diff --git a/meta-oe/recipes-extended/polkit/files/CVE-2026-4897-01.patch b/meta-oe/recipes-extended/polkit/files/CVE-2026-4897-01.patch new file mode 100644 index 0000000000..96548ca771 --- /dev/null +++ b/meta-oe/recipes-extended/polkit/files/CVE-2026-4897-01.patch @@ -0,0 +1,64 @@ +From 7e122c8a5120c2aae2d9d44a26796dc18f5b677c Mon Sep 17 00:00:00 2001 +From: Jan Rybar +Date: Fri, 27 Mar 2026 15:57:01 +0100 +Subject: [PATCH] CVE-2026-4897 - getline() string overflow + +Report and fix by Aisle.com +Pavel Kohout, Aisle Research + +Signed-off-by: Jan Rybar jrybar@redhat.com + +CVE: CVE-2026-4897 +Upstream-Status: Backport [https://github.com/polkit-org/polkit/commit/7e122c8a5120c2aae2d9d44a26796dc18f5b677c] +Signed-off-by: Peter Marko +--- + src/polkitagent/polkitagenthelperprivate.c | 23 +++++++++++++--------- + 1 file changed, 14 insertions(+), 9 deletions(-) + +diff --git a/src/polkitagent/polkitagenthelperprivate.c b/src/polkitagent/polkitagenthelperprivate.c +index 35bca85..7e4f94e 100644 +--- a/src/polkitagent/polkitagenthelperprivate.c ++++ b/src/polkitagent/polkitagenthelperprivate.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #include + + #ifndef HAVE_CLEARENV +@@ -59,21 +60,25 @@ read_cookie (int argc, char **argv) + return strdup (argv[2]); + else + { +- char *ret = NULL; +- size_t n = 0; +- ssize_t r = getline (&ret, &n, stdin); +- if (r == -1) ++ #define POLKIT_AGENT_MAX_COOKIE 4096 ++ char buf[POLKIT_AGENT_MAX_COOKIE + 2]; /* +1 for newline, +1 for NUL */ ++ if (fgets (buf, sizeof(buf), stdin) == NULL) + { + if (!feof (stdin)) +- perror ("getline"); +- free (ret); ++ perror ("fgets"); + return NULL; + } +- else ++ if (buf[strlen (buf) - 1] != '\n') + { +- g_strchomp (ret); +- return ret; ++ /* Cookie too long - drain remaining input and reject */ ++ int c; ++ while ((c = getchar ()) != '\n' && c != EOF) ++ ; ++ errno = EOVERFLOW; ++ return NULL; + } ++ g_strchomp (buf); ++ return strdup (buf); + } + } + diff --git a/meta-oe/recipes-extended/polkit/files/CVE-2026-4897-02.patch b/meta-oe/recipes-extended/polkit/files/CVE-2026-4897-02.patch new file mode 100644 index 0000000000..c47eee2014 --- /dev/null +++ b/meta-oe/recipes-extended/polkit/files/CVE-2026-4897-02.patch @@ -0,0 +1,32 @@ +From 39601309eb3e5e88a1c1fbda9a272ba8691f1bf3 Mon Sep 17 00:00:00 2001 +From: Jan Rybar +Date: Wed, 13 May 2026 14:58:32 +0200 +Subject: [PATCH] Draining loop can keep polkit busy + +The draining loop is not really appropriate for pipe input, especially +in a daemon. + +Co-authored-by: Frantisek Sumsal + +CVE: CVE-2026-4897 +Upstream-Status: Backport [https://github.com/polkit-org/polkit/commit/39601309eb3e5e88a1c1fbda9a272ba8691f1bf3] +Signed-off-by: Peter Marko +--- + src/polkitagent/polkitagenthelperprivate.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/src/polkitagent/polkitagenthelperprivate.c b/src/polkitagent/polkitagenthelperprivate.c +index 7e4f94e..c0a9825 100644 +--- a/src/polkitagent/polkitagenthelperprivate.c ++++ b/src/polkitagent/polkitagenthelperprivate.c +@@ -70,10 +70,6 @@ read_cookie (int argc, char **argv) + } + if (buf[strlen (buf) - 1] != '\n') + { +- /* Cookie too long - drain remaining input and reject */ +- int c; +- while ((c = getchar ()) != '\n' && c != EOF) +- ; + errno = EOVERFLOW; + return NULL; + } diff --git a/meta-oe/recipes-extended/polkit/files/CVE-2026-85498.patch b/meta-oe/recipes-extended/polkit/files/CVE-2026-85498.patch new file mode 100644 index 0000000000..891d9215c9 --- /dev/null +++ b/meta-oe/recipes-extended/polkit/files/CVE-2026-85498.patch @@ -0,0 +1,38 @@ +From eea172967848bb4c5a407329f40c0e45de0d187e Mon Sep 17 00:00:00 2001 +From: Jan Rybar +Date: Thu, 27 Aug 2026 15:02:45 +0200 +Subject: [PATCH] CVE-2026-85498: Unsanitized underflow in cookie input + +Credits for the report: +Sunwoo Lee, Korea Institute of Energy Technology (KENTECH) +Daeyoung Kang, Korea Institute of Energy Technology (KENTECH) +Haeryong Park, Korea Internet & Security Agency (KISA) +Hyuk Lim, Korea Institute of Energy Technology (KENTECH) +Seunghyun Yoon, Korea Institute of Energy Technology (KENTECH) +Juthawong Naisanguansee + +Co-authored-by: Jan Rybar + +CVE: CVE-2026-85498 +Upstream-Status: Backport [https://github.com/polkit-org/polkit/commit/eea172967848bb4c5a407329f40c0e45de0d187e] +Signed-off-by: Peter Marko +--- + src/polkitagent/polkitagenthelperprivate.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/polkitagent/polkitagenthelperprivate.c b/src/polkitagent/polkitagenthelperprivate.c +index c0a9825..e2d2c9b 100644 +--- a/src/polkitagent/polkitagenthelperprivate.c ++++ b/src/polkitagent/polkitagenthelperprivate.c +@@ -68,6 +68,11 @@ read_cookie (int argc, char **argv) + perror ("fgets"); + return NULL; + } ++ if (buf[0] == '\0') ++ { ++ errno = EINVAL; ++ return NULL; ++ } + if (buf[strlen (buf) - 1] != '\n') + { + errno = EOVERFLOW; diff --git a/meta-oe/recipes-extended/polkit/polkit_127.bb b/meta-oe/recipes-extended/polkit/polkit_127.bb index c0a301c8b0..91be8858cd 100644 --- a/meta-oe/recipes-extended/polkit/polkit_127.bb +++ b/meta-oe/recipes-extended/polkit/polkit_127.bb @@ -5,7 +5,12 @@ LICENSE = "LGPL-2.0-or-later" LIC_FILES_CHKSUM = "file://COPYING;md5=155db86cdbafa7532b41f390409283eb" BUGTRACKER = "https://github.com/polkit-org/polkit/issues" -SRC_URI = "git://github.com/polkit-org/polkit.git;protocol=https;branch=main;tag=${PV}" +SRC_URI = "\ + git://github.com/polkit-org/polkit.git;protocol=https;branch=main;tag=${PV} \ + file://CVE-2026-4897-01.patch \ + file://CVE-2026-4897-02.patch \ + file://CVE-2026-85498.patch \ +" SRCREV = "9e4894c969eecf26a3ba762f4f7a268aa0fb3e51"