From patchwork Mon Oct 12 11:00:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jakub Szczudlo X-Patchwork-Id: 100437 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A10C6CA9ED0 for ; Mon, 12 Oct 2026 11:00:58 +0000 (UTC) Received: from AM0PR83CU005.outbound.protection.outlook.com (AM0PR83CU005.outbound.protection.outlook.com [52.101.69.67]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10907.1791802848104261225 for ; Mon, 12 Oct 2026 04:00:48 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=kw1D1MOo; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 52.101.69.67, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=WSW1d0xiyt95VgxvR2HlSlnKRahoaF85fotHArVEBSMAIUDDe97VOXRKaoNBdPsG3fzqvyJQEUYLsHRIvboL8Cf68KzhwmW01dRwf8DUGHbv4cSSqdL7z+QaiAEowCo2AFAyC060OtTlXrrpToHSNiXLVAE8aEhx9bKyOx01dBCEhd5qOLVAna159lh4T0vhaGtbgdeIZBa7ze9cKEX+Moa/ZfBgLYbz2FrykGBqX7y4exVWOhyDLQuGOln0gg1WzlSfVJKM/nnSgCEOsBAufi5abDCFo251WPdsVIdb9joqFn75hhSRQ7sg502YB1ZNhUJmcgScHHo8rf2vo/vLAg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=WgjqhY/y9KcMolxcdf9TxpwNWBFngWfAPqj8+TLyJWw=; b=G0GJZcjx7Xfg8rbcXVrjPZJ3bUW7+vIVdy2GlPog3/09PVG39CkuLoNPrdHxnehAfxHJhFWIwI92Ky5f4+LYOt4VLDgfn36+7n9B8VHxThkW3MyrSjnb9ctDSjn8rZYGRmknw/mimDoka4GgAAEjkrdbtGXtDRfqDfCPqvDwEoSp1AaWoQGKlYjwFgJJ+SzJlLsDXO5/auT7ZAnPa2JqOzbsE20yGraI5D4zVVtqcamn2TdACGufWERXNRFNEHw5u4lEkUrJw6CdY5/zvJtVnTh0eSa0fdbONdl1GbMZXd9WddhTHk6r4MifthwmG9Fh3opD/q8zEwRFt65agqVKoQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=WgjqhY/y9KcMolxcdf9TxpwNWBFngWfAPqj8+TLyJWw=; b=kw1D1MOoTFMwj95vjfC46SpYPj6C+wncQ4MTbq9s6eQd4laGoUaennNGPY6hHPuB0eXTNjiSkY3w+vMY5iVgY2NMtbbWBdFCm/i6Z5vq4Uqj/Nd8rpnArExhYBeDK0/n9UnRRSLBkhbQ8U5g3rrXECPCYcruV1Mlpker5DUDkyPiqTujL2zEj3UvAxVJRsWyc//qHiwnlrPGvPGppySdihDHr8sncQfZM28yOSIWEueiBiwR+mwl+QzgMBjek7HYdIBxIvMGIsFwey3+Jn4d2XWk3SGbd89IZaQ22H2sjXYs336Ah3d9jvz34TAJknPkaS2uMWy+FHvkFtcuq1MGcw== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by MI9PR07MB375903.eurprd07.prod.outlook.com (2603:10a6:290:ad::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.496.21; Mon, 12 Oct 2026 11:00:45 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0496.020; Mon, 12 Oct 2026 11:00:45 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [wrynose][PATCH v2] libarchive: fix CVE-2026-15028 Thread-Topic: [wrynose][PATCH v2] libarchive: fix CVE-2026-15028 Thread-Index: AQHdWjjuUXq5SI1yQUOa3FsvUPUiHQ== Date: Mon, 12 Oct 2026 11:00:45 +0000 Message-ID: <20261012110033.11294-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|MI9PR07MB375903:EE_ x-ms-office365-filtering-correlation-id: 07fe71ba-d6d4-43a8-8b9f-08df285010b7 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|23010399003|1800799024|366016|376014|260925022911599003|260925021911599003|260925021311599003|10067099003|13003099007|261009223027099003|38070700021|11063799006|6133799003|12006099003|18002099003|56012099006; x-microsoft-antispam-message-info: CCHD04elXyZPLCfSiZ9GHh9MBNc/LLURQrgt5tyix6e6VH00MQu4vha5SxS5XdRh9r9JJtZfom2Z3IN2SbF9/FQRDiwKRKG8hglE6AAbM4oc8IfL/XiQrFOMYZG+tQGZx+frgQ2WGn4AoIpDGM2POfTruoAYcgzwz8hLAZXaozUiTogKMiwuWMOkRvYSVydaT/24l4/w7CFx/c43QOLIp9FnAhuqw2HuBlFnJ9F2Zl8kupQ9q0UksscKDiCnQ3qhtm3rvTGVKrnsJNB533u+0EobxHFL7ftCGYXKBxgAvNsb/H1Y/ILJFVALYVZ7SpmHHuOy3qcsipuWpKRxsAb/Pu08Y6z3gJwkCaz698LsJ/UNivneQpXrcaBlOxXSzJWeKlNv90OZcLSrFpPfH2JEWCYYmLa+QUUyGx6YTNPHp/awZA+yQUJoci3+qCnSx/Ri6dwNRYTep+BP8RrCqisxhM7Ax0dypf/AVU8nuKcikDCKw2xmqwdhOTNdPI9EmO1pc+biP+yTLVi161tPnzmSUBqV3/SrupNPIrFG1KP20mzp4OBQ2ARcwoEij3Hlb5Fg8VouEispRWz/1yliD6M0vwplY6r0tnwfkaGwnR8DHVcXD7c3YT71bvMcro592RWXUBLc6QzELBqnJ3AVfOjV/BtoRv0E0emxiJtLuxMq0H8= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(366016)(376014)(260925022911599003)(260925021911599003)(260925021311599003)(10067099003)(13003099007)(261009223027099003)(38070700021)(11063799006)(6133799003)(12006099003)(18002099003)(56012099006);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?q?tRBKGybAq6/QQPIrCGihUSc?= =?iso-8859-1?q?tNA30exYuhBiA6aAcZlos1WSjzzEwfrVCJWyNcaHSNuVZX23ySsV/+9loW12?= =?iso-8859-1?q?/B8ao9AmCdJ7gPEFCbmeY1/vNlDN82murAiKN696F4/x4JcKGEuaaksMzp5g?= =?iso-8859-1?q?Mprp63DYFrsEmvZU69kSRJLcMOOwVr8F5lQ93CwByzngLH8OMf0tMjZOqcnr?= =?iso-8859-1?q?J1ENHmB9xN9/dPn6p9iWMoeeaSChP69KFHf8sIRTaw5DQmkVeAbC8dc+srXt?= =?iso-8859-1?q?CMrFK6JKMh2vA2PR4HKrkQRWw35wDNE2rZheBXi2Sj5FPSqkka3thVrjgCyK?= =?iso-8859-1?q?1f/C0EvNHcl3GitEcJ0sS70dsft4X1PdomH5a5/ZaeMZjTxYBFJFa3hkg4Lk?= =?iso-8859-1?q?qDKjYid1273cV29Z7GOW88mu1r10rFgdDfok5oiKr8JwmJamIPfLjVuS+USw?= =?iso-8859-1?q?cw+p2/wk4f7aErYu+tZDPhqUXSNg3UqxgvSXZe4ZP1Bw/chbW9nU5a5fqJ6z?= =?iso-8859-1?q?ebt67m3NeL5KLpGNfSQLtZmLa/hJi4+/jpbql4RcFFe3husc5Y8mteUet9U2?= =?iso-8859-1?q?9O5rMR00bMstplEX70rORm96slcbeWIQ/qSLNr3w6R4omzByG5ekNzTdCT7U?= =?iso-8859-1?q?KrQVEmdy5AVj+8l83GUbTdgqeqAVqbOq9a8ue14C3n9MKAn+RysMvERVTcoD?= =?iso-8859-1?q?gU4Zlgn737wapVxapaZ9lfa7NppkQ7s/K30bi5h/xOVVpsXswFPyzrsumk0+?= =?iso-8859-1?q?gZrh7IQ1CShXUDpadJ6q16WikeZNByVlrPty3bcUL0Y/+rKitzFSX6KPr3nl?= =?iso-8859-1?q?yOLjvESkuVuyxEZufRpB0m6SIBxpVrKl1MGjlB4jprSLwwabQKb0Yr6UVLIs?= =?iso-8859-1?q?v2I8y1Y2giE+BsS2yZp7Uu1xZYEfQpaDMtpFdS2RG2I5mXMWgqUnIKT+NZdd?= =?iso-8859-1?q?Uj6wgw2NxIXwpjpeuWtnY+57ES2P7bpE4VeMLIG+vXsTnBNCBaho7zs6v8O0?= =?iso-8859-1?q?OZ1dnyUJEW7fZQmxPGNgMSmo7VDXfMZ5DcILWJj68RMQW6BXnvkzvEwEgMmG?= =?iso-8859-1?q?7ioS+1p4ZhgvBCYVV67p5cw6wHXdQ52GMyALm97fKT7NRn+WKWNvQjL9Ysua?= =?iso-8859-1?q?2IDuSk0h0JQEu5wz4DxGM6mli11t1amvB0JmdV6YQXwMrXTTTirZeRkHPhd7?= =?iso-8859-1?q?V7V2aTnFA7xeRqdjNORGfA0En19PtIS63AT6lu17H8d3kesJSmkLsND9LHAR?= =?iso-8859-1?q?/Zfh8XiomWVXK3I0E801IZcZbSjs3SvDVp1esRTgx9knKMd7mnYYWlSVAxQ7?= =?iso-8859-1?q?OSffwMeS4xcz6esIl/9338nifqgZOKzOoC5sphBDl3nWwPYvRbClx/lAKgVa?= =?iso-8859-1?q?2Q5W1QlfkfQ+4Gpr4N6ennngvE7xn2nQHUxXKRzPP8XNZejjKipC06BSbhJl?= =?iso-8859-1?q?GLJqtOyl6oH36us3ek9PPQVHhDXYr+BEQsJZN2vGOntEZ2DhLZJEGGorkON+?= =?iso-8859-1?q?GqmxKOM74bbJn6NC0dHIUAn4jDigL8hvykL43WVmlD2luG475BKcMliLN3n5?= =?iso-8859-1?q?Qh9s6G5WQWP7Wz+MUH0A0WJmUdeL33uyyAwfYLrH3PYZp1mpg7YW8mYuVH4J?= =?iso-8859-1?q?vUkMGrxIpCuTaibFRzHUPI6nuBY7Pio8v8uzvPL1jVIpQn9f/W9cfLj4zk6e?= =?iso-8859-1?q?rG5BBgA9bQRTcv8/Vki0f9/yUlNzmeOIOolTWhLyrFBQ6kYr5SiKDF8CnulJ?= =?iso-8859-1?q?07bOKIRb3NpXSEvi5hfJ6hANk6UHMhZGqiJn6Mp5Ydax04A=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 07fe71ba-d6d4-43a8-8b9f-08df285010b7 X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Oct 2026 11:00:45.2658 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: zZQ9KPwhGwVHVRWF4qUZ1JnXegswK0bYjcQOSGu/PThdtlR0RS2YFKR/FWaoWwRS2gEWo+cJ9iFkM7vFmoM1uShz3T/j0Vil6c7Cgi9DoPo= X-MS-Exchange-Transport-CrossTenantHeadersStamped: MI9PR07MB375903 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 11:00:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247633 Backport patch to fix CVE-2026-15028. References: https://nvd.nist.gov/vuln/detail/CVE-2026-15028 The link in NVD is wrong. Based on project own pull request: https://github.com/libarchive/libarchive/pull/3252 Fixing commit is the below one: https://github.com/libarchive/libarchive/commit/40b92de1def08e4fc319d55702785f82cedb7ef2 Signed-off-by: Jakub Szczudlo --- .../libarchive/CVE-2026-15028.patch | 41 +++++++++++++++++++ .../libarchive/libarchive_3.8.7.bb | 1 + 2 files changed, 42 insertions(+) create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch new file mode 100644 index 0000000000..c63fcf22f2 --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch @@ -0,0 +1,41 @@ +From 40b92de1def08e4fc319d55702785f82cedb7ef2 Mon Sep 17 00:00:00 2001 +From: datauwu +Date: Mon, 6 Jul 2026 21:51:15 +0800 +Subject: [PATCH] tar: fix 1-byte OOB read in SUN.holesdata parsing + +header_pax_extension() passes PAX attribute values without the trailing +newline to pax_attribute(). The SUN.holesdata parser read one byte past +the supplied value when the last numeric field ended at the value +boundary. + +Handle length == 0 before checking *e. + +CVE: CVE-2026-15028 +Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/40b92de1def08e4fc319d55702785f82cedb7ef2] +Signed-off-by: Jakub Szczudlo +--- + libarchive/archive_read_support_format_tar.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/libarchive/archive_read_support_format_tar.c b/libarchive/archive_read_support_format_tar.c +index e07cfdb63b..1c0441db6c 100644 +--- a/libarchive/archive_read_support_format_tar.c ++++ b/libarchive/archive_read_support_format_tar.c +@@ -3448,13 +3448,10 @@ pax_attribute_SUN_holesdata(struct archive_read *a, struct tar *tar, + return (ARCHIVE_FATAL); + tar->sparse_last->hole = hole; + } +- if (length == 0 || *e == '\n') { +- if (length == 0 && *e == '\n') { +- return (ARCHIVE_OK); +- } else { +- return (ARCHIVE_WARN); +- } +- } ++ if (length == 0) ++ return (ARCHIVE_OK); ++ if (*e == '\n') ++ return (ARCHIVE_WARN); + p = e + 1; + length--; + hole = hole == 0; diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb index afc06f85d4..d4cd0b5b01 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb @@ -31,6 +31,7 @@ EXTRA_OECONF += "--enable-largefile --without-iconv" SRC_URI = "https://libarchive.org/downloads/libarchive-${PV}.tar.gz \ file://run-ptest \ + file://CVE-2026-15028.patch \ " UPSTREAM_CHECK_URI = "https://www.libarchive.org/"