From patchwork Mon Nov 9 22:55:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 103538 Received: from mta-64-225.siemens.flowmailer.net (mta-64-225.siemens.flowmailer.net [185.136.64.225]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7941.1794264992269815903 for ; Mon, 09 Nov 2026 14:56:32 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=JL4vSPmz; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.225, mailfrom: fm-256628-2026110922563028b1114f4f000207bf-igndtr@rts-flowmailer.siemens.com) Received: by mta-64-225.siemens.flowmailer.net with ESMTPSA id 2026110922563028b1114f4f000207bf for ; Mon, 09 Nov 2026 23:56:30 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=+aKXSj758wpNIvHd6u+EAX8kuXKM162NxeLDopvBfCw=; b=JL4vSPmzmlutCwJF44P0TDF9GRN0A2E4SNpAmFdkyy7OH9ybtpeCTm4eQIRIvUp7PdmdNY tgvcQwS6TxmppjjYZJCbUzNq25hOvpcbtUj4kwx+tBzrcG6zwV1a9Hyu63CKqbI5EKHRGHOU s84aZtizmthR/YUAiT2/Do+RsmpPuv4/TwjaXuSGmjNoRJxs4gD3BItknyT14BtcS7UswoxL C+4kUNnlQVZt/QoSt5TfA7BSktPDGLG+7LfHCrxjCjFTkNN11ideLWuGugiZLfCYH5zJPWUc Z4cG46UlCvU6Tw27N9U0qTQRMT2GwmM7HAejLaJ713HGf1n82UuKKd5Q==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [scarthgap][PATCH v2 2/2] dropbear: patch CVE-2026-35385 Date: Mon, 9 Nov 2026 23:55:17 +0100 Message-ID: <20261109225517.1220998-2-peter.marko@siemens.com> In-Reply-To: <20261109225517.1220998-1-peter.marko@siemens.com> References: <20261109225517.1220998-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Mon, 09 Nov 2026 22:56:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249882 From: Peter Marko Pick patch referencing this CVE from 2026.90 release. Signed-off-by: Peter Marko --- .../dropbear/dropbear/CVE-2026-35385.patch | 42 +++++++++++++++++++ .../recipes-core/dropbear/dropbear_2022.83.bb | 1 + 2 files changed, 43 insertions(+) create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch diff --git a/meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch b/meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch new file mode 100644 index 00000000000..773ed196107 --- /dev/null +++ b/meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch @@ -0,0 +1,42 @@ +From 443ccc1fd1b9a4e3747f6b5cd644b7af49064308 Mon Sep 17 00:00:00 2001 +From: Matt Johnston +Date: Sat, 2 May 2026 08:17:25 +0800 +Subject: [PATCH] scp: clear setuid/setgid bits on received files + +From openssh-portable 487e8ac146f7d6616f65c125d5edb210519b833a +Tracked as CVE-2026-35385 + +upstream: when downloading files as root in legacy (-O) mode and + +without the -p (preserve modes) flag set, clear setuid/setgid bits from +downloaded files as one might expect. + +AFAIK this bug dates back to the original Berkeley rcp program. + +Reported by Christos Papakonstantinou of Cantina and Spearbit. + +OpenBSD-Commit-ID: 49e902fca8dd933a92a9b547ab31f63e86729fa1 + +CVE: CVE-2026-35385 +Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/443ccc1fd1b9a4e3747f6b5cd644b7af49064308] +Signed-off-by: Peter Marko +--- + scp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/scp.c b/scp.c +index 09297a5b..79b0a12d 100644 +--- a/scp.c ++++ b/scp.c +@@ -1114,8 +1114,10 @@ sink(int argc, char **argv, const char *src) + + setimes = targisdir = 0; + mask = umask(0); +- if (!pflag) ++ if (!pflag) { ++ mask |= 07000; + (void) umask(mask); ++ } + if (argc != 1) { + run_err("ambiguous target"); + exit(1); diff --git a/meta/recipes-core/dropbear/dropbear_2022.83.bb b/meta/recipes-core/dropbear/dropbear_2022.83.bb index d06bbd3a6db..65dfddbca72 100644 --- a/meta/recipes-core/dropbear/dropbear_2022.83.bb +++ b/meta/recipes-core/dropbear/dropbear_2022.83.bb @@ -34,6 +34,7 @@ SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \ file://CVE-2019-6111-03.patch \ file://CVE-2019-6111-04.patch \ file://CVE-2019-6111-05.patch \ + file://CVE-2026-35385.patch \ " SRC_URI[sha256sum] = "bc5a121ffbc94b5171ad5ebe01be42746d50aa797c9549a4639894a16749443b"