From patchwork Mon Oct 12 11:01:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jakub Szczudlo X-Patchwork-Id: 100438 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 85921CA9ED1 for ; Mon, 12 Oct 2026 11:01:18 +0000 (UTC) Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.61]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.10771.1791802872466048170 for ; Mon, 12 Oct 2026 04:01:12 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=FbL7PVj+; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 40.107.159.61, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=WAfxDzm73WMusK1zf30D1jHuWIIglFvYNsbt9mBJTUwYQZ+ASYkUWohvPl08MUkG03J/p1XXTBncZG4fZGY01J8S+DM5eMUPNxMC8aIsBHu337qu7JNySFuuKnaPN14cT6bm/uVVdD+42XuaNdAHCDB2oegzX9nMj5DE/P06XQB68lXLNVGtBaVEyUpO6fwo4SXyItlMlms3Qjl4XXx6itkmYpNVOhlDBnfs5qeXkZcbXZ0lteXWZ8sRO2dW+3FaDdtzhzSRxl2ynJyHSFPqn8mhtvi6upjdeByFtDokSTKRI6RrCqyrw/6uLeOZebB3Tini4VJY0zUND1iQGdCdNw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Sk81kpCPYscRAWIFSu0n2FovNraCqcYGvquzvICEI3s=; b=uo25KKxXpystGpjv9O2eAPbEoSyLBiYj6rgqyy7hyDoYbaJ6w7iS8RHk3lKxBz+LUDolPn5LZHhNdMxDIEnGqzUOe29Tj1KiCrU3i/SbcQyXBBWkjVclBimPd2NxLawqs2wmFO0UXaPf9GqtOUZJkLyc2pVm258LgeBHrEvaR9M2X/N8/tFxvhyLZv4eCos4IRkJUbdxIYhOb9lSpxTcdskxbD+QSHmLb06zZRrrahvemVKFPKbKvgDPvSWUHKwKu5TL/ZwfVTneiauEqr4J0rcTy7/rn4UU+AddEjo2ZRXvqFY6lFl7d6sRpMus0uPSim8C+E8byLT6XxyBKWQhPQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Sk81kpCPYscRAWIFSu0n2FovNraCqcYGvquzvICEI3s=; b=FbL7PVj+3tXhNux+e0JQx19mJ4ilBZgsi+ahp3nXkhgX39dJCmn1HiXkK4la4PhuGqIIpj72LBO7gs7zXbDYuaw4Wd+gpyQimbNqj3UWlMvukKA1obdrwpqKpvWHQdiFdrSe/NeErtOwHk4y4UmxDSh54XoD7tsDMJLxb0LDcrY9kj+gEEq+ObNq/I/uptKVQV7GWwarttCkKJSdIRCYs5G6z1JQWiQHVhXbGQ3e7W5uc746q+AExggYI1bqI1c4Va69smQxlM3IuNZ+ddfFm9Kd1tZPvbAR2JhWCBBnkTHrjvOkeoKq5j7BTfWCsCy+Ue14pcbjTR2Qbq7fbwIUnw== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by MI9PR07MB375903.eurprd07.prod.outlook.com (2603:10a6:290:ad::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.496.21; Mon, 12 Oct 2026 11:01:07 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0496.020; Mon, 12 Oct 2026 11:01:07 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [scarthgap][PATCH v2] libarchive: fix CVE-2026-15028 Thread-Topic: [scarthgap][PATCH v2] libarchive: fix CVE-2026-15028 Thread-Index: AQHdWjj7VYn/8AL+Hkuzu9ZVGQuWYg== Date: Mon, 12 Oct 2026 11:01:07 +0000 Message-ID: <20261012110103.11458-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|MI9PR07MB375903:EE_ x-ms-office365-filtering-correlation-id: 5960fc64-aea2-493b-07e0-08df28501e17 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|23010399003|1800799024|366016|376014|260925022911599003|260925021911599003|260925021311599003|10067099003|13003099007|261009223027099003|38070700021|11063799006|6133799003|12006099003|18002099003|56012099006; x-microsoft-antispam-message-info: HPTfRB40PB2N7yOA+puU52f3M25H3pYS+6nNBC1PPsOBX4BxU4T8kJg7ThexMU9u1R/CNCui+bjVPJqED/82v53SmNdsrJ2ao+Dg6WUTX0KKu0wWXbOG03XESFHeMNUOIFSdYKo5DibD5f59y/HSqMLyJNB2IrPyoxE6Hm8+5y60BT4h4wO6wBDxqajAt2UPy7QZvfw2jDUqAeLYl0BZLhGL8v7XVzlqapPEQld/9Ps2dA7vrlHcRNSA5tpYJSNI7cvN0/+p89xrNDrsrAE9IdS0oSVsWjS3F5cTsJhKdrxQZI85wJmtxn4VbEqxmXKsr/uloyi/YAtrrA7Z+PJNeOoqt/388pfcRcJ/PLb0tQLCDeaDIGun2++O4PjYv2fnt3Y+B6XEPAlt/eA60rdKoVhpN4CbsQjxOoGjlEIpliRq66iupsO6DjSY06cSJFh1PkMMrs8nlCzmgZ4WVyH9mrtLElLW1OJJILUy12WDDHTJbM+9spANeEviUB0wFYFz2gDdThew+4D9UTUm8R1zUigjqTlOBdZEWOIjU5CBatYaoYPfBo0mliIr9HOOhxM3vPt/L1Q7/4H/2F8vim1BhbttruXiC/tQIxPA7GeHTKSHrhbjeBMWTm9CKX8RX3r0E+2wwiKH5u9gU5WxgMxBZS56SGG9+rJnQHbV2XNXujQ= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(366016)(376014)(260925022911599003)(260925021911599003)(260925021311599003)(10067099003)(13003099007)(261009223027099003)(38070700021)(11063799006)(6133799003)(12006099003)(18002099003)(56012099006);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?q?Y8dPaFByCVNKfNfPz2+hpwP?= =?iso-8859-1?q?pqdSX/5eix4YZZxFbRCVwBryb9HLz/ioM7YvYiZT4cmALq6hyD6DHkwh4k91?= =?iso-8859-1?q?Gh+a01ULeLMbLlwXRY7uLIGNbE7fsUMGgCRYTh73VDLVMjnDXtuhjW8aRhCl?= =?iso-8859-1?q?H/bZEVmaM5ru4ktXY2chbjFSigNPziF2HNyNHAtgfBwsEQzsB+beeI8eApkB?= =?iso-8859-1?q?oHLhapMz/QQpadSZ+n5xznQRMk7Tc5VgIltIoSVyO6XKSlgJVcJEGCJqQhSj?= =?iso-8859-1?q?cDmSOvKhfuIQgrvHY377vdEYgnH2ospr8ktjxFbrWzNeW5iZCbDkrl3d45Bl?= =?iso-8859-1?q?i33fGWzKgI+8e326+pukEiaEzaAcvM4lMmFkF8tvHueyEMLNqD+jZSD0ZDfu?= =?iso-8859-1?q?Q57m1G0uEbYgnJ0e1b8nWYyvfF/QNTyB3HmTSBKhdwrxIIOWkQvAqyDLpdDZ?= =?iso-8859-1?q?/LTNuCQ1cmEagJfHze/GqaILaw0YNfg02uuOMdKTjL0jjc0LQgp9zXsdPXe1?= =?iso-8859-1?q?v1QT9eDoP4swayuQtniW7M2w9PMDBeiPikgntjeu0AP1E9l5ZGb80IofkU4V?= =?iso-8859-1?q?1VEj+fguxww/9FEIl5lVUQR56qv5tETrV1xMzOvgLyxQdyTpH8ulwu5czcbX?= =?iso-8859-1?q?8E0fQgqMgQX5jKKIGuKlNqxjmkrlZ6BBXQjJAnw9uCK5ZhkBr7JTjVMVmApP?= =?iso-8859-1?q?58QFIgbO7+pcnD3Q5Oq04FhNuACVltzhxNWGtOybBojj3rmA0Vrd+Bkaph6o?= =?iso-8859-1?q?kSOWNnEWwNc4eMHWQLSEmgwlUx99cTmP9INx2gQgpt+C/GS9bxXcd9A3GY1V?= =?iso-8859-1?q?qRH2aAYvKFzokZN6c3ScjSiZcwQK5u8P9kWv+AfcTa4GW0qVKu/l5IJef/J5?= =?iso-8859-1?q?X8I87X6tCErFKk404bcQuV8JZ0mlkil4HVRi3ODjqjwqsw87QdAtRnQ7ne7S?= =?iso-8859-1?q?pKoKLRgpP3xIlgfc10f96xCuc4DWJhABGa2HgkAmFGWoQ8KRrtguqwXPiY0B?= =?iso-8859-1?q?yjgDGTdcVOz5Kb6MnO8WsQfOqq6nelC0hSWKaeTfOdsfIx0tLN1TAekOjZR2?= =?iso-8859-1?q?u6P8dgiMwpeuGdezIEUEnnpUf7Ffb1l900O/F6c4Ae5kDW2UHCfnuCZ1oqah?= =?iso-8859-1?q?n54vwLfeoeq3NG/+jQ2b0ynjf6PH39iJZvhCnMhbPXg+JwKsigwnHgDjbpgk?= =?iso-8859-1?q?t7n6baA1t3WYE025GdY5hpt6szcwqi6Tb2atp12qg+Jo72IEOT31w2b5jrIQ?= =?iso-8859-1?q?rFgiJfauJvNNuiJ5a/RNc8l5Igi0EMNxKSxgOEHKqo89Ml9xY36eQOPBvmW8?= =?iso-8859-1?q?E3s7Bc0N+KXPz0U9mb26XAiTi4eRsdpDyy07z0pl7FzrP1kccBBajUWjIetA?= =?iso-8859-1?q?/Obdbge64OJ5padvgm7FUrYEVWNtub14he5SLs9U36uI/fWyu64PJX8BIOv8?= =?iso-8859-1?q?IQrycHavhTClwFgpscaV5Snz5SzMbMmsol2tGTpfI+3OiFgrnOivBVuekQsT?= =?iso-8859-1?q?T3RyBedES2KHXVIP57wqYWAO0hWimgL6YC5Q6CrGEJ24dIlg87bBgBHN3Pke?= =?iso-8859-1?q?W5ofg3aWjeDDepEXYpaqwLHZVxB+N5VsjufYbxOAP6W7vnBVLjt4xQC4OIHS?= =?iso-8859-1?q?6Q9ShiRX7KxTP1sX/6VdPsMGS9CS4+DmJqgYLSyba8Mn4fUFSeNLyOmdRjmr?= =?iso-8859-1?q?BjkVL6S+xFkX0X4GCJotNlXt8zWhMOU19DTQ4ZGECNd/YGVt5kNhdgFlBZmJ?= =?iso-8859-1?q?StNC488OnEvNyEyrPrUbvUNRpR4yYysThmYI+0N3wz/e4og=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5960fc64-aea2-493b-07e0-08df28501e17 X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Oct 2026 11:01:07.6612 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: O2bYmZrsf9P42JRwrRhLJtfCKZ3XphECw3kTcQQTRv70DhIHMir2JnXx1gdyLAsnQNoN+SCaQXkcqbriOLgz/PuFUgKyANxmq/X9/0BpwlA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: MI9PR07MB375903 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 11:01:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247634 Backport patch to fix CVE-2026-15028. References: https://nvd.nist.gov/vuln/detail/CVE-2026-15028 The link in NVD is wrong. Based on project own pull request: https://github.com/libarchive/libarchive/pull/3252 Fixing commit is the below one: https://github.com/libarchive/libarchive/commit/40b92de1def08e4fc319d55702785f82cedb7ef2 Signed-off-by: Jakub Szczudlo --- .../libarchive/CVE-2026-15028.patch | 41 +++++++++++++++++++ .../libarchive/libarchive_3.7.9.bb | 1 + 2 files changed, 42 insertions(+) create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch new file mode 100644 index 0000000000..c63fcf22f2 --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch @@ -0,0 +1,41 @@ +From 40b92de1def08e4fc319d55702785f82cedb7ef2 Mon Sep 17 00:00:00 2001 +From: datauwu +Date: Mon, 6 Jul 2026 21:51:15 +0800 +Subject: [PATCH] tar: fix 1-byte OOB read in SUN.holesdata parsing + +header_pax_extension() passes PAX attribute values without the trailing +newline to pax_attribute(). The SUN.holesdata parser read one byte past +the supplied value when the last numeric field ended at the value +boundary. + +Handle length == 0 before checking *e. + +CVE: CVE-2026-15028 +Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/40b92de1def08e4fc319d55702785f82cedb7ef2] +Signed-off-by: Jakub Szczudlo +--- + libarchive/archive_read_support_format_tar.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/libarchive/archive_read_support_format_tar.c b/libarchive/archive_read_support_format_tar.c +index e07cfdb63b..1c0441db6c 100644 +--- a/libarchive/archive_read_support_format_tar.c ++++ b/libarchive/archive_read_support_format_tar.c +@@ -3448,13 +3448,10 @@ pax_attribute_SUN_holesdata(struct archive_read *a, struct tar *tar, + return (ARCHIVE_FATAL); + tar->sparse_last->hole = hole; + } +- if (length == 0 || *e == '\n') { +- if (length == 0 && *e == '\n') { +- return (ARCHIVE_OK); +- } else { +- return (ARCHIVE_WARN); +- } +- } ++ if (length == 0) ++ return (ARCHIVE_OK); ++ if (*e == '\n') ++ return (ARCHIVE_WARN); + p = e + 1; + length--; + hole = hole == 0; diff --git a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb index 2eb22e2d61..3719965eed 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb @@ -51,6 +51,7 @@ SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \ file://CVE-2026-4424-2.patch \ file://CVE-2026-5121-02.patch \ file://CVE-2026-5745.patch \ + file://CVE-2026-15028.patch \ " UPSTREAM_CHECK_URI = "http://libarchive.org/"