From patchwork Fri Jul 31 11:56:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Leonid Iziumtsev X-Patchwork-Id: 94047 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1D117C54F54 for ; Fri, 31 Jul 2026 11:59:46 +0000 (UTC) Received: from AM0PR02CU008.outbound.protection.outlook.com (AM0PR02CU008.outbound.protection.outlook.com [52.101.72.0]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.4981.1785499182337649574 for ; Fri, 31 Jul 2026 04:59:42 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=gRG61JFb; spf=pass (domain: est.tech, ip: 52.101.72.0, mailfrom: leonid.iziumtsev@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Gz9YBzonTDODaPLq6NGI5csdB0ceUb9qmjmi8MWuXxt0MbRaCwI/9y7IsVxzcSQoC9AT3f7uSZAOxU5DPlGK6w7CU7HCLxKcVE3CTcvkPVz3VOG7eAEcgJmd6SWKdJkGJ1xrAgmzA+5u2W7eesGd09FSGe9DOyjtZhBqVaZ1T0sjuR6Tc4dNBxKR3SqUGas83wZtKSy4TrDGj94nUz7Yr3eXXihgtwdrZRjT6iNEmNU6G9u3ft5/qaHwnaSPugQ65afv+XS+k5rjT/LNdQEbMRZaYs4rvdsQfLMMSDnvORHgAf4n55Yyu6bBh6wIvpYTK64AQRta9CjZuwUkfDllgQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=DqXTaw9us4E6tx4OQ90cS4haOdug4NhA0c0fYBBdJIc=; b=EwV4F1eslAqp1TAgd/YJ39tYvca2fKVGbSFifTbq9lAC073Q9kdOlxDm71PBJrMlaO2jXnsI1J9WyHg9x3TWMWDcBB7xtq6SizIJFjRV3jk6x8Jyh7BAlR+kB9hFsWhjHe4nlkWB+BL/E9wUhtT0Gglvby1VAzIDMAFvB9UfcbuWw05L9ueCua8lSaMkbjKN8y0GcYktUsrDoTyNmvEJSwmSkrbPRTzCbq3E7XMSbrjFBXBn5kP5AHu1TT0ztMYAJQtd3IGpmTp3kUNuyAXifqgasOjLli1OSvF9g30HWSPXIi6UkNubCbYur35d2mdGGS8iSNtKLYYQN1DiZmz47A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DqXTaw9us4E6tx4OQ90cS4haOdug4NhA0c0fYBBdJIc=; b=gRG61JFb0aO2xH5YCyREyaYgdFexDDX6VwN4Rjk/4g8GYLNXM/683KHf9zdEYfA9fUNI0OnCgn+h4OiP76WWTdJj4OoQUwPxgeykx85XUUwmCEnBNnRoBMEcJR9CrrC6UkjGWYHZpp5K9u4aucDXwY2FDp4rZ/Y3nJOloQ1faqU14P6AOIsjFJJvxg4wDO5KTJbwCURoJ/o3heuiLNBT6yVPSYiOWFdTCD7CgyTiv/41KZLLrBjC7N8oNDm1L9X3ZCvD2NrSLW9IgDyrt+WRA+Cgn58OgQGsX3TRQJFE0UqSfUS1JGKqGrvXk0hHeF3MHiNVLufWx5xXCFPLeL8gXQ== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AM9P189MB1731.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:2ff::18) by DU4P189MB3374.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:5f3::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.11; Fri, 31 Jul 2026 11:59:40 +0000 Received: from AM9P189MB1731.EURP189.PROD.OUTLOOK.COM ([fe80::a809:5156:7172:6c1f]) by AM9P189MB1731.EURP189.PROD.OUTLOOK.COM ([fe80::a809:5156:7172:6c1f%4]) with mapi id 15.21.0292.010; Fri, 31 Jul 2026 11:59:39 +0000 From: Leonid Iziumtsev To: openembedded-core@lists.openembedded.org CC: Leonid Iziumtsev Subject: [OE-core][PATCH 1/2] coreutils: fix CVE-2026-56391 Date: Fri, 31 Jul 2026 13:56:34 +0200 Message-ID: <20260731115649.1402336-2-leonid.iziumtsev@est.tech> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260731115649.1402336-1-leonid.iziumtsev@est.tech> References: <20260731115649.1402336-1-leonid.iziumtsev@est.tech> X-ClientProxiedBy: DUZPR01CA0226.eurprd01.prod.exchangelabs.com (2603:10a6:10:4b4::13) To AM9P189MB1731.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:2ff::18) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM9P189MB1731:EE_|DU4P189MB3374:EE_ X-MS-Office365-Filtering-Correlation-Id: a9978715-d497-44a4-7be7-08deeefb3348 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|10070799003|366016|23010399003|1800799024|376014|13003099007|6133799003|56012099006|11063799006|10067099003|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: sua3pRx5aLdzcqx069cI2qxjo3xHzPSQWtyrnH5yQNdqBubC+2E14lsVosPaI7bM4Av3Ez/IcTBStCpekEN7WLDM4tZCYSvC2VZvzxge1+ClKahy1TvslwSbjnidvE7NZvbjC4PCQ80I20SSRzLX56YF1IVqaxviqu59kCPZ2OFl4gro4zGXUjUgYN5Kgr2xnAbMQ1aVQ2Z4DplaG1uPG0Z1z0j79yz9aR1T31jTe7Tx1fkCWdoad7Og3yOzkza8E5gNWwPuQfv9xmnaRCaf0K3zTGdyPjExdPsTQWcEuGd9NvzY578250Z/QxioAfeUEaHp8BP1aUBXY0uH2wkzeeecM9ZUxASl2E976CWTzy9CBw1ZKFSh7XbQ7ZGXoguCfQBIP5eW0WglefBbqs1uiM36hQbpbnpqXHxzM7AiaCM2hohiuAkwBAmWd0SEaukYpTQN6cjczaRiRzOLFaOaZEMENxU1V26/Q5EsDzXeNApxPv0hVL/2vRyqf5bhNZKCuXOvZdxEq/HmFLKEHrhwESxZq4zx4jR/66bSC4QzpewiR/81W7CrkIvaNLKNPXun+gZHr9/Qytedx4JyCoSwl8lENR2xSF1pfP3ciXOpNaimbEbTV+zNEzUtr1BuR0z8kLRgkkfGpwmWlNZmIScUM63yde94WPE8B/4NLrFcP7M= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM9P189MB1731.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(10070799003)(366016)(23010399003)(1800799024)(376014)(13003099007)(6133799003)(56012099006)(11063799006)(10067099003)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: bbV/8ourasAaBKQmmX3GNuMNYBRMRZj1f/6kBBh5HZNZ6PRSG7IFIKS+BmB5galKP52JDo67f8xcawFcOt/21RpjGHiTwa1bUPOrMmQ2cRChozEWuSLY7P9NeHQP568AZU/Sap2t4VkGQc4qf1l7hzFxwih9KrkfoOM0ItVAdUU+9+f6Jr93wdrc6a/f73QBfF2XHenM7KYLMq2AK2yZgY99Dh671jsDf7u+B2uqAE+4JEduLo37nhae9dnjWqwf/nIeWS1bY12ci0typmgJDmYM77KsRFvp9x5pLiYtQyHURLNqJG2V1r8edmsaswZTaL6Cm0j64ZiTUOv0yS9YN40bgHP8m11w7ccYxAn0gitb+y7LfGiWmxU1waf/TKqEm8jm+ZuJW4vZVuciNmBi79JQVOb5aEO81O1RXy1jS6Dj9AqoX6DD3F6/3KoJGQyszI+jK8u607bHonHJ2RfPL9t9jN7tcr3Tbt9r/qjVOXQ+LK7BlORBbH3zi3TN0TVV34jyL1WKpvb4+5J/KDWY+AgGXl24cKMJFGh/ggprdHayIegm1wB0mfBCwvz1bD7bkmDRQ7L5DW/PQYHFuoA3LdSY5wXrznzcmQo3tYXXkMRCt8ehIeh4lVshXPKJjg3NO2/7vI7qOZ4Q/H9z87f8+zkQ6IW2x5ZO+laWic41nF8x4DLEeDMStJDBiZzd4G8wYpdZKl7YnZZrLjuYKkZ7rVZU5sOp/g3ptN7ISDBbJJyXGMGoffhy35mCv+yDpptod+XygSDT4R9TRXmiMUiZajrncL2quYKiGtvoLrrsXSRHthfozwN8rT7XF/pJGKbBkxoqCDSt8dlEE8giUTtylDNYFdtCK9Lb8zQPTTkvDZRoYiYkmE/QiIua2RyiRhnHFT5khuIJcruj5T3eF+uOyLhja+sEdXi6zzz8auQYwFQHvXgc4TJKLAZCKDXno1EuhetgH9RDdfetRwObRf3ZP/5ZAWAmN8Yap4SD7t+NLtVaEpAvJv2akhbtSoL/pgLjSB8ELtxlxrjiXTtpoyLuBojQLo/95n/FDd1EnKcXhAz4o+CulSQxUr2l8JOxzMMRnSNSfUOCBZG8lLm0m1sOh/Sf/U/3k0k1+zt4aeVWdsa77+PPDtloAbAFfW1+ughIiKqlnagHRLgMdMbEA9JbAqNhIJGE1F4fOQwZfvTr313rW5+wRs7HxX/Q6tRl3q1qc6DQIXOOnbrh+tcNVh1Z5yaCmx4qoE2/wppamrRlS4G+8hvNbs5uBrErB5ITOS19g1SfZba7TykNzG7MsqF0zvU+WNXackOvs+Eu9WTtjKXORAFuzPxkjiSuIKX4pwYs99mNc0TBPLA5/DKyNh9yPphzm8Utcj0p9FRlWqn9Mb1kwawFCl338nn9buBfuEOhRhHFWkGTHBz9JqMqGEtU04B1yuFJ+u2Y59PtdE0xwviRBuqs0Imftxwv/FfXJHToFMoElhSmPF2PPi6soa9O2xj7WJ70v2DLUM4RP+iT3ULDl5gYWNwv2oLOaqsm7ik6tuzlgxu9OcZRQOe03Oge+CyRH3ve+hf79UWy/FWytAxNyOt9WotigTIWHDo6BlxA0QmbalNS85Zcj1pW7VpDupM1kC9jcht6mvsQJEwb3T/zmuex9scEc2Tj/o3yjkmubviCKyFFqx1fUaj8agtA+2OvqO4c89jbfeEFy4WHRigZ3vq/fLMwfdYCFqT9DDX4pOJPqp5amWuKX+omLa3v9WsZpwWKOmYRvKmCUDkHUIoLWxOTHD7kKAouVMEOVQiIE8nx7vAm X-MS-Exchange-AntiSpam-MessageData-1: OL7HATfWW1D+p9cD4wmVQvR7Gegxj/dhNGE= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: a9978715-d497-44a4-7be7-08deeefb3348 X-MS-Exchange-CrossTenant-AuthSource: AM9P189MB1731.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Jul 2026 11:59:39.8730 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: I9npNCOjtUKt1uG4Dn5K2KvoyHJClQzaC3n9P+3899ywgfLtQeYIXrbVdEFi3/COuaRjwK0OIrREQ5Dm1cm+Gr3vFm6X92DmNda8KpF/BN8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU4P189MB3374 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 31 Jul 2026 11:59:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242432 Backport patch to fix CVE-2026-56391. Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-56391 Upstream fix: https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371 Signed-off-by: Leonid Iziumtsev --- .../coreutils/coreutils/CVE-2026-56391.patch | 66 +++++++++++++++++++ meta/recipes-core/coreutils/coreutils_9.11.bb | 1 + 2 files changed, 67 insertions(+) create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch diff --git a/meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch b/meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch new file mode 100644 index 0000000000..85745bf572 --- /dev/null +++ b/meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch @@ -0,0 +1,66 @@ +From dadd37b60ca43b436a2287d28d6497bcc5bf4b9a Mon Sep 17 00:00:00 2001 +From: Paul Eggert +Date: Tue, 28 Apr 2026 11:25:00 -0700 +Subject: [PATCH] uniq: fix read overrun with -w +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Problem reported by Michał Majchrowicz. +* src/uniq.c (find_field): Fix typo. +* tests/uniq/uniq.pl (add_z_variants): Test for the bug. + +CVE: CVE-2026-56391 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371] + +Backport Changes: +- The NEWS file has not been updated. + +Signed-off-by: Leonid Iziumtsev +--- + THANKS.in | 1 + + src/uniq.c | 4 ++-- + tests/uniq/uniq.pl | 3 +++ + 3 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/THANKS.in b/THANKS.in +index 35fee75..5a2fd35 100644 +--- a/THANKS.in ++++ b/THANKS.in +@@ -459,6 +459,7 @@ Michail Litvak mci@owl.openwall.com + Michal Politowski mpol@charybda.icm.edu.pl + Michal Svec msvec@suse.cz + Michal Trunecka mtruneck@redhat.com ++Michał Majchrowicz mmajchrowicz@afine.com + Michel Robitaille robitail@IRO.UMontreal.CA + Michiel Bacchiani bacchian@raven.bu.edu + Mike Castle dalgoda@ix.netcom.com +diff --git a/src/uniq.c b/src/uniq.c +index 3046359..5834596 100644 +--- a/src/uniq.c ++++ b/src/uniq.c +@@ -285,8 +285,8 @@ find_field (struct linebuffer const *line, idx_t *plen) + else + { + char *ep = lp; +- for (idx_t i = check_chars; 0 < i && lp < lim; i--) +- ep += mcel_scan (lp, lim).len; ++ for (idx_t i = check_chars; 0 < i && ep < lim; i--) ++ ep += mcel_scan (ep, lim).len; + len = ep - lp; + } + +diff --git a/tests/uniq/uniq.pl b/tests/uniq/uniq.pl +index b558fb3..0df7ec6 100755 +--- a/tests/uniq/uniq.pl ++++ b/tests/uniq/uniq.pl +@@ -234,6 +234,9 @@ my @Tests = + " - 'separate'\n" . + " - 'both'\n" . + "Try '$prog --help' for more information.\n"}], ++ # Test for read buffer overrun. ++ do { my $longline = "\360\237\230\200" . "A" x 255 . "\n"; ++ ['146', '-w256', {IN => $longline x 2}, {OUT => $longline}] }, + ); + + # Locale related tests diff --git a/meta/recipes-core/coreutils/coreutils_9.11.bb b/meta/recipes-core/coreutils/coreutils_9.11.bb index ea2d237c3d..3e4f5fc7dc 100644 --- a/meta/recipes-core/coreutils/coreutils_9.11.bb +++ b/meta/recipes-core/coreutils/coreutils_9.11.bb @@ -16,6 +16,7 @@ inherit autotools gettext texinfo SRC_URI = "${GNU_MIRROR}/coreutils/${BP}.tar.xz \ file://remove-usr-local-lib-from-m4.patch \ file://run-ptest \ + file://CVE-2026-56391.patch \ " SRC_URI[sha256sum] = "394024eda0a5955217ceda9cd1201e65dc8fa3aa29c2951135a49521d57c3cc3" From patchwork Fri Jul 31 11:56:35 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Leonid Iziumtsev X-Patchwork-Id: 94048 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id EDC15C5516D for ; Fri, 31 Jul 2026 11:59:55 +0000 (UTC) Received: from AM0PR02CU008.outbound.protection.outlook.com (AM0PR02CU008.outbound.protection.outlook.com [52.101.72.32]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4845.1785499186592305054 for ; Fri, 31 Jul 2026 04:59:46 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=dEkyfyMO; spf=pass (domain: est.tech, ip: 52.101.72.32, mailfrom: leonid.iziumtsev@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=AYYZShfTG6VfLHMKUJkUnrGwUi1mW28IkEN+eGmQ7qec+Q0SuueI3y6TXv3Oomcvq1dRasGRrfBLyazQ9bXznxR11+fiB2YlW9hn83XI0ScGn+5c7rL1uE6hM6L6DjS8/DbCHR2i5bps8tojJllFPFONSvFdZma65g/+zM4m6Pfa1NFdMzAumFujxRPseSZuwV4BAi7ggb6mJ9mtLXg0wujwc4kSx5/DHOC8NKdNfzYplzDgRTu7/JL1kuZn8Dbppyx19jo2Y70UbfjZJqc8CAzynDqahaIU5jddNBu8jPfhC3YeILCJPXeLyKFA0HkP4pyiurWuXfhAdX9nD3AW2w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=gx7B0Lnfp/A3/YsyBCQSb1SZII00H/B0F8jB+fob+2g=; b=eIJYxvKBSWX3IQn22RTX/tuLrGCL9mzCUvqx1mw4+Am/1g+nBHDjI00E2+I2kKHJxnLrZbw0+eMlgrspJHJazg/L9/3vb9tX2Juf2N5vk10mv89X90lmcEKqEtTb8dce799tq0qm81L0Fhsq74b49SRX6xfJQvEg0b+nTCN911fjYnUb7wQnWV5BhtpHduwYzGq88GcgZml+WyFWyQHdRc/anEGgXWGfEFtw2vLUiYX8hZHzhsnqG2ffo4gpiihVK6sQxVvairYAh13UphCf4XVM/dOt7R1l9X5q/avHE1OzKTeKn2eMl8GG0TxrAL01sgvDoBbB65O7Z43vqf+3vg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=gx7B0Lnfp/A3/YsyBCQSb1SZII00H/B0F8jB+fob+2g=; b=dEkyfyMOJPLcCPp5vdvqyObDzecSnb+3Vhz0h61bt2Kg0mMn7J+1UnBykb5r9YDCCeFTVclMSB1ml7j1VOwPTEqlvHfDqq+oED7o9uRc5I/OsreQ6RIkWzDBDVlEzAwog52bnw9LhUiINcJXqXz62SCmuBxJznnWlVmpax3AAzCH3vYrW0ZB7rRHHYvzSBBRr82+j6GbMHv1ffCY8Zti5SVdmK0jt1GlJCspDBUIyZSLMZGl5Xw/vwS37m945JMrHF1j0q2AC+TksL24hfEzFA7eAuEqyVJGV/6eooCEVFPBM4vqUndhKLCtFQoJDhc5XL3dUOQA1DV33muusU+TCw== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AM9P189MB1731.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:2ff::18) by DU4P189MB3374.EURP189.PROD.OUTLOOK.COM (2603:10a6:10:5f3::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.11; Fri, 31 Jul 2026 11:59:44 +0000 Received: from AM9P189MB1731.EURP189.PROD.OUTLOOK.COM ([fe80::a809:5156:7172:6c1f]) by AM9P189MB1731.EURP189.PROD.OUTLOOK.COM ([fe80::a809:5156:7172:6c1f%4]) with mapi id 15.21.0292.010; Fri, 31 Jul 2026 11:59:44 +0000 From: Leonid Iziumtsev To: openembedded-core@lists.openembedded.org CC: Leonid Iziumtsev Subject: [OE-core][PATCH 2/2] coreutils: fix CVE-2026-56392 Date: Fri, 31 Jul 2026 13:56:35 +0200 Message-ID: <20260731115649.1402336-3-leonid.iziumtsev@est.tech> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260731115649.1402336-1-leonid.iziumtsev@est.tech> References: <20260731115649.1402336-1-leonid.iziumtsev@est.tech> X-ClientProxiedBy: DU6P191CA0040.EURP191.PROD.OUTLOOK.COM (2603:10a6:10:53f::15) To AM9P189MB1731.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:2ff::18) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM9P189MB1731:EE_|DU4P189MB3374:EE_ X-MS-Office365-Filtering-Correlation-Id: c04799b9-4e49-4588-dafd-08deeefb35b8 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|10070799003|366016|23010399003|1800799024|376014|56012099006|11063799006|10067099003|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: kYZuze2UUIqqQ5u4XzJcVmdiixaJdvpzA1qvwWEiEiclNkIzA0JRvUtTZacwyIktuBW+Z1ZtJl44eJ2SlXfCEiWDAlVutvPldBI7cBnABl2v6CSq0Rd7BhIHAh6Vi5+DZwJI8eS/XfmyvanB5icACjfyKek+oYLnDCB6vbePSYkHgnkvpY0KN2k4R5hCcVoVw09izTInXVnvEoAgXPPIQxvNLRqx/lGKFPcWKyrMPOeg2rLVnB7S9xvDeYTaS4rR5u6BgiJ1vQUUOsdabPWCDYoc4MT7vBPclLAbGjVtsmdegv17idxrnKvq4STum3kTww8hqmtHwU+zz/Jpx2/rWI8RvqWzcafYf8O1I82e5+q7Yvh2+RTQbAd8UrETF4pPv1XYp2fEuX81oz5dv8go0EnUg+gWj5lpIFvWI2fxEFsGHl87ZaS/k4I54qWl/L1oauzxA4MYnmiEhNvjTRdSlz/+HUlfWD62Q78+df1gKSiE1wF+Iki0tHBTR+o9ELMEHFi3HzZnGKJf4nD9D1lUCs89vzkQGzw3YE8sl92CWA43mSvytcMr97COIi8PdfgUyqPDn4nvoYD8F1s7ZVJCeD+NnOYLAL7ozMNqdEq2IeYJ2eh2VrCEyaX9DZ9w/GHHltDr/6pzvLac2WQ18qF674TFYRbtRRkvPpbww9OsRsE= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM9P189MB1731.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(10070799003)(366016)(23010399003)(1800799024)(376014)(56012099006)(11063799006)(10067099003)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: UAoJpFe16cJQcD1RZ6W+mfZG+6XKL1LS2ncxAh3mg7fYedeSS3lNKzEx2vXHsPp2uM3QvKeTvh084T+BWBqpzsESnD0IHpWIRzRfkoG0RGZeVG2tF3YDJKlr9M+J89pPdj8GIaAtJZtus/ryGhglgZiM5owtnSUV2MafJWRWbBtL4Qa0vaX/XLiyw9o0glQi65OsT1lPt2hY5xFOFi4G0HS6j7elNiFkNU7EUydwiXlKe3Bnm3RLAvAKManNt6IhYMt7bRsCLE/CrlNE4c5AkRa6IIZnU4I7iFtaXHYWQYuEGU6vM70BLoEb/9Lo4BDicgjyvaX/fHbLGPYMB2bB5GGEGkPpdWk94OZZBHB5UZCKPzC//TTugEz0A3LcGSk50oZjTkLXQGzX9tuR+xojLeTZTwC514fuNd38c0GCJlE13QUmSifsdMgUsk111pegY0bo2guq6Wkg0QjpVcC6iHGFLREqBXfUdOn+b9JXhoEYbBHZWQFffVWMJJSVm7TPjhvFGpDkKMBH/O/pZqlyByJ/24G0mMFqJbYbIIpeK/GDWtGWDGIRLqTnX/QN/h4OmfwPU+y5qNandtiLUrLTN5oTCZ5RgZ8HkvMSzT6xFWNlqY+O1Z/0u/ZIG+CVZwvwoQKW45hMOmyULW8f/Sxp08g5MddgRKID3J8irx1tux9VYjkD6NBeJjK0MlOHNYYOm0INiZGZnga+8Jp5VlPN6GFfHGV0NHiw03o3fC9lHSPnBAxQ9UtO15bwyRS7Mp/3YMwc3HDYjtlJRPwMz4XsJn77VhgKKBy7ezAivjppmRqKNlCvEzF+bbDye/7m0feG5p2jB0kvYXpQcUh2HyvJOxFbh6AbyuIGfHqX9bCHA54YNURMVXuoTyPfOR3RLdsXxJNfiopK7/MrVpye5RekGRgjgMavg0Z5RSxe/XzDAMvJKKVCtQqPjtvj1X1BURb2VdBs8JdkMKBViZjK7YWhF+LXU5plyja7EyZFrZqOc3JmhYC2rkAjWvHjU0CfXf6mTM0maDddmTqVUZ48Rw0ci3boIRKq8AlMNqZ+gt66I+Wxb5VmG3XwvpNAcAKH+WdBLg0TVC2C2QTRe5HqKdQ7jSunE/RxDhaM7jm4Jx7R71jvdr08pxVpJtktjL1UVVekCDY8UATTrMocFIQ8sIBtHfYqo0I1J6hyrCuOfZSU+l6u+FBq2BwjqGKDwvAxgFgh8EdITd6rDeKCJ0LBUDJMVOfGjWcy5hR0tk0X0346+k52bHLFw7kTcaz785Hxdg2XZeuEYsmhrrRIKQBWlY/St2zobwPC0n4vLX4UBgnIBuSXilZcn8joLLqi+usLxNetuTTlgSvNbR78f+TBqSNxyNd3YrKICJRlQ31voDzjppoYW1GrgE5WkghF6kKUzqleKN7QgpauSQqmH5HzvcMKy1mjo/oFqDx2IY42PzFuGftcUjiLPehTazKTVwKJaeF6bw+FUC6N0pw1pPX2ddXrOxUtI4ELhuoPJn+X+u8zVAaIAw5OEJwx674ntlHuuuZu2jRQjuJ8TvCUHnjjblWgSpNiT2gP044HVBwHp0KY4M5/DkO6LBLlCA6FLLdK1eX6yd8X+JpUgSyUJm7qJvpAn0hXqhLqqes6aBv0QflluHe7zCBwFjGP+XzFpU5R1pHjxutIH3kYknFbbtPLgwj3+z06+ALdxK2836L9t3jytCJxzpurfEP7D3aglIvMGXnmBtQFpcd7SwWsJa9Ctez0Lh1nXKFUAuzbJgDCAlhuvh9hG1ntG0l3MtuzbVxrwPSRSy3b0yHo X-MS-Exchange-AntiSpam-MessageData-1: 5SDb8C/v4wjOWugN5kj32TnvKliENTT+Y5g= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: c04799b9-4e49-4588-dafd-08deeefb35b8 X-MS-Exchange-CrossTenant-AuthSource: AM9P189MB1731.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Jul 2026 11:59:43.9669 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: osybi2fEUsD4OIzdm4ZqoZa4BocpjkkMo+FpLeeK0ZZZ/0/1PM7wkefAPX3RUDq6vqLdp2iy8GxoSUIDom2knYMoNKOY1bB7dUcfRowOkF8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU4P189MB3374 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 31 Jul 2026 11:59:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242433 Backport patch to fix CVE-2026-56392. Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-56392 Upstream fix: https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d Signed-off-by: Leonid Iziumtsev --- .../coreutils/coreutils/CVE-2026-56392.patch | 65 +++++++++++++++++++ meta/recipes-core/coreutils/coreutils_9.11.bb | 1 + 2 files changed, 66 insertions(+) create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2026-56392.patch diff --git a/meta/recipes-core/coreutils/coreutils/CVE-2026-56392.patch b/meta/recipes-core/coreutils/coreutils/CVE-2026-56392.patch new file mode 100644 index 0000000000..8468b4d288 --- /dev/null +++ b/meta/recipes-core/coreutils/coreutils/CVE-2026-56392.patch @@ -0,0 +1,65 @@ +From aa3f6d91fdddcc45c5bb656168f7d20808991fe0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?P=C3=A1draig=20Brady?= +Date: Tue, 28 Apr 2026 20:33:10 +0100 +Subject: [PATCH] unexpand: fix heap overflow +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +* src/unexpand.c (unexpand): Use xinmalloc() to gracefully +handle overflow. Also use the runtime locale specific MB_CUR_MAX +rather than the worst case MB_LEN_MAX. +* tests/unexpand/mb.sh: Add a test case that fails in a default +glibc build with either MB_CUR_MAX or MB_LEN_MAX. +* NEWS: Mention the bug fix. +Reported by Michał Majchrowicz. + +CVE: CVE-2026-56392 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d] + +Backport Changes: +- The NEWS file has not been updated. + +Signed-off-by: Leonid Iziumtsev +--- + src/unexpand.c | 2 +- + tests/unexpand/mb.sh | 8 ++++++++ + 2 files changed, 9 insertions(+), 1 deletion(-) + +diff --git a/src/unexpand.c b/src/unexpand.c +index 4fbf9d3..761c8ea 100644 +--- a/src/unexpand.c ++++ b/src/unexpand.c +@@ -131,7 +131,7 @@ unexpand (void) + /* The worst case is a non-blank character, then one blank, then a + tab stop, then MAX_COLUMN_WIDTH - 1 blanks, then a non-blank; so + allocate MAX_COLUMN_WIDTH bytes to store the blanks. */ +- pending_blank = ximalloc (max_column_width * sizeof (char) * MB_LEN_MAX); ++ pending_blank = xinmalloc (max_column_width, MB_CUR_MAX); + + while (true) + { +diff --git a/tests/unexpand/mb.sh b/tests/unexpand/mb.sh +index 76a2679..076a1c1 100755 +--- a/tests/unexpand/mb.sh ++++ b/tests/unexpand/mb.sh +@@ -17,6 +17,7 @@ + + . "${srcdir=.}/tests/init.sh"; path_prepend_ ./src + print_ver_ unexpand printf ++getlimits_ + + test "$LOCALE_FR_UTF8" != none || skip_ "French UTF-8 locale not available" + export LC_ALL="$LOCALE_FR_UTF8" +@@ -161,4 +162,11 @@ EOF + unexpand -a ./in ./in > out || fail=1 + compare exp out > /dev/null 2>&1 || fail=1 + ++# Ensure overflow is handed gracefully ++# coreutils v9.11 induced a buffer overflow with mb_mul=4 (or 16). ++for mb_mul in 4 6; do ++ printf ' \n' | unexpand -t $(expr $SIZE_MAX / $mb_mul + 1) 2>err; ret=$? ++ test "$ret" = 1 || test "$ret" = 0 || { cat err; fail=1; } ++done ++ + Exit $fail diff --git a/meta/recipes-core/coreutils/coreutils_9.11.bb b/meta/recipes-core/coreutils/coreutils_9.11.bb index 3e4f5fc7dc..63f7810e88 100644 --- a/meta/recipes-core/coreutils/coreutils_9.11.bb +++ b/meta/recipes-core/coreutils/coreutils_9.11.bb @@ -17,6 +17,7 @@ SRC_URI = "${GNU_MIRROR}/coreutils/${BP}.tar.xz \ file://remove-usr-local-lib-from-m4.patch \ file://run-ptest \ file://CVE-2026-56391.patch \ + file://CVE-2026-56392.patch \ " SRC_URI[sha256sum] = "394024eda0a5955217ceda9cd1201e65dc8fa3aa29c2951135a49521d57c3cc3"