 52.101.69.36, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=aaceS2Tg7G6CFaWjefF7o5yT5pdexD6lLKOkevFw93QrqTFoQdZ2lBFXnkXEezQYF8S5kHpmXkzcvXYPf4Sp/AUkrxWR2uSJkWD20/DmWFVoBVQ6I4ZNf2Rs8g2hjDdGEjVvqK+weyBu5Ng8jomuVZ3Le0vTT1B59+DI1o8QepWqmLMycI1E2mI879l9j0UfUoZJ8VkdvdV0BHitu5H896STOFT/Oyqg7xtWDER3nIGSORpKNlWQNfF0As3F0lrpih5YNmyvRxfFUBbt/ifCp3lE38ASWbMe1EAb3H0CyB2ob9AA/z3U23taU0gD0z5GPIM7c53HkWzB+xVOsifVMQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=WgjqhY/y9KcMolxcdf9TxpwNWBFngWfAPqj8+TLyJWw=; b=oUZ96slHD+gMaaV3hAXqhHhy4CJxj6etSSnErimd9THEfHCxV+gCbK9FLPkzbOi/plrpj7q247/3dpP86D4PbrUKhQkyX8wUP2b24KqgdkI0BITG3EL9qkbgz4qttvZbAogHSgS5i88eBgxf+Y9pucRnabhFT+YuBNB90lDwoloU9Rj7KBHs1B/+8O5E7IJDN9SdWChl28jeIRjRv6PBPeizS+qLRFqkWeSXl4/C45A7E7E+gFMazzdA4S89O5de9NOsPML+vFWIH0l7dKMLbwshQ3UcgmgQefFOkz6thCVDpzYfu+zMsFgKLO/P7Fu0D+XFXmUwIy6wjwAkLe8qyw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=WgjqhY/y9KcMolxcdf9TxpwNWBFngWfAPqj8+TLyJWw=; b=LxEFUJMDZHs3YVXuXqwFmg9jWpervNDMuF7WwdKwm3287polq60L7yebwIJcHCXZI0R7qbueInkraUhRsaMPUT5YfUZO3AK8M1d1q/BrkASzsV1MFlm7vTdFcsDPKoi72+YoKOn+yRxmAhf9nGyjm0HmnAMAXXIR1DxLLvDxOTA/GNDY2V/LTHN96yUJGXgoeGCHBF8J26KoIpEg4bPUmnb/ckjIVYZFr06FHPfQGtkV9NUCyEFho3AM0ziogWEHKAkh6tTulDuSdpisA+aKLTWkVy8aoivDvydJ/ePNZxYaz3+51BAaVD0/P9KuQlDumUxgtSoC2SXSY2NOhfiO+w== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by MI9PR07MB375903.eurprd07.prod.outlook.com (2603:10a6:290:ad::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.496.21; Mon, 12 Oct 2026 10:59:32 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0496.020; Mon, 12 Oct 2026 10:59:32 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [wrynose][PATCH] libarchive: fix CVE-2026-15028 Thread-Topic: [wrynose][PATCH] libarchive: fix CVE-2026-15028 Thread-Index: AQHdWjjCgVCxfsKR902Xwafj1Qlebg== Date: Mon, 12 Oct 2026 10:59:31 +0000 Message-ID: <20261012105920.11004-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|MI9PR07MB375903:EE_ x-ms-office365-filtering-correlation-id: c63dae43-4315-4a5f-e938-08df284fe509 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|23010399003|1800799024|366016|376014|260925022911599003|260925021911599003|260925021311599003|10067099003|13003099007|261009223027099003|38070700021|11063799006|6133799003|12006099003|18002099003|56012099006; x-microsoft-antispam-message-info: c7B9b685KIJdiZR/ZHY7OKj97w2Jqxaqsm4OY9+APpibGUadB8ute8gjh3GAWGqZ+dVdAP5NMwQHSlknZoqrKveLpJLfu6cuBvO7f1YsPzHkeDiqMQPGVqwrSxlS4MfgGOhG1WQHtpHjUlnFviF3gz/5OKiwl/TmmNRkirMkEsfjfGwgfSvMMNJyBwKO7mIADuGDGR9pTF1hsXPf1uO4OKucPBplQi+TDiaojy8xUYxJnMnBlcjR7JvE3bzNpLPHPyTeJ8pFXRnT2y5TpIpd5D1qnQHiulvTpUfKtGfcIXtqRkJ18OjipPmMZG1dK+wI3cJdDNa6m9Q9O4ZU7MdbjSnl0p/K0yyR2poePVGjhLYfgXduas3uTUyh1jqm5rJVTn3BR5KpXo/EBYAo4qPdWWOQpd1A3a7wwsu21r/pE4nfAEODMd3FFFUHmG9DOF7Z1JIw+yixu3BxIJXhzvEeMyyVrXU9KXG2x0NEmikdcOK2zEQ7+VPiDSZmIFwLQ1FCt7w+xNYjZ8lO1QubYUwOcXr49pEcr+VUZSE3osHBlkzsqyriuLyqAK6i6AMWcbEJbyrdGgHQ7n4NlS6/AyAU/kNcALTGoJ47LzyAfY6mNogl52TRvtsA9sarclz0X6S1QeXjrswg1cvYz5YoE3WAoGe1BqzVJGnoGAsJ7Dv9t2Q= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(366016)(376014)(260925022911599003)(260925021911599003)(260925021311599003)(10067099003)(13003099007)(261009223027099003)(38070700021)(11063799006)(6133799003)(12006099003)(18002099003)(56012099006);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?q?A1XJfr1T+FWkDz/LNOcloMw?= =?iso-8859-1?q?OBw/v3b3l5S8z9XX/2wf/gnSrFEOT4768V+3j6sc4vr1qGr1FAJzM704MfXq?= =?iso-8859-1?q?ZV+qn01RR1hROUMh3iYeLbjiyZCH7wo+rUpwaR5g0rtpldN/Xd+W5Li1kkEU?= =?iso-8859-1?q?kgsdeH6RTVADN7VqwTcD8WBeNKEAdnHwlon13ce0OvFDT6mJVT/qRsgbz1fO?= =?iso-8859-1?q?WidDlw6zrLoI1SvtCjmoWo14VTCy9LaVwq0U4hOPlQwi8CF+CK73eYVOpUMb?= =?iso-8859-1?q?k5d2PwScn0w/IHa/M1P2is885vt5ceDxc23XsTwOsIpeXB9W4Tkb2Y3a/PbO?= =?iso-8859-1?q?9z4hsymLROxU803vP/mlIP+0eNs6KQnTsijh5asqDbBqD7C2G5/2XGyHyLKL?= =?iso-8859-1?q?GmXev4Zy+KcwT4UB4nP0L3+qi7a6ORzP7ILgUd7zFfHkRsLSs3HXNd6K4Qnf?= =?iso-8859-1?q?xSVheRt0UCK4sxP8FF39oyWm16+UkZ8SserXUPb+hMwVi2MIa/OR9tsrGwxv?= =?iso-8859-1?q?Njc/Hg4PVQI88sTt6ax+dS2724o5sqWsc4ozopHpzH52KMMkGF9ScJGWvUZ3?= =?iso-8859-1?q?OV1HiTqgPqHsUR5KajP7lJJt6xHYnFUX+xCc3FwVV4prrjUX73XMdDR4cX3s?= =?iso-8859-1?q?R93iag+eA9LgOyJqCwQfGDzaOb3egdIuf7efMdBhIP419Sc0c3Ugvqhw8Ftd?= =?iso-8859-1?q?ZM6tMLptwMyVJNUzVZ4iGDB8e3jKJCDnJsrJev2BzLeJT5DjBdONwVNJMGph?= =?iso-8859-1?q?s/MC2mKPD8Bpc78cod4p6DNzDqn/sDrypBqkOnpG1C/cscoDsidNOCh/K0A3?= =?iso-8859-1?q?s0+NCJkj9R8xlZDbgOau5PPZKaJXuhPGqrZ4eddzB2F6/u2PSW+/KWHd3Guj?= =?iso-8859-1?q?JiVJ2ImjFKLlEJ0aHoLduBe0TgYZ+UjtV/j5epgqnDJj9EbQpv8T4ltwxRvV?= =?iso-8859-1?q?+7kwoRwQsj8AoWRLMU/7L6dUdnCJothb/vkCDvnIjlYdD6q8Out0U6oEmBay?= =?iso-8859-1?q?5DgXE/1wdCKbczPijd1AfMiblIdz/xQ8k+e4I/bAHEc/5I+1Fy2WU53VSFNA?= =?iso-8859-1?q?O1p49i8rGAbLw1kv5jncRi9HBC2GxDJjb6WHboFr4nuYfuBXNJJfCHAow6XN?= =?iso-8859-1?q?IVcmIp2atK22HKl2eQey+rHA4EOyBQ/9fROlfYyvx+D8y64+M27yEeDg7MBx?= =?iso-8859-1?q?A6hR0HO4Okj4vFuViOpS1fJDcPmjCLXIhqlgEXLZD0FnlCzTotGrTBz1OzuM?= =?iso-8859-1?q?PSxOZE2vGz/weVoTHvoUcnQoDd7cIJHX7J2NYX68WJtWNKKChg+UkmMzHK41?= =?iso-8859-1?q?2uNC6OIO27HBTIY5z84tAoaz4NtH7hStle35E/MsdU6nolR7SGB9xFvbzjKq?= =?iso-8859-1?q?T/lxCcGS3kBEpbAE0vHZLiTzZBXoef6AuF2TOiNMAaXiPa3RFd/pBI+aw+uX?= =?iso-8859-1?q?OmHKkvohY8yGlfarqBoJYFT96W9P05fCLhAHajg6QweaIDIdVACIdPQHJny4?= =?iso-8859-1?q?NzPPL+RaHyD+2A+2q4vamdRoX9SYx3KArXi2zEFxFB9sYwxe8AWrTWjhAygg?= =?iso-8859-1?q?XIDtEYDckiyQrqTaqd1uTt1xQl+iilutd6PiQzr2IwDpvgHD/ixvFD1M6XvU?= =?iso-8859-1?q?9zCze0ZpXNHN5/ECioIgefw7bwx+G2hRCjANjIVt2KOh3gvKvu9pkMR1lf1a?= =?iso-8859-1?q?bOeDFFx4tG6rfR5Ejjq0M61dpEDuv8qdSEVYSEDg46TCVEtR8OZGiY//29o4?= =?iso-8859-1?q?S0WjvfnKPAEW7KRnLBAgxly6JeyRN8rDxFYvzUQpOwxqDcQ=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: c63dae43-4315-4a5f-e938-08df284fe509 X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Oct 2026 10:59:31.9814 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: e0ZoI63cr0xCTQcI+OZ5hI3Vj39t+/44YjXSfq0d2i3cN2P0CvpotCN+vdDBG3n3lmGQnLsdECYTjpKHJRDWhS4S8zvkZrIcDWeUh6lQSEI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: MI9PR07MB375903 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 10:59:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247632 Backport patch to fix CVE-2026-15028. References: https://nvd.nist.gov/vuln/detail/CVE-2026-15028 The link in NVD is wrong. Based on project own pull request: https://github.com/libarchive/libarchive/pull/3252 Fixing commit is the below one: https://github.com/libarchive/libarchive/commit/40b92de1def08e4fc319d55702785f82cedb7ef2 Signed-off-by: Jakub Szczudlo --- .../libarchive/CVE-2026-15028.patch | 41 +++++++++++++++++++ .../libarchive/libarchive_3.8.7.bb | 1 + 2 files changed, 42 insertions(+) create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch new file mode 100644 index 0000000000..c63fcf22f2 --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch @@ -0,0 +1,41 @@ +From 40b92de1def08e4fc319d55702785f82cedb7ef2 Mon Sep 17 00:00:00 2001 +From: datauwu +Date: Mon, 6 Jul 2026 21:51:15 +0800 +Subject: [PATCH] tar: fix 1-byte OOB read in SUN.holesdata parsing + +header_pax_extension() passes PAX attribute values without the trailing +newline to pax_attribute(). The SUN.holesdata parser read one byte past +the supplied value when the last numeric field ended at the value +boundary. + +Handle length == 0 before checking *e. + +CVE: CVE-2026-15028 +Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/40b92de1def08e4fc319d55702785f82cedb7ef2] +Signed-off-by: Jakub Szczudlo +--- + libarchive/archive_read_support_format_tar.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/libarchive/archive_read_support_format_tar.c b/libarchive/archive_read_support_format_tar.c +index e07cfdb63b..1c0441db6c 100644 +--- a/libarchive/archive_read_support_format_tar.c ++++ b/libarchive/archive_read_support_format_tar.c +@@ -3448,13 +3448,10 @@ pax_attribute_SUN_holesdata(struct archive_read *a, struct tar *tar, + return (ARCHIVE_FATAL); + tar->sparse_last->hole = hole; + } +- if (length == 0 || *e == '\n') { +- if (length == 0 && *e == '\n') { +- return (ARCHIVE_OK); +- } else { +- return (ARCHIVE_WARN); +- } +- } ++ if (length == 0) ++ return (ARCHIVE_OK); ++ if (*e == '\n') ++ return (ARCHIVE_WARN); + p = e + 1; + length--; + hole = hole == 0; diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb index afc06f85d4..d4cd0b5b01 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb @@ -31,6 +31,7 @@ EXTRA_OECONF += "--enable-largefile --without-iconv" SRC_URI = "https://libarchive.org/downloads/libarchive-${PV}.tar.gz \ file://run-ptest \ + file://CVE-2026-15028.patch \ " UPSTREAM_CHECK_URI = "https://www.libarchive.org/"