From patchwork Fri Nov 6 08:53:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103239 Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.2177.1793955248827567715 for ; Fri, 06 Nov 2026 00:54:09 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=c8Pw56Yx; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=12677; q=dns/txt; s=iport01; t=1793955249; x=1795164849; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=iGa10oGkq6zAM0NHV9JV/nC15jfoMu4pdqq6PD+9WPI=; b=c8Pw56YxAzOEmoDLJZZw8XNGS8WThoCb7pfqVNKrjEuQyLACqhXeJW+p 5yBtpvp8T4pcY7NWEWakf/8uBbvBABk+NfUeKAiKZkj9f/i+3OWUcUFzj epKwPh6AY7jkf1ed8YqmfMz5I/dmyHLzbdItlRrMroRBzc3cr4LTp/ZIQ USEqKMHK0Jx2ZlbbJPVTA0Q5iicnDIVr8CSi+bmk6zDPYc0/+C8FQgDhr OxdxuVoPnhLbupzzvHhxBSeYI3Pdf4AnWEbc0wSZNPlIQ5ZmeXv0tWJ6T URS4RqsgQemKxRrOQFDuvAo7en0SVanTxt4C7Yfm74dJRLVXBB5718lfe g==; X-CSE-ConnectionGUID: 6JlhplkFTPCfLgkptq+Grg== X-CSE-MsgGUID: GH4vWxZoTWWq4Vy3/ZhDZQ== X-IPAS-Result: A0BGAgBUle1q/5D/Ja1aHgEBCxIMggULgld1YENJlkueJIF+DwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECASoLARgBLSwDAQJaIyEJgnkBgnQDEbwGgXkzgQGCZkMBPwJDUNlLgWgBCxQBBYEzhUAyh3FdGAGEfScbgUlEhH6BBYFcAQGIJgSDHBKBWh6GIoZYAoFRhnlIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHQ5EDAeJC8FHCY+GwovGA1IESw3FRkEPm4Hkj2DCwYBAXoTAQcjAXsdcDU6owqCIaERhCqBaIo8lToaM4VbpRYLmH2OCpZRhGmBaDyBRwsHMxoIGxWDIglKGQ+OLgsLg2CBf4MUxn0mMgIJMgEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:k4G4T6zAYqaP8rnmS/V6t+dhxyrEfRIJ4+MujC+fZmUNrF6WrkUGz WNMD2vVPPrYYWv9etgkYI63phtU6sCGmNdrTVRq/lhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWctaj9MsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJB8UOY0A/uVZPVll+ 9gXKygRd1Osne3jldpXSsE07igiBNPgMIVavjRryivUSK55B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cP3WjOX9PYH46tO6ynnjjazRwo1OOrq1x6G/WpOB0+OWxbIuFJ4LSGq25mG63h j7YwHTLBS0lC8XD9yvetUCsqt32yHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rbyyjVSzc9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7GQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSv1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:phA+GqmQFkBJLxmvblVpmESDEebpDfIA3DAbv31ZSRFFG/FwWf rAoB19726QtN9/YhAdcLy7VZVoIkmsl6Kdn7NwAV7KZmCP0wGVxepZg7cKrQeNJ8TWzJ846U 4ZSdkcNPTASX5nkM39/A60V/wkwNWB7eSUoN229QYLcemvAJsQljuQzW2gYytLeDU= X-Talos-CUID: 9a23:FU+46Gt56AjMrT+cVXQ9tWDL6It7UHnd1HPTDXOAImhNR76NVUbT17lrxp8= X-Talos-MUID: 9a23:f0iucglKM9Ty3QPcI9eAdnpNFJt23LScD3wyroxahdjfch5wFwWk2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="544985607" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 08:54:07 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 93E50180003EF; Fri, 6 Nov 2026 08:54:07 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id 3DE69CC2EF1; Fri, 6 Nov 2026 00:54:07 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH 01/10] sqlite3: Fix CVE-2026-119377 Date: Fri, 6 Nov 2026 00:53:56 -0800 Message-Id: <20261106085405.3517095-1-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 08:54:21 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249619 This patch applies the upstream fix series [1], [3], [5], and [7] for the authorizer bypass. Commits [1] and [3] are dependent commits. Commit [5] adds authorizer checks for RIGHT JOIN USING terms, and commit [7] corrects the loop so every term is checked. The GitHub mirror commits correspond to the SQLite Fossil check-ins shown in [2], [4], [6], and [8], respectively. [1] https://github.com/sqlite/sqlite/commit/c70fbd39f9c130bbe1cc45269c3b490dfdf7f259 [2] https://sqlite.org/src/info/625f78a630bb [3] https://github.com/sqlite/sqlite/commit/ddea119f825bf07f145c55f623022286bc644664 [4] https://sqlite.org/src/info/4ef88a36f9d9 [5] https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237 [6] https://sqlite.org/src/info/bbd69ce27462 [7] https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8 [8] https://sqlite.org/src/info/2cb228776836 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119377 Signed-off-by: Arpit Patel --- .../CVE-2026-119377-dependent_p1.patch | 86 +++++++++++++++++++ .../CVE-2026-119377-dependent_p2.patch | 59 +++++++++++++ .../sqlite/sqlite3/CVE-2026-119377_p1.patch | 52 +++++++++++ .../sqlite/sqlite3/CVE-2026-119377_p2.patch | 51 +++++++++++ meta/recipes-support/sqlite/sqlite3_3.45.3.bb | 4 + 5 files changed, 252 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p1.patch create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p2.patch create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p1.patch create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p2.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p1.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p1.patch new file mode 100644 index 0000000000..bdeb32da04 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p1.patch @@ -0,0 +1,86 @@ +From c3cab0322ae36fe6ca21df300c670af379c0a423 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Sat, 2 May 2026 17:30:33 +0000 +Subject: [PATCH] Minor optimization to the authorizer. + +FossilOrigin-Name: 625f78a630bbf897f945065f1b85a92fe26e426302c8f6edc4d26a817ff62358 + +CVE: CVE-2026-119377 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/c70fbd39f9c130bbe1cc45269c3b490dfdf7f259] + +Backport Changes: +- Applied the src/auth.c and src/resolve.c changes to sqlite3.c because + the Yocto sqlite-autoconf source uses the amalgamated SQLite layout. +- Kept SQLITE_PRIVATE on sqlite3AuthCheck() to match the amalgamated + source. +- Omitted manifest and manifest.uuid because they are repository + metadata and are not needed for this sqlite3.c backport. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 27 ++++++++++++++++++++++----- + 1 file changed, 22 insertions(+), 5 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 6acf46a5b5..3bab6d7638 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -107075,9 +107075,7 @@ lookupname_end: + if( cnt==1 ){ + assert( pNC!=0 ); + #ifndef SQLITE_OMIT_AUTHORIZATION +- if( pParse->db->xAuth +- && (pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER) +- ){ ++ if( db->xAuth && (pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER) ){ + sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList); + } + #endif +@@ -120685,8 +120683,14 @@ SQLITE_PRIVATE void sqlite3AuthRead( + ** either SQLITE_OK (zero) or SQLITE_IGNORE or SQLITE_DENY. If SQLITE_DENY + ** is returned, then the error count and error message in pParse are + ** modified appropriately. ++** ++** Divided into two routines. realAuthCheck() does the work. The ++** sqlite3AuthCheck() routine is usually a fast no-op but invokes ++** realAuthCheck() (and spends time doing some stack pushes and pops ++** as a result) in the uncommon case where an authorization check is ++** actually needed. + */ +-SQLITE_PRIVATE int sqlite3AuthCheck( ++static int SQLITE_NOINLINE realAuthCheck( + Parse *pParse, + int code, + const char *zArg1, +@@ -120700,7 +120704,7 @@ SQLITE_PRIVATE int sqlite3AuthCheck( + ** or if the parser is being invoked from within sqlite3_declare_vtab. + */ + assert( !IN_RENAME_OBJECT || db->xAuth==0 ); +- if( db->xAuth==0 || db->init.busy || IN_SPECIAL_PARSE ){ ++ if( IN_SPECIAL_PARSE ){ + return SQLITE_OK; + } + +@@ -120729,6 +120733,19 @@ SQLITE_PRIVATE int sqlite3AuthCheck( + } + return rc; + } ++SQLITE_PRIVATE int sqlite3AuthCheck( ++ Parse *pParse, ++ int code, ++ const char *zArg1, ++ const char *zArg2, ++ const char *zArg3 ++){ ++ if( pParse->db->xAuth!=0 && pParse->db->init.busy==0 ){ ++ return realAuthCheck(pParse,code,zArg1,zArg2,zArg3); ++ }else{ ++ return SQLITE_OK; ++ } ++} + + /* + ** Push an authorization context. After this routine is called, the +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p2.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p2.patch new file mode 100644 index 0000000000..e8a89898d4 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p2.patch @@ -0,0 +1,59 @@ +From 7606a5f5a1ce6f38eb5e98514583c711120ad694 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Mon, 1 Jun 2026 16:49:39 +0000 +Subject: [PATCH] Make sure the authenticator is called for columns that are + part of a USING in a FULL JOIN. [bugs:/info/2026-05-31T02:00:37Z|Bug + 2026-05-31T02:00:37Z]. + +FossilOrigin-Name: 4ef88a36f9d9669b0d74c58f79ad497803885ff6078e5f9685f13c96eab397cc + +CVE: CVE-2026-119377 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/ddea119f825bf07f145c55f623022286bc644664] + +Backport Changes: +- Applied the src/resolve.c change to sqlite3.c because this recipe + uses the amalgamated SQLite source. +- Omitted manifest and manifest.uuid updates because they are Fossil + repository metadata and are not needed in this backport. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 3bab6d7638..903af8baa8 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -107001,7 +107001,7 @@ static int lookupName( + ** cnt>1 means there were two or more matches. + ** + ** cnt==0 is always an error. cnt>1 is often an error, but might +- ** be multiple matches for a NATURAL LEFT JOIN or a LEFT JOIN USING. ++ ** be multiple matches for a NATURAL OUTER JOIN or a OUTER JOIN USING. + */ + assert( pFJMatch==0 || cnt>0 ); + assert( !ExprHasProperty(pExpr, EP_xIsSelect|EP_IntValue) ); +@@ -107075,8 +107075,17 @@ lookupname_end: + if( cnt==1 ){ + assert( pNC!=0 ); + #ifndef SQLITE_OMIT_AUTHORIZATION +- if( db->xAuth && (pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER) ){ +- sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList); ++ if( db->xAuth ){ ++ if( pFJMatch ){ ++ assert( pExpr->op==TK_FUNCTION ); ++ assert( sqlite3_stricmp(pExpr->u.zToken,"coalesce")==0 ); ++ assert( pExpr->x.pList==pFJMatch ); ++ assert( pFJMatch->nExpr>0 ); ++ pExpr = pFJMatch->a[0].pExpr; ++ } ++ if( pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER ){ ++ sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList); ++ } + } + #endif + /* Increment the nRef value on all name contexts from TopNC up to +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p1.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p1.patch new file mode 100644 index 0000000000..7dd0f76b6b --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p1.patch @@ -0,0 +1,52 @@ +From 7e76b79f06869f46def99a3ec08d9dfb53a346b1 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Sun, 5 Jul 2026 16:06:33 +0000 +Subject: [PATCH] Be sure to invoke the authorizer callback on all terms of the + USING clause in a RIGHT JOIN. [bugs:/info/2026-07-05T08:15:45Z|Bug + 2026-07-05T08:15:45Z] + +FossilOrigin-Name: bbd69ce27462000873af053bfebdd305c53deac85c426b1e7dbd927b5f17d622 + +CVE: CVE-2026-119377 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237] + +Backport Changes: +- Applied the src/resolve.c change in sqlite3.c because the Yocto + sqlite-autoconf source uses the amalgamated layout. +- Omitted test/auth.test because the extracted recipe source lacks the + upstream Tcl test tree. +- Omitted manifest and manifest.uuid because they are repository + metadata and are not needed in this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index d777811056..9338328be5 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -107077,13 +107077,16 @@ lookupname_end: + #ifndef SQLITE_OMIT_AUTHORIZATION + if( db->xAuth ){ + if( pFJMatch ){ ++ int ii; + assert( pExpr->op==TK_FUNCTION ); + assert( sqlite3_stricmp(pExpr->u.zToken,"coalesce")==0 ); + assert( pExpr->x.pList==pFJMatch ); + assert( pFJMatch->nExpr>0 ); +- pExpr = pFJMatch->a[0].pExpr; +- } +- if( pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER ){ ++ for(ii=0; iinExpr; ii++){ ++ assert( pFJMatch->a[0].pExpr->op==TK_COLUMN ); ++ sqlite3AuthRead(pParse, pFJMatch->a[0].pExpr, pSchema, pNC->pSrcList); ++ } ++ }else if( pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER ){ + sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList); + } + } +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p2.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p2.patch new file mode 100644 index 0000000000..b67cb32b8c --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p2.patch @@ -0,0 +1,51 @@ +From a98f25c8a88d1e0e24f677279ac90b30567f93ee Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Fri, 24 Jul 2026 14:53:59 +0000 +Subject: [PATCH] Fix a bug in the check-in [bbd69ce274620008] causing that + bug-fix check-in to fail to completely fix the original bug. This fix is in + response to the follow-up report at [bugs:/info/2026-07-24T02:52:08Z|Bug + 2026-07-24T02:52:08Z]. + +FossilOrigin-Name: 2cb22877683680c1f89bcc9edb47bd1a4a8755d4a6b846a1a20136a657dacdcc + +CVE: CVE-2026-119377 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8] + +Backport Changes: +- Applied the src/resolve.c correction to sqlite3.c because the Yocto + recipe source uses the amalgamated SQLite layout. +- Omitted test/auth.test because the extracted recipe source lacks the + upstream Tcl test tree. +- Omitted manifest and manifest.uuid because they are Fossil + repository metadata and are not needed in the source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 9338328be5..7761d83d08 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -107077,14 +107077,13 @@ lookupname_end: + #ifndef SQLITE_OMIT_AUTHORIZATION + if( db->xAuth ){ + if( pFJMatch ){ +- int ii; + assert( pExpr->op==TK_FUNCTION ); + assert( sqlite3_stricmp(pExpr->u.zToken,"coalesce")==0 ); + assert( pExpr->x.pList==pFJMatch ); + assert( pFJMatch->nExpr>0 ); +- for(ii=0; iinExpr; ii++){ +- assert( pFJMatch->a[0].pExpr->op==TK_COLUMN ); +- sqlite3AuthRead(pParse, pFJMatch->a[0].pExpr, pSchema, pNC->pSrcList); ++ for(i=0; inExpr; i++){ ++ assert( pFJMatch->a[i].pExpr->op==TK_COLUMN ); ++ sqlite3AuthRead(pParse,pFJMatch->a[i].pExpr,pSchema,pNC->pSrcList); + } + }else if( pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER ){ + sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList); +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb index 975f3bdab8..5a87ad4c6f 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb @@ -10,6 +10,10 @@ SRC_URI = "http://www.sqlite.org/2024/sqlite-autoconf-${SQLITE_PV}.tar.gz \ file://CVE-2025-7709.patch \ file://CVE-2025-70873.patch \ file://CVE-2026-11822_CVE-2026-11824.patch \ + file://CVE-2026-119377-dependent_p1.patch \ + file://CVE-2026-119377-dependent_p2.patch \ + file://CVE-2026-119377_p1.patch \ + file://CVE-2026-119377_p2.patch \ " SRC_URI[sha256sum] = "b2809ca53124c19c60f42bf627736eae011afdcc205bb48270a5ee9a38191531" From patchwork Fri Nov 6 08:53:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103243 Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.2176.1793955248702729751 for ; Fri, 06 Nov 2026 00:54:08 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Qit81qbA; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3784; q=dns/txt; s=iport01; t=1793955248; x=1795164848; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=iOx0oTRCkBUhaa9K2cZHlyA+K1wSYi5hhZsJeqS2pRg=; b=Qit81qbATtgKM5W/Q5uYN5ZxAoflugLuMM+y0C81E9a3++6D5VCpr3Dx UA/ZZosmp7K0dnzJ/83tVHrBjCo0+u8X2icOenKepj3H8CGSe0/O1ovvB VCdo+gOsqLv6g0ZEPJxjwUY8w1lqb8oTxjg2zRQQC5MbjzP2pfkNBBphk VLrzQWWE0OCzoBPI9uI9j1PmOE+3abBSw+bkueTVD5Ag4UeEMT2DrMdrH /Xxon5hGxl/Uj4SH1e6sadag+EjK4QCKSAju5lDBCYagOweqSw3QPkV/z v7jHado2Uk3Ho1SkjEfxEsV8uIaMCRK2QSyei1y+8rbwCvU7LS4O800lQ Q==; X-CSE-ConnectionGUID: ivy/GccHQV+tzEVzMT1lTA== X-CSE-MsgGUID: rTNqkCGPQkqr/6DvOaONSg== X-IPAS-Result: A0BJAgBxlO1q/5D/Ja1aHgEBCxIMggULgld1YENJlksDniEUgWoPAQEBD0QNBAEBhD9GAo4dAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBLRAcAwECFhkrIwgZCYJ5AYJ0AxG8AoF5M4EBgykBPwJDUNlLgWgBCxQBBYEzhUAyh3FdGAGEfScbgUlEhH6BBYFcAQGBGYEGhgcEgxwSgVoeZYwVAoFRhnlIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHQ5EDAeJC8FHCY+GwovGA1IESw3FRkEPm4Hkj2DEgGBDQEqAYI9o0SCIaERhCqBaIo8lToaM4VbpRYLmH2OCpZRhGmBaDyBRwsHMxoIGxWDIglKGQ+OLgsLg2CBf4MUxn0mMgIJMgEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:Jt7gg6xCez4ji6X33dJ6t+dhxyrEfRIJ4+MujC+fZmUNrF6WrkVTn 2JJWziDOqvfYTD1fd0ibt/n/EtUv5Tcy4IxGwY/rVhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWctaj9MsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJEAoLMo38e1XOF8N6 e41FiIoUkmHu8vjldpXSsE07igiBNPgMIVavjRryivUSK55B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cP3WjOX9PYH46tO6ynnjjazRwo1OOrq1x6G/WpOB0+OWxbYePK43WHq25mG6Cm kTf/E/WOigZLcbYlxab1XuLoNTAyHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rbyyjVSzc9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7GQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSv1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:o8bCT6jycU4/9XQdH9rJQzkTH3BQXgIji2hC6mlwRA09TyVXra +TdZMgpHjJYVkqOU3I9ersBEDEewK/yXcX2/h0AV7dZmnbUQKTRekIh7cKgQeQfhEWndQy6U 4PScRD4fTLfD5HZL7BkWqFOudl5sWb+6a1guqb5XJsQQZ2L5xE1W5Ce3+m+okcfng8OXL/f6 DsnvZ6mw== X-Talos-CUID: 9a23:gDIoi2ulJRSuvN/zxrJrAZiT6IskbGya43zbA3aGSnp7ZYOHbGPJ/J9Nxp8= X-Talos-MUID: 9a23:SWCvUgaBVFh5VOBTrQPKnTJJG/9R4L20Tx4hj7IPnO+/Onkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="545529943" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 08:54:07 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 98866180003FC; Fri, 6 Nov 2026 08:54:07 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id 40928CBF22E; Fri, 6 Nov 2026 00:54:07 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH 02/10] sqlite3: fix CVE-2026-119373 Date: Fri, 6 Nov 2026 00:53:57 -0800 Message-Id: <20261106085405.3517095-2-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106085405.3517095-1-arpitpa@cisco.com> References: <20261106085405.3517095-1-arpitpa@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 08:54:22 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249613 This patch applies the upstream fix [1], which prevents a buffer overflow when merging FTS5 detail=none prefix lists with negative docids. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80 [2] https://sqlite.org/src/info/a7f8c92f62 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119373 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119373.patch | 56 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.45.3.bb | 1 + 2 files changed, 57 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119373.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119373.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119373.patch new file mode 100644 index 0000000000..24401900dd --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119373.patch @@ -0,0 +1,56 @@ +From 2ea652e191b5fd3e2ff13eadd907519b74e3db94 Mon Sep 17 00:00:00 2001 +From: dan +Date: Tue, 4 Aug 2026 11:04:17 +0000 +Subject: [PATCH] In fts5, account for the possibility of negative docids when + allocating a buffer to store the results of merging detail=none prefix lists. + Fix for report [bugs:/info/2026-08-04T08:49:27Z | 2026-08-04T08:49:27Z]. + +FossilOrigin-Name: a7f8c92f623e9cbe8a61266d949916acc9e5110c94dff4aa6fd1ad2ea8a60d4e + +CVE: CVE-2026-119373 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80] + +Backport Changes: +- Applied the FTS5 fix from ext/fts5/fts5_index.c to sqlite3.c because + the recipe source uses the amalgamated SQLite layout. +- Omitted ext/fts5/test/fts5prefix2.test because the extracted source + does not include SQLite's Tcl test tree. +- Omitted manifest and manifest.uuid because they are Fossil + repository metadata and are not needed for this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 7761d83d08..9d5790a0d9 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -244833,7 +244833,7 @@ static void fts5MergeRowidLists( + (void)nBuf; + memset(&out, 0, sizeof(out)); + assert( nBuf==1 ); +- sqlite3Fts5BufferSize(&p->rc, &out, p1->n + p2->n); ++ sqlite3Fts5BufferSize(&p->rc, &out, p1->n + p2->n + 9); + if( p->rc ) return; + + fts5NextRowid(p1, &i1, &iRowid1); +@@ -244841,12 +244841,12 @@ static void fts5MergeRowidLists( + while( i1>=0 || i2>=0 ){ + if( i1>=0 && (i2<0 || iRowid1iOut ); +- fts5BufferSafeAppendVarint(&out, iRowid1 - iOut); ++ fts5BufferSafeAppendVarint(&out, (u64)iRowid1 - (u64)iOut); + iOut = iRowid1; + fts5NextRowid(p1, &i1, &iRowid1); + }else{ + assert( iOut==0 || iRowid2>iOut ); +- fts5BufferSafeAppendVarint(&out, iRowid2 - iOut); ++ fts5BufferSafeAppendVarint(&out, (u64)iRowid2 - (u64)iOut); + iOut = iRowid2; + if( i1>=0 && iRowid1==iRowid2 ){ + fts5NextRowid(p1, &i1, &iRowid1); +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb index 5a87ad4c6f..c591db4eaf 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb @@ -14,6 +14,7 @@ SRC_URI = "http://www.sqlite.org/2024/sqlite-autoconf-${SQLITE_PV}.tar.gz \ file://CVE-2026-119377-dependent_p2.patch \ file://CVE-2026-119377_p1.patch \ file://CVE-2026-119377_p2.patch \ + file://CVE-2026-119373.patch \ " SRC_URI[sha256sum] = "b2809ca53124c19c60f42bf627736eae011afdcc205bb48270a5ee9a38191531" From patchwork Fri Nov 6 08:53:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103244 Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.2177.1793955248827567715 for ; Fri, 06 Nov 2026 00:54:08 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Aud04IVe; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4293; q=dns/txt; s=iport01; t=1793955248; x=1795164848; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=C3wlhUPDCMwQIhpEcXI63pbn+mxVxF9lVfDs9Ue7IOw=; b=Aud04IVeBxpbFqzlWaamUsf/tUwpPqgSWIfpoQa/ZFI3bK7Pm1s9tg86 XtjorJ5moOF6uyECv5A+Qj1MwIUNQ/HywYmfVfrnpJtDVtWA3tzvzqFC7 MAKsbphG8te061Oufk0Gya5TTVPVNmoOQOii3ygVH9B/s3dEX7d1JGAGB 2/GvUIqxM32WqTaQuaMLmN2kPYxAclQOU8PdfiCOlYrZRRnBcr8uXSaMz GwMj2m+74PgdGTm/2ZlLZhp8X6MOpH2SzvDwAhHdEjF3gvTH4Mu0px8/q CBCvvcYFn0qwKuMGvw2j5QgJKD3S65U4JILzGUViv8uUEXkevQJLvi+Ln Q==; X-CSE-ConnectionGUID: o6TTV883R9Kli0oprd3t9w== X-CSE-MsgGUID: aWmJbH7MRLiNx9Y4NYNsyA== X-IPAS-Result: A0AnAABUle1q/5H/Ja1aHQEBAQEJARIBBQUBgXwIAQsBglZ1YENJjHKJWQOeIYF+DwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAS0QHAMBAi8rIwgZCYJ5AYJ0AxG8BoF5M4EBgmZDAT8CQ1DZS4FoAQsUAQWBMwGFPzKHcV0YAYR9JxuBSUSEfoEFgVwBAYgmBIMcEoFaHox6AoFRhnlIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHQ5EDAeJC8FHCY+GwovGA1IESw3FRkEPm4Hkj2DEgE8UQEqAYEFQGIWo0SCIaERhCqBaIo8lToaM4VbpRYLmH2OCpZRhGmBaDxGgQELBzMaCBsVgyIJShkPjisDCwuDYIF/gxTGfSYyAgkyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:gqCiXqlHCiZZicsPSAvfvmLo5gzXJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xIXWGrTOPyLMWPze993Ot6+90NS7JCDydNlQAE5pCw2RFtH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4Errav6+/SEUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZK31GONgWYubDtNs//b8XuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05FYpGxtpJUTEVz 607LDFVaQiZi7mqka3uH4GAhux7RCXqFJkUtnclyXTSCuwrBMiTBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQTZz/7C7pm9AusrnDlazxEsFu9rqss6G+Vxwt0uFToGIeJJo3aGJsNzy50o ErPwGHbCDFFEea7yByVo0PwoN7phjLSDdd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzBUCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3uz8Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:hXLbDq4liktXvUP1fgPXwBDXdLJyesId70hD6qm+c3Nom6uj5q eTdZsgtCMc5Ax9ZJhko6HjBEDiewK5yXcK2+ks1N6ZNWGM0ldAbrsSiLcKqAePJ8SRzIJgPI 5bAs5D4aXLfDtHpPe/xhWkGNA9x9TC2qWpieDCi0pJd2hRGthdB8MTMHfhLqWwLzM2faYEKA == X-Talos-CUID: 9a23:4954FG2QlfFv14iij0EveLxfHZ4ZTkONnCzqcmy8CD5uUKeZEkPB5/Yx X-Talos-MUID: 9a23:6bA41wXKIxl3R4/q/DbTgRNoFJhN2YCvLlBcoMkgiu+fJAUlbg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="544985609" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 08:54:07 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id 9B0F9180001E4; Fri, 6 Nov 2026 08:54:07 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id 477FBCBF22F; Fri, 6 Nov 2026 00:54:07 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH 03/10] sqlite3: fix CVE-2026-119374 Date: Fri, 6 Nov 2026 00:53:58 -0800 Message-Id: <20261106085405.3517095-3-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106085405.3517095-1-arpitpa@cisco.com> References: <20261106085405.3517095-1-arpitpa@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 08:54:22 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249614 This patch applies the upstream fix [1], which addresses an FTS5 secure-delete buffer overrun when handling a corrupted database. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9 [2] https://sqlite.org/src/info/9cd4f9e920 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119374 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119374.patch | 78 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.45.3.bb | 1 + 2 files changed, 79 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch new file mode 100644 index 0000000000..cf4dd9cb32 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch @@ -0,0 +1,78 @@ +From 6875e24f0c0612feccb97ab4c3f92c8444833373 Mon Sep 17 00:00:00 2001 +From: dan +Date: Tue, 11 Aug 2026 14:16:12 +0000 +Subject: [PATCH] Fix a problem in fts5 secure-delete code that could lead to a + buffer overrun when dealing with a strategically corrupted database. Problem + reported by YEONBA. + +FossilOrigin-Name: 9cd4f9e9205c5a5096388397a39349db9ff5377d19095c6b20388ff799969c31 + +CVE: CVE-2026-119374 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9] + +Backport Changes: +- Applied the fix from ext/fts5/fts5_index.c to sqlite3.c because the + recipe uses SQLite's amalgamated source. +- Used p->rc = FTS5_CORRUPT; because current version of SQLite does + not define the newer FTS5_CORRUPT_IDX(p) helper. +- Omitted ext/fts5/test/fts5corruptB.test because the extracted source + does not include the upstream Tcl test tree. +- Omitted manifest and manifest.uuid because they are Fossil metadata + and are not needed for this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 9d5790a0d9..a397e4d36b 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -244270,32 +244270,36 @@ static void fts5DoSecureDelete( + if( p->rc==SQLITE_OK ){ + const int nMove = nPg - iNextOff; /* Number of bytes to move */ + int nShift = iNextOff - iOff; /* Distance to move them */ +- ++ int nNewPg = 0; + int iPrevKeyOut = 0; +- int iKeyIn = 0; ++ i64 iKeyIn = 0; + + memmove(&aPg[iOff], &aPg[iNextOff], nMove); + iPgIdx -= nShift; +- nPg = iPgIdx; ++ nNewPg = iPgIdx; + fts5PutU16(&aPg[2], iPgIdx); + + for(iIdx=0; iIdxnPg ){ ++ p->rc = FTS5_CORRUPT; ++ break; ++ } + if( iKeyIn!=iDelKeyOff ){ + int iKeyOut = (iKeyIn - (iKeyIn>iOff ? nShift : 0)); +- nPg += sqlite3Fts5PutVarint(&aPg[nPg], iKeyOut - iPrevKeyOut); ++ nNewPg += sqlite3Fts5PutVarint(&aPg[nNewPg], iKeyOut - iPrevKeyOut); + iPrevKeyOut = iKeyOut; + } + } + +- if( iPgIdx==nPg && nIdx>0 && pSeg->iLeafPgno!=1 ){ ++ if( p->rc==SQLITE_OK && iPgIdx==nNewPg && nIdx>0 && pSeg->iLeafPgno!=1 ){ + fts5SecureDeleteIdxEntry(p, iSegid, pSeg->iLeafPgno); + } + +- assert_nc( nPg>4 || fts5GetU16(aPg)==0 ); +- fts5DataWrite(p, FTS5_SEGMENT_ROWID(iSegid,pSeg->iLeafPgno), aPg, nPg); ++ assert_nc( nNewPg>4 || fts5GetU16(aPg)==0 ); ++ fts5DataWrite(p, FTS5_SEGMENT_ROWID(iSegid,pSeg->iLeafPgno), aPg, nNewPg); + } + sqlite3_free(aIdx); + } +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb index c591db4eaf..0476c71cae 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb @@ -15,6 +15,7 @@ SRC_URI = "http://www.sqlite.org/2024/sqlite-autoconf-${SQLITE_PV}.tar.gz \ file://CVE-2026-119377_p1.patch \ file://CVE-2026-119377_p2.patch \ file://CVE-2026-119373.patch \ + file://CVE-2026-119374.patch \ " SRC_URI[sha256sum] = "b2809ca53124c19c60f42bf627736eae011afdcc205bb48270a5ee9a38191531" From patchwork Fri Nov 6 08:53:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103242 Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.2175.1793955248651963828 for ; Fri, 06 Nov 2026 00:54:08 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=VFuk9qPy; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3235; q=dns/txt; s=iport01; t=1793955248; x=1795164848; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=zju3WPbpgQWVaF2lVrqN3+LC7M1Xvoq5Mv9Q0eVgjhU=; b=VFuk9qPyvfPqcMQhqlNTm6mdFeYJoMGrviWFyUH6rlzkrkFFkcgO23tL Ra8zVz0TvAjkJjjUs4waDoodmCEOQknRPtn4hzFKhrrktdjxtya6s5D0r BH98Ak1LHxgC2s0k/RGFwDXXUomJOdVsffr3o+BdEeMXLvWhUiXQRkDc5 Fuq4AF30CwpqMR7pDG10YmGIBrOFhkGm7faA/2EcOsNw/SRhhFUN8IgvU ZuciH5vbhMp+rfXK+BT84eGIkPsmCCMmR2inVEEQWiWofD18nkiWBRnnb d2GNLCPX48FDFPO8/vjIZghgGGTk43E9pajD4L5xmFgCD1n40Zy2FbmsY w==; X-CSE-ConnectionGUID: x8hTQ2HnSdO3wYtM1j5O/g== X-CSE-MsgGUID: f0hgo3lfSEKnkhcf2vtjUQ== X-IPAS-Result: A0BJAgDmlO1q/4v/Ja1aglmCV3VgQ0mWSwOeIYF+DwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAS0QHAMBAi8rIwgZCYJ5AYJ0AxG8BoF5M4EBgykBPwJDUNlLgWgBCxQBBYEzhUAyh3FdGAGEfScbgUlEhH6BBYFcAQGBJ4Z/BIMcEoFaHox6AoFRhnlIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHQ5EDAeJC8FHCY+GwovGA1IESw3FRkEPm4Hkj2DEQEBgQ0BKgGCBTijRIIhoRGEKoFoijyVOhozhASUGZJUC5h9jgqWUYRpgWg8RoEBCwczGggbFYMiCUoZD44uCwuDYIF/gxTGfSYyAgkyAQEHAgcOAwuBaJAAgX4BAQ IronPort-Data: A9a23:8yaJe6+CGhUzG37nibayDrUD1n+TJUtcMsCJ2f8bNWPcYEJGY0x3x 2sXXWjTO/zYN2H3fd1xPd639RlQupHVztQxSwJoripEQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtazpJs/vrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2kmbY0kw7xXB1pC0 qcHGSwoNxLeoKW5lefTpulE3qzPLeHxN48Z/3UlxjbDALN+G9bIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZOEwn1lQ/UPrSmM+hnGH+byVRgFmUvqEwpWPUyWSd1ZCwbIaOK4zTH5s9ckCwq DrG8GOiBh8hGf+ZyjqO/Ciymu3ypHauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8gUmkVvpbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBXC4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rEnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:gVLRs6iRdMyZ7KqiT7534TRb0HBQXgIji2hC6mlwRA09TyVXra +TdZMgpHjJYVkqOU3I9ersBEDEewK/yXcX2/h0AV7dZmnbUQKTRekIh7cKgQeQfhEWndQy6U 4PScRD4fTLfD5HZL7BkWqFOudl5sWb+6a1guqb5XJsQQZ2L5xE1W5Ce3+m+okcfng8OXL/f6 DsnvZ6mw== X-Talos-CUID: 9a23:m91QUWhC541scAbQVbPyNZZUojJuYi3d8E6KA0mDBUEyV4yJbAaSpYQjnJ87 X-Talos-MUID: 9a23:VJVGzAurxDX8ekZhns2nimliO8Az56qVJWMLkpUNtZOaKS5NAmLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="544398126" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 08:54:07 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id A06D918000206; Fri, 6 Nov 2026 08:54:07 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id 4B7A6CBF230; Fri, 6 Nov 2026 00:54:07 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH 04/10] sqlite3: fix CVE-2026-119375 Date: Fri, 6 Nov 2026 00:53:59 -0800 Message-Id: <20261106085405.3517095-4-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106085405.3517095-1-arpitpa@cisco.com> References: <20261106085405.3517095-1-arpitpa@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 08:54:22 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249612 This patch applies the upstream fix [1], which fully initializes the page read when the WAL and database page sizes differ, preventing disclosure of uninitialized page data. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e [2] https://sqlite.org/src/info/f9b4ee369557c36c Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119375 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119375.patch | 47 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.45.3.bb | 1 + 2 files changed, 48 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119375.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119375.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119375.patch new file mode 100644 index 0000000000..390a3f5234 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119375.patch @@ -0,0 +1,47 @@ +From c9e05db641c387aad309081b35afa3e703aa075d Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Sun, 16 Aug 2026 10:49:39 +0000 +Subject: [PATCH] When reading a frame from a WAL file where the WAL pagesize + and the database pagesize disagree, be sure to fully initialize the page that + is read. + +FossilOrigin-Name: f9b4ee369557c36c606666bd7e6d8dc4685d87531993d3ce4e7a718aa814a5ac + +CVE: CVE-2026-119375 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e] + +Backport Changes: +- Applied the src/wal.c change to sqlite3.c because the recipe source + uses the amalgamated SQLite layout. +- Omitted manifest and manifest.uuid because they are Fossil + repository metadata and are not needed in this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/sqlite3.c b/sqlite3.c +index a397e4d36b..afcf2b1969 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -68201,11 +68201,15 @@ SQLITE_PRIVATE int sqlite3WalReadFrame( + i64 iOffset; + sz = pWal->hdr.szPage; + sz = (sz&0xfe00) + ((sz&0x0001)<<16); ++ if( nOut>sz ){ ++ memset(pOut+sz, 0, nOut-sz); ++ nOut = sz; ++ } + testcase( sz<=32768 ); + testcase( sz>=65536 ); + iOffset = walFrameOffset(iRead, sz) + WAL_FRAME_HDRSIZE; + /* testcase( IS_BIG_INT(iOffset) ); // requires a 4GiB WAL */ +- return sqlite3OsRead(pWal->pWalFd, pOut, (nOut>sz ? sz : nOut), iOffset); ++ return sqlite3OsRead(pWal->pWalFd, pOut, nOut, iOffset); + } + + /* +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb index 0476c71cae..db92177c08 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb @@ -16,6 +16,7 @@ SRC_URI = "http://www.sqlite.org/2024/sqlite-autoconf-${SQLITE_PV}.tar.gz \ file://CVE-2026-119377_p2.patch \ file://CVE-2026-119373.patch \ file://CVE-2026-119374.patch \ + file://CVE-2026-119375.patch \ " SRC_URI[sha256sum] = "b2809ca53124c19c60f42bf627736eae011afdcc205bb48270a5ee9a38191531" From patchwork Fri Nov 6 08:54:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103238 Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.2175.1793955248651963828 for ; Fri, 06 Nov 2026 00:54:09 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=bcTWrIr/; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4160; q=dns/txt; s=iport01; t=1793955249; x=1795164849; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=4IPuIPXUgvXyKrDQ8L4aT6Nvl7IoU2/wyoXnSdaWTmE=; b=bcTWrIr/7msQJQMj7eehbd398+jvnDBqpOI0Npz5gq1yBo5ai9WBx/SC OVjcYA/W4TOAkhwe2TXtoaNJQCYRHQLG3gUO2O+gNozWbS73RX/JSZr6l 9Q0VWFN2gxzMYctrSx7a1AmhIFcvzoA482BZdLkkZkc7OnH9Eml+7KXKV bz88oLNZ34bwpmbSfqMIoOSFKCZmYvKMLawKVWQ5SG00O0z02cTzxV8r7 chg4T/72KoU9eH7tzRHWDqspcHAME3OyWesCUCeMiS/jGCKGmMlOyaWU5 St1LXsD+oElLC1Cu8eADd52IRWRROS1vf7zbgM4NI01o9xvgKrTSiniAb A==; X-CSE-ConnectionGUID: MN89+SbqSRiW9NxypPjT2A== X-CSE-MsgGUID: QFa+gox2RVCg/yT1Ho9IZw== X-IPAS-Result: A0BJAgDmlO1q/4//Ja1aglmCV3VgQ0mWSwOeIYF+DwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAS0QHAMBAi8rIwgZCYJ5AYJ0AxG8BoF5M4EBgmZDAT8CQ1DZS4FoAQsUAQWBM4VAModxXRgBhH0nG4FJRIJQgi6BBYFcAQGIJgSDHBKBWh6MegKBUYZ5SIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXQEhgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQx0ORAwHiQvBRwmPhsKLxgNSBEsNxUZBD5uB5I9gxIBPFEBKgGCBDYDkwCQRIIhoRGEKoFoijyVOhozhVulFguYfY4KllGEaYFoPIFHCwczGggbFYMiCUoZD44uCwuDYIF/gxTGfSYyAgkyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:rQBQGKIaAx+tQabYFE+Rh5QlxSXFcZb7ZxGr2PjKsXjdYENSgWECn WcWX2qGbvuLa2DwLYpzboiy80IDupbcmIUxSFcd+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8gmYpajt8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN1LKhFnfrYS491NAF4f0 +wJMAgPUkqq0rfeLLKTEoGAh+w5J8XteYdasXZ6wHSBU7AtQIvIROPB4towMDUY358VW62BI ZBENHw2ME+ojx5nYj/7DLo3hv+pmmH2WzZZs1mS46Ew5gA/ySQsjOS2YYqMIIPiqcN9p2iR5 W3B7z7DPDoVc82jkBqCo1Oembqa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++MvUCSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXPIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:l6S75684mrAfbj1EwChuk+AAI+orL9Y04lQ7vn2ZhyY7TiX+rb HIoB11737JYVoqNU3I3OrwWpVoIkmskaKdn7NwAV7KZmCP0wGVxcNZnO7fKlbbdREWmNQw6U 5ISdkZNDSJNykYse/KpC+lDt0n3N6LtIqshevY0jNRaDsCUdAY0++8YTzraXGfg2J9dOIEKK Y= X-Talos-CUID: 9a23:K+I+82H/UWMQ7bnEqmJC0h5FWfsva0bnzUiBBV+pEV5rdOe8HAo= X-Talos-MUID: 9a23:kbQjGg6v7TVjUDxsfP6fDl8kxoxRza3tB0cdy684kMbDJBApGzDMrQaoF9o= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="544398127" Received: from rcdn-l-core-06.cisco.com ([173.37.255.143]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 08:54:07 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-06.cisco.com (Postfix) with ESMTPS id A47301800025A; Fri, 6 Nov 2026 08:54:07 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id 4FB23CBF231; Fri, 6 Nov 2026 00:54:07 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH 05/10] sqlite3: fix CVE-2026-119379 Date: Fri, 6 Nov 2026 00:54:00 -0800 Message-Id: <20261106085405.3517095-5-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106085405.3517095-1-arpitpa@cisco.com> References: <20261106085405.3517095-1-arpitpa@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-06.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 08:54:21 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249618 This patch applies the upstream fix [1], which prevents a buffer overrun when applying a strategically corrupted changeset through SQLite's session extension. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52 [2] https://sqlite.org/src/info/3f57024aecea0f3b Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119379 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119379.patch | 78 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.45.3.bb | 1 + 2 files changed, 79 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119379.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119379.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119379.patch new file mode 100644 index 0000000000..19e36effc5 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119379.patch @@ -0,0 +1,78 @@ +From 17e3b5a6f6c3a5e852a86597ad68f259d802296a Mon Sep 17 00:00:00 2001 +From: dan +Date: Mon, 17 Aug 2026 11:31:59 +0000 +Subject: [PATCH] Avoid a buffer overrun when processing a strategically + corrupted changeset. Report [bugs:/info/2026-08-16T10:15:25Z | + 2026-08-16T10:15:25Z]. + +FossilOrigin-Name: 3f57024aecea0f3b565ed823cf94b085031c481fd6323c1f2e4319a53500864f + +CVE: CVE-2026-119379 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52] + +Backport Changes: +- Applied the ext/session/sqlite3session.c fix to sqlite3.c because + the recipe source uses the amalgamated SQLite layout. +- Omitted ext/session/sessioncorrupt.test because the extracted source + does not include the upstream test tree. +- Omitted manifest and manifest.uuid because they are Fossil + metadata and are not required for this backport. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 52bd4aa19c..8cbe1d3ec7 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -228425,9 +228425,9 @@ static int sessionChangesetApply( + int schemaMismatch = 0; + int rc = SQLITE_OK; /* Return code */ + const char *zTab = 0; /* Name of current table */ +- int nTab = 0; /* Result of sqlite3Strlen30(zTab) */ + SessionApplyCtx sApply; /* changeset_apply() context object */ + int bPatchset; ++ int bNew = 0; /* True for first entry of new table */ + + assert( xConflict!=0 ); + +@@ -228443,15 +228443,16 @@ static int sessionChangesetApply( + if( rc==SQLITE_OK ){ + rc = sqlite3_exec(db, "PRAGMA defer_foreign_keys = 1", 0, 0, 0); + } +- while( rc==SQLITE_OK && SQLITE_ROW==sqlite3changeset_next(pIter) ){ ++ while( rc==SQLITE_OK && SQLITE_ROW==sessionChangesetNext(pIter, 0, 0,&bNew) ){ + int nCol; + int op; + const char *zNew; + + sqlite3changeset_op(pIter, &zNew, &nCol, &op, 0); + +- if( zTab==0 || sqlite3_strnicmp(zNew, zTab, nTab+1) ){ ++ if( bNew ){ + u8 *abPK; ++ bNew = 0; + + rc = sessionRetryConstraints( + db, pIter->bPatchset, zTab, &sApply, xConflict, pCtx +@@ -228486,7 +228487,6 @@ static int sessionChangesetApply( + rc = SQLITE_NOMEM; + break; + } +- nTab = (int)strlen(zTab); + sApply.azCol = (const char **)zTab; + }else{ + int nMinCol = 0; +@@ -228538,7 +228538,6 @@ static int sessionChangesetApply( + sApply.bStat1 = 0; + } + } +- nTab = sqlite3Strlen30(zTab); + } + } + +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb index db92177c08..e852ff79d8 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb @@ -17,6 +17,7 @@ SRC_URI = "http://www.sqlite.org/2024/sqlite-autoconf-${SQLITE_PV}.tar.gz \ file://CVE-2026-119373.patch \ file://CVE-2026-119374.patch \ file://CVE-2026-119375.patch \ + file://CVE-2026-119379.patch \ " SRC_URI[sha256sum] = "b2809ca53124c19c60f42bf627736eae011afdcc205bb48270a5ee9a38191531" From patchwork Fri Nov 6 08:54:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103236 Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.2130.1793955248964473815 for ; Fri, 06 Nov 2026 00:54:09 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=BvEcdedw; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3678; q=dns/txt; s=iport01; t=1793955248; x=1795164848; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=tfkKrpR7b6e6nDqaM1xkZmp5PlksRGenjC8v99jY0dI=; b=BvEcdedwvS5TZiDFCUxSZe16wFD/1zfzvNFpTic7EHNxhy2ocSi1lyiC 0RwxFaKyvn9vPbgi1B77Shg8oIikV+yK2BzoeKr0Rka1N/oCpyHRm5W0k 46DKd8kseEq71Ozz4X+CBbBLsGvjTa7ambb4wYG+aaKd78pGZPumfHLlM A9nzKQFqpveZ9uzzLOFCsIHi5+dKYlHeFPycQQjViRBJyuexJXJpTV4JX BKFG+zj3TME7LvTGTOF8IPEbkVoZCDN8UKaOySZueiug2C5KBhXbm5e0j 3gy2jVl/jXr6y5BHs10DHJsS6ZjKIMQsAvSBq5qh2CT0HMjXOzC+TupOz A==; X-CSE-ConnectionGUID: vX4AmXq1T6SuOl2v5blaqw== X-CSE-MsgGUID: KlMLNAniTjWGYBANWkeMLA== X-IPAS-Result: A0AnAADmlO1q/4r/Ja1aHQEBAQEJARIBBQUBgXwIAQsBglZ1YENJjHKJWQOeIYF+DwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAS0QHAMBAi8rIwgZCYJ5AYJ0AxG8BoF5M4EBgykBPwJDUNlLgWgBCxQBBYEzAYU/ModxXRgBhH0nG4FJRIR+gQWBXAEBiCYEgxwSgVoejHoCgVGGeUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF0BIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZAsaBWEIAg0MdDkQMB4kLwUcJj4bCi8YDUgRLDcVGQQ+bgeSPYMLBwGBDQETFwGBBUB4kwCQRIIhoRGEKoFoijyVOhozhVulFguYfY4KllGEaYFoPIFHCwczGggbFYMiCUoZD44rAwsLg2CBf4MUxn0mMgIJMgEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:034Geaveh/f3/UFa59lnoWMSFufnVABfMUV32f8akzHdYApBsoF/q tZmKT+FO/vfZTf2Ld12YNzj9UkC7cPVmNQxSwZurXgzQSxGgMeUXt7xwmUckM+xwmwvaGo9s q3yv/GZdJhcokf0/0nrb/656yYsjclkf5KkYMbcICd9WAR4fykojBNnioYRj5Vh6TSDK1vlV eja/YuFZzdJ5xYuajhKsvvb9Us21BjPkGpwUmIWNKgjUGD2zxH5PLpHTYmtIn3xRJVjH+LSb 47r0LGj82rFyAwmA9Wjn6yTWhVirmn6ZFXmZtJ+AsBOszAazsAA+v9T2Mk0NS+7vw60c+VZk 72hg3AfpTABZcUgkMxFO/VR/roX0aduoNcrKlDn2SCfItGvn3bEm51T4E8K0YIw5NYrKGR+7 KUkdgsQSRTZmb+8xLuiVbw57igjBJGD0II3oHpsy3TdSP0hW52GG/yM7t5D1zB2jcdLdRrcT 5NGMnw0M1KaPkAJYwxHYH49tL/Aan3XeidAqU6NrII84nPYy0p6172F3N/9J4DXHp0KxhrDz o7A10f9JzU8Hdqe9Ti63UOGr8nwni7efKtHQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHtlYM UE8/is1sbN081SmSNT4VRC0rHOI+BkGVLJt//YS8gqBzO/Qpg2eHGVBFmcHY909v8hwTjsvv rOUo+7U6fVUmOX9YRqgGn289Fte5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:of37Vq//K1l3ZpmYmcluk+AAI+orL9Y04lQ7vn2ZhyY7TiX+rb HIoB11737JYVoqNU3I3OrwWpVoIkmskaKdn7NwAV7KZmCP0wGVxcNZnO7fKlbbdREWmNQw6U 5ISdkZNDSJNykYse/KpC+lDt0n3N6LtIqshevY0jNRaDsCUdAY0++8YTzraXGfg2J9dOIEKK Y= X-Talos-CUID: 9a23:pFZj+2Mkx20QEe5DRhk73UskA5kZLEbA63OKPRKyDW9wV+jA X-Talos-MUID: 9a23:Ar+xSQhZ8HqQvvqNW1MpNMMpF8NNx4KHDkExk6opiuOtExNzNhK5pWHi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="545307043" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 08:54:08 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 01FA8180001DB; Fri, 6 Nov 2026 08:54:08 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id 53EE4CBF23C; Fri, 6 Nov 2026 00:54:07 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH 06/10] sqlite3: fix CVE-2026-119372 Date: Fri, 6 Nov 2026 00:54:01 -0800 Message-Id: <20261106085405.3517095-6-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106085405.3517095-1-arpitpa@cisco.com> References: <20261106085405.3517095-1-arpitpa@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 08:54:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249617 This patch applies the upstream fix [1], which prevents a use-after-free in FTS3 snippet() processing. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731 [2] https://sqlite.org/src/info/e4635c41536a Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119372 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119372.patch | 56 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.45.3.bb | 1 + 2 files changed, 57 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119372.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119372.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119372.patch new file mode 100644 index 0000000000..96a9fdab6c --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119372.patch @@ -0,0 +1,56 @@ +From a5fe767d0ba12d3082bd22b3c5341fdb6cc6ef95 Mon Sep 17 00:00:00 2001 +From: dan +Date: Mon, 17 Aug 2026 13:55:38 +0000 +Subject: [PATCH] Avoid a problem causing a use-after-free in the fts3 + snippet() function. Report [bugs:/info/2026-08-17T09:18:24Z | + 2026-08-17T09:18:24Z]. + +FossilOrigin-Name: e4635c41536a0b3620780c3f1c872de33121370bafb608fce9fe7e3113e2ae01 + +CVE: CVE-2026-119372 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731] + +Backport Changes: +- Applied the ext/fts3/fts3_snippet.c fix to sqlite3.c because the + recipe source uses the amalgamated SQLite layout. +- Omitted test/fts3snippet2.test because the extracted source does not + include the upstream Tcl test tree. +- Omitted manifest and manifest.uuid because they are Fossil + repository metadata and are not needed for this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 8cbe1d3ec7..62a8d5128b 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -201458,6 +201458,7 @@ static int fts3BestSnippet( + sqlite3_int64 nByte; /* Number of bytes of space to allocate */ + int iBestScore = -1; /* Best snippet score found so far */ + int i; /* Loop counter */ ++ Fts3Expr *pExpr = pCsr->pExpr; + + memset(&sIter, 0, sizeof(sIter)); + +@@ -201486,9 +201487,12 @@ static int fts3BestSnippet( + sIter.nSnippet = nSnippet; + sIter.nPhrase = nList; + sIter.iCurrent = -1; +- rc = sqlite3Fts3ExprIterate( +- pCsr->pExpr, fts3SnippetFindPositions, (void*)&sIter +- ); ++ rc = sqlite3Fts3ExprIterate(pExpr, fts3SnippetFindPositions, (void*)&sIter); ++ if( rc==SQLITE_OK ){ ++ /* Iterate through the expression twice, in case pointers garnered during ++ ** the first iteration are invalidated by a call to fts5EvalRestart(). */ ++ rc = sqlite3Fts3ExprIterate(pExpr, fts3SnippetFindPositions, (void*)&sIter); ++ } + if( rc==SQLITE_OK ){ + + /* Set the *pmSeen output variable. */ +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb index e852ff79d8..eabc6566c2 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb @@ -18,6 +18,7 @@ SRC_URI = "http://www.sqlite.org/2024/sqlite-autoconf-${SQLITE_PV}.tar.gz \ file://CVE-2026-119374.patch \ file://CVE-2026-119375.patch \ file://CVE-2026-119379.patch \ + file://CVE-2026-119372.patch \ " SRC_URI[sha256sum] = "b2809ca53124c19c60f42bf627736eae011afdcc205bb48270a5ee9a38191531" From patchwork Fri Nov 6 08:54:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103237 Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.2178.1793955248973552344 for ; Fri, 06 Nov 2026 00:54:09 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=c7UF53am; spf=pass (domain: cisco.com, ip: 173.37.86.80, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3653; q=dns/txt; s=iport01; t=1793955249; x=1795164849; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=HD1D7l58QQoxxpM5Ru2ZuBsIYyRjEg2JlvKYtRGz2JI=; b=c7UF53amLgW9cTzoVsxWwacafMNac0dc+FMAJ5Mm6JSUJwemkjBQnVq8 zo+4xRGk4qdgEXnWkwHuqwkIteZ/qWPkfdBaHDfjTK+xfN1WyNybq91Pt CksRiYwgfImcBvL8oFjO+GFRkdnaAYwJSbPDSHJyVTKlSUOCJ13r3CYii XeBHEj9SimbaXFja4DMC5vNnFMLC/WMQP6zzsdilmVywrIJ5QcqpIRy5R faKX27BD0n96Wf39uy9b00CkeiNSLa8nxxGlpQO/jGu87KrYXcoFY10Fm Qa+uhRr5r+ZC5BnFraBFHSYE/GK1Kl6yMZNOl1zS45Pgw4A38f4B6Pry8 Q==; X-CSE-ConnectionGUID: r5mnAh2IQDO0VTXyED4FWA== X-CSE-MsgGUID: hxPZEq+dRim8RWCKTEIEKA== X-IPAS-Result: A0BJAgBUle1q/4v/Ja1aglmCV3VgQ0mWSwOeIYF+DwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAS0QHAMBAi8rIwgZCYJ5AYJ0AxG8BoF5M4EBgmZDAT8CQ1DZS4FoAQsUAQWBM4VAModxXRgBhH0nG4FJRIQIdoEFgVwBAYEnhn8EgxwSgVoejHoCgVGGeUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF0BIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZAsaBWEIAg0MdDkQMB4kLwUcJj4bCi8YDUgRLDcVGQQ+bgeSPYMLBwEsRxoBExcBgUV4kwCQRIIhoRGEKoFoijyVOhozhVulFguYfY4KllGEaYFoPIFHCwczGggbFYMiCUoZD44tAQsLg2CBf4MUxn0mMgIJMgEBBwIHDgMLgWiQAIF+AQE IronPort-Data: A9a23:d/NQyamCpFDMHZPdt6gJ1JXo5gzXJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xIcWm6BP/jeNGT1fI0ia4/j/EgGvMTSnd8xSwA5qSxgRltH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4Errav6+/SEUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZK31GONgWYubDtNs//b8XuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05FZdF/+BeATtvz NA/cA4xXgGuq76Y/5vuH4GAhux7RCXqFJkUtnclyXTSCuwrBMiZBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQUaz/7C7pm9AusrnDlazxEsFu9rqss6G+Vxwt0uFToGIeJJoXQHpQIwy50o ErG71zLLwhZOOaezGq/zVmPusLusADSDdd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzBeCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3u78Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:/0ldTa5e6bGLeJro2QPXwBDXdLJyesId70hD6qm+c3Nom6uj5q eTdZsgtCMc5Ax9ZJhko6HjBEDiewK5yXcK2+ks1N6ZNWGM0ldAbrsSiLcKqAePJ8SRzIJgPI 5bAs5D4aXLfDtHpPe/xhWkGNA9x9TC2qWpieDCi0pJd2hRGthdB8MTMHfhLqWwLzM2faYEKA == X-Talos-CUID: 9a23:P/J7jGz67hjun4Zp2w8LBgUOR8UjW32H7U78BBeGNVZ4ZZHJZ2C5rfY= X-Talos-MUID: 9a23:QZ/3jA/wrmcoQF0L+j4BBe+Qf8d425aDEQMBq5QD6/O7Hg9MFhawrx3iFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="544123955" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-9.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 08:54:08 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id 051B218000206; Fri, 6 Nov 2026 08:54:08 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id 58951CBF23D; Fri, 6 Nov 2026 00:54:07 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH 07/10] sqlite3: fix CVE-2026-119378 Date: Fri, 6 Nov 2026 00:54:02 -0800 Message-Id: <20261106085405.3517095-7-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106085405.3517095-1-arpitpa@cisco.com> References: <20261106085405.3517095-1-arpitpa@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 08:54:21 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249615 This patch applies the upstream fix [1], which prevents a use-after-free in R-Tree when a manipulated shadow-table schema causes sqlite3_last_insert_rowid() to return 0. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04 [2] https://sqlite.org/src/info/6a9e1415659f9e75 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119378 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119378.patch | 52 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.45.3.bb | 1 + 2 files changed, 53 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119378.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119378.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119378.patch new file mode 100644 index 0000000000..98937c7bc9 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119378.patch @@ -0,0 +1,52 @@ +From 347b0263ce597345446fcfd259d063ef86228191 Mon Sep 17 00:00:00 2001 +From: dan +Date: Thu, 24 Sep 2026 20:14:31 +0000 +Subject: [PATCH] Avoid a use-after-free problem in rtree triggered by an + attacker manipulating the shadow table schema to ensure + sqlite3_last_insert_rowid() returns 0 after certain INSERTs. Problem reported + by Claude and Ada Logics. + +FossilOrigin-Name: 6a9e1415659f9e75940b3c3a6f6e123f61c5e9e2a7a612693ee395d7b7567bef + +CVE: CVE-2026-119378 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04] + +Backport Changes: +- Applied the ext/rtree/rtree.c fix to sqlite3.c because the recipe + source uses the amalgamated SQLite layout. +- Omitted ext/rtree/rtreeI.test because the extracted source does not + include the upstream test tree. +- Omitted manifest and manifest.uuid because they are Fossil + repository metadata and are not needed for this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 62a8d5128b..4b1c310fd6 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -209661,7 +209661,17 @@ static int nodeWrite(Rtree *pRtree, RtreeNode *pNode){ + sqlite3_bind_null(p, 2); + if( pNode->iNode==0 && rc==SQLITE_OK ){ + pNode->iNode = sqlite3_last_insert_rowid(pRtree->db); +- nodeHashInsert(pRtree, pNode); ++ if( pNode->iNode==0 ){ ++ /* If the SQL statement has succeeded but sqlite3_last_insert_rowid() ++ ** returns 0, then the shadow table schema has been corrupted somehow ++ ** (e.g. the %_node table has been replaced by a WITHOUT ROWID table). ++ ** It would be dangerous to continue in this case as the hash table ++ ** implementation assumes iNode==0 means that the node is not part ++ ** of the hash table. */ ++ rc = SQLITE_CORRUPT_VTAB; ++ }else{ ++ nodeHashInsert(pRtree, pNode); ++ } + } + } + return rc; +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb index eabc6566c2..2ad46aa5f2 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb @@ -19,6 +19,7 @@ SRC_URI = "http://www.sqlite.org/2024/sqlite-autoconf-${SQLITE_PV}.tar.gz \ file://CVE-2026-119375.patch \ file://CVE-2026-119379.patch \ file://CVE-2026-119372.patch \ + file://CVE-2026-119378.patch \ " SRC_URI[sha256sum] = "b2809ca53124c19c60f42bf627736eae011afdcc205bb48270a5ee9a38191531" From patchwork Fri Nov 6 08:54:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103235 Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.2129.1793955248950874260 for ; Fri, 06 Nov 2026 00:54:09 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Pe65n5XT; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4833; q=dns/txt; s=iport01; t=1793955248; x=1795164848; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=laSJCytpL/IPxBP+TRrOSD0M5ot6aiwORfU7uK92KL4=; b=Pe65n5XT4Ef1bYtzXGZdJn2U2lumf9DzYJKYnnhjCiCVSSaq2aERZYXo 2zNPTwuOvA+u4a2FPRzb+YSyc10YUOzn0TUaVpfMrQtGFWN7jhI2NdIb3 6kI7+k+zZlpXdCgW5R+FqogKhNwV+j+RR+ISSdsAXZDULBTXXOaJwdDWA XFrzeNtTk2lG1txKKqKQ6f9T1c5wdjTD+aNfhsbbpX4I8OhQHvZQv6/zi ynUC1nRTiWL6paiwMU6U1fApOG934xx+iyIezPGvsBGq5oDgjbq46rBGD Yq3DkFYcQDe51sDuLLYQddIzFJHv0PIBDL7JoF0MXovaSpFtOs8/b7Zeo Q==; X-CSE-ConnectionGUID: Q0HrCociQSC3XN99J69KpQ== X-CSE-MsgGUID: feOwt5+zQSasY7plFkMPLg== X-IPAS-Result: A0BIAgBxlO1q/5H/Ja1aHgEBCxIMggULgld1YENJlksDniGBfg8BAQEPRA0EAQGEP0YCjh0CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAEtEBwDAQIvKyMIGQmCeQGCdAMRvAKBeTOBAYJmQwE/AkNQ2UuBaAELFAEFgTOFQDKHcV0YAYR9JxuBSUSCUIIugQWBXAEBgTiGbgSDHBKBWh6MegKBUYZ5SIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXQEhgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQx0ORAwHiQvBRwmPhsKLxgNSBEsNxUZBD5uB5I9gn8TAYENASoBgj2jRIIhoRGEKoFoijyVOhozhVulFguYfY4KllGEaYFoPIFHCwczGggbFYMiCUoZD44uCwuDYIF/gxTGfSYyAgkyAQEHAgcOAwuBaJABgX0BAQ IronPort-Data: A9a23:ihsAb6w4gGX/XXy62/56t+dhxyrEfRIJ4+MujC+fZmUNrF6WrkUPm DMeWG/QOvuJazP8ed0kO96+/EgDvJTTmNViHAc/+FhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWctaj9MsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJHhuHZcz/e12OFplr sw+eWEvMEGgn9vjldpXSsE07igiBNPgMIVavjRryivUSK52B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cPnWjOX9PYH46tO6ynnjjazRwo1OOrq1x6G/WpOB0+OWxbIWEJYzVFa25mG6Wq 0XZ4zm6ECghPceuliKB3HGJvsvAyHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rbyyjVSzc9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7JQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSv1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:fUJSvq/zD0rtVlXSEWZuk+AAI+orL9Y04lQ7vn2ZhyY7TiX+rb HIoB11737JYVoqNU3I3OrwWpVoIkmskaKdn7NwAV7KZmCP0wGVxcNZnO7fKlbbdREWmNQw6U 5ISdkZNDSJNykYse/KpC+lDt0n3N6LtIqshevY0jNRaDsCUdAY0++8YTzraXGfg2J9dOIEKK Y= X-Talos-CUID: 9a23:ErKs0GoLHcnTepru3Ut0FCXmUfl9Umf2y3zRGnSTUlZPGey3Fw6z4Joxxg== X-Talos-MUID: 9a23:O1ncRwhwkwuQ8FW6sh+NscMpOspP/LjzS1I0qpwdipacMQJzHg+5g2Hi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="544797878" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 08:54:08 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id 058CF180001C5; Fri, 6 Nov 2026 08:54:08 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id 5BFF3CBF23E; Fri, 6 Nov 2026 00:54:07 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH 08/10] sqlite3: fix CVE-2026-119376 Date: Fri, 6 Nov 2026 00:54:03 -0800 Message-Id: <20261106085405.3517095-8-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106085405.3517095-1-arpitpa@cisco.com> References: <20261106085405.3517095-1-arpitpa@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 08:54:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249616 This patch applies the upstream fix [1], which includes COLLATE expressions in expression tree depth calculations and prevents bypass of the expression depth limit. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2 [2] https://sqlite.org/src/info/252c0b7bf5a727d2 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119376 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119376.patch | 75 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.45.3.bb | 1 + 2 files changed, 76 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119376.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119376.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119376.patch new file mode 100644 index 0000000000..975054e843 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119376.patch @@ -0,0 +1,75 @@ +From 2af844923ba3e32fb16b06adab4e4ad3b2f4da49 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Sun, 4 Oct 2026 21:54:17 +0000 +Subject: [PATCH] Fix expression tree depth calculations for COLLATE. + [bugs:/info/2026-10-04T04:50:56Z|Bug 2026-10-04T04:50:56Z] + +FossilOrigin-Name: 252c0b7bf5a727d29605672bb58e06c758173c276671df3e388a68294998b4d3 + +CVE: CVE-2026-119376 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2] + +Backport Changes: +- Ported the src/expr.c and src/sqliteInt.h changes into sqlite3.c + because the recipe source uses the amalgamated SQLite layout. +- Omitted test/sqllimits1.test because the extracted source does not + include the upstream test tree. +- Omitted manifest and manifest.uuid because they are Fossil + repository metadata and are not needed for this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 4b1c310fd6..7385344f84 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -21204,8 +21204,8 @@ SQLITE_PRIVATE void sqlite3SetTextEncoding(sqlite3 *db, u8); + SQLITE_PRIVATE CollSeq *sqlite3ExprCollSeq(Parse *pParse, const Expr *pExpr); + SQLITE_PRIVATE CollSeq *sqlite3ExprNNCollSeq(Parse *pParse, const Expr *pExpr); + SQLITE_PRIVATE int sqlite3ExprCollSeqMatch(Parse*,const Expr*,const Expr*); +-SQLITE_PRIVATE Expr *sqlite3ExprAddCollateToken(const Parse *pParse, Expr*, const Token*, int); +-SQLITE_PRIVATE Expr *sqlite3ExprAddCollateString(const Parse*,Expr*,const char*); ++SQLITE_PRIVATE Expr *sqlite3ExprAddCollateToken(Parse *pParse, Expr*, const Token*, int); ++SQLITE_PRIVATE Expr *sqlite3ExprAddCollateString(Parse*,Expr*,const char*); + SQLITE_PRIVATE Expr *sqlite3ExprSkipCollate(Expr*); + SQLITE_PRIVATE Expr *sqlite3ExprSkipCollateAndLikely(Expr*); + SQLITE_PRIVATE int sqlite3CheckCollSeq(Parse *, CollSeq *); +@@ -108701,23 +108701,29 @@ SQLITE_PRIVATE int sqlite3ExprDataType(const Expr *pExpr){ + ** and the pExpr parameter is returned unchanged. + */ + SQLITE_PRIVATE Expr *sqlite3ExprAddCollateToken( +- const Parse *pParse, /* Parsing context */ ++ Parse *pParse, /* Parsing context */ + Expr *pExpr, /* Add the "COLLATE" clause to this expression */ + const Token *pCollName, /* Name of collating sequence */ + int dequote /* True to dequote pCollName */ + ){ +- if( pCollName->n>0 ){ ++ if( pCollName->n>0 && pParse->nErr==0 ){ + Expr *pNew = sqlite3ExprAlloc(pParse->db, TK_COLLATE, pCollName, dequote); ++ assert( pExpr!=0 ); + if( pNew ){ + pNew->pLeft = pExpr; + pNew->flags |= EP_Collate|EP_Skip; ++#if SQLITE_MAX_EXPR_DEPTH>0 ++ pNew->nHeight = pExpr->nHeight+1; ++ sqlite3ExprCheckHeight(pParse, pNew->nHeight); ++ testcase( pParse->nErr>0 ); ++#endif + pExpr = pNew; + } + } + return pExpr; + } + SQLITE_PRIVATE Expr *sqlite3ExprAddCollateString( +- const Parse *pParse, /* Parsing context */ ++ Parse *pParse, /* Parsing context */ + Expr *pExpr, /* Add the "COLLATE" clause to this expression */ + const char *zC /* The collating sequence name */ + ){ +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb index 2ad46aa5f2..761087f1a3 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb @@ -20,6 +20,7 @@ SRC_URI = "http://www.sqlite.org/2024/sqlite-autoconf-${SQLITE_PV}.tar.gz \ file://CVE-2026-119379.patch \ file://CVE-2026-119372.patch \ file://CVE-2026-119378.patch \ + file://CVE-2026-119376.patch \ " SRC_URI[sha256sum] = "b2809ca53124c19c60f42bf627736eae011afdcc205bb48270a5ee9a38191531" From patchwork Fri Nov 6 08:54:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103240 Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.2175.1793955248651963828 for ; Fri, 06 Nov 2026 00:54:09 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=edfU7aKb; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=11017; q=dns/txt; s=iport01; t=1793955249; x=1795164849; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=FO9py5J+Cxr01+Qa+tu/m7BP2Qi6RxLhGu+6GHIFgEM=; b=edfU7aKbbK1J7v5BRYLg7YIkDF3Lkg4l2lQo7ze8JKZYlCHpIj2nPp0d dc3NIY+NYAaxWrFAnDzr/O6/ZYxXFJoeFw2qeMWxNIdhBKTVF48b0Ur3O LjxwKI4F6M2lGWYvcWLUMbRKRxCYKdo6s/pF+JVS3kUcKeUrJ0uB/ClRl oF2aMz4NZEtJc6eI9l7GFNf0hYCan41oXrjsNdBVvIUtiy4Kuw7MoS0qY E3+4P8CQv+U5Q7G+HNfWfJ38fC4D/liIs/1Z+wXQhIL67Q9HYaY3uxttn HSnvKxRCKLi3r3Zjw9tBKzgmmzq+5yXDT5zSYMEtEDZ+rcpyeneuwYKbN A==; X-CSE-ConnectionGUID: KffQZb8OR1qyA0wWRQ6M+g== X-CSE-MsgGUID: 7evQ0pmkTxa5cfdSGnt8zw== X-IPAS-Result: A0AnAADmlO1q/4v/Ja1aHQEBAQEJARIBBQUBgXwIAQsBglZ1YENJjHKJWQOTIIsBgX4PAQEBD0QNBAEBhD9GAo4dAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBLRAcAwECLysjCBkJgnkBgnQDEbwGgXkzgQGCZkMBPwJDUNlLgWgBCxQBBYEzAYU/ModxXRgBhH0nG4FJRIR+gQWBXAEBgTiGbgSDHBKBWh5ljBUCgVGGeUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF0BIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZAsaBWEIAg0MdDkQMB4kLwUcJj4bCi8YDUgRLDcVGQQ+bgeSPYMSATw+EwElBQGBBT56K5MDkBaCIaERhCqBaIo8lToaM4VbpRYLmH2OCpZRhGmBaDyBRwsHMxoIGxU7gmcJShkPjisDCwuDYIF/gxTGfSYyAgkyAQEHAgcOAwuBaJABgX0BAQ IronPort-Data: A9a23:49aLlqkjFkCR9bIct0v+Uaro5gzXJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xIbUWqCP//bNzT9eop3PN+z8kICscODzNEwTAdurSw1E1tH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4Errav6+/SEUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZK31GONgWYubDtNs//b8XuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05Fa4W9N9FCzFpz 6UBORlVcS+5vryTg73uH4GAhux7RCXqFJkUtnclyXTSCuwrBMiZBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQUaz/7C7pm9AusrnDlazxEsFu9rqss6G+Vxwt0uFToGIeJJofbFZwPzi50o EqZ8nrAWgkfN+CPwGeO/H6XqenTzTHkDdd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzBeCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3u78Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:oCvL+qmz1wywMWaJS/0Yughtm5LpDfL03DAbv31ZSRFFG/FwWf rAoB19726StN9/YhAdcLy7VZVoBEmsl6KdgrNhWYtKIjOHhILAFugLhuHfKn/bakjDH4Vmu5 uIHZITNDTYNykdsS+D2njaL/8QhP+a7auvmeDSi11pTQ1sduVcyj0RMHfjLqWzLzM2fqbQ0/ Gnl7J6mwY= X-Talos-CUID: 9a23:MfGYqWCa49m3FHj6Ewpp+ncmEJACSCTE3V6IPHCCMDhMC7LAHA== X-Talos-MUID: 9a23:vbsKNAWP8Dm76Uzq/GDhmgg6LMJr37SnVUsDna4pvdXUJzMlbg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="544398128" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 08:54:08 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id 075D71800035E; Fri, 6 Nov 2026 08:54:08 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id 60728CBF23F; Fri, 6 Nov 2026 00:54:07 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH 09/10] sqlite3: fix CVE-2026-119371 Date: Fri, 6 Nov 2026 00:54:04 -0800 Message-Id: <20261106085405.3517095-9-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106085405.3517095-1-arpitpa@cisco.com> References: <20261106085405.3517095-1-arpitpa@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 08:54:21 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249620 This patch series applies the upstream prerequisite [1] and CTE recursion fix [3]. Commit [1] adds VIEW and subquery nesting tracking; commit [3] uses that counter to limit recursive CTE depth. The GitHub commits [1] and [3] correspond to SQLite Fossil check-ins [2] and [4], respectively. [1] https://github.com/sqlite/sqlite/commit/9fb225190c3ac0e51f11a7fddab0d4cc960417ad [2] https://sqlite.org/src/info/3f3fb9b638f59ad9 [3] https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb [4] https://sqlite.org/src/info/f54730871303e655 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119371 Signed-off-by: Arpit Patel --- .../sqlite3/CVE-2026-119371-dependent.patch | 109 ++++++++++++++++++ .../sqlite/sqlite3/CVE-2026-119371.patch | 104 +++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.45.3.bb | 2 + 3 files changed, 215 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119371-dependent.patch create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119371.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119371-dependent.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119371-dependent.patch new file mode 100644 index 0000000000..6f06da3d74 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119371-dependent.patch @@ -0,0 +1,109 @@ +From fcea662407384de099367f4eded9dae4ac16b7eb Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Tue, 16 Jun 2026 13:43:08 +0000 +Subject: [PATCH] Limit VIEW recursion depth to SQLITE_LIMIT_EXPR_DEPTH to + prevent static overflow in malicious schemas with tens of thousands of levels + of recursive views. [bugs:/info/2026-06-16T04:21:51Z|Bug + 2026-06-16T04:21:51Z] + +FossilOrigin-Name: 3f3fb9b638f59ad982beafb7c117f24ddd3da612e62c862510805fa672ffae06 + +CVE: CVE-2026-119371 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/9fb225190c3ac0e51f11a7fddab0d4cc960417ad] + +Backport Changes: +- Ported src/select.c and src/sqliteInt.h code into the amalgamated + sqlite3.c source file. +- Updated limit documentation in sqlite3.c and sqlite3.h. +- Omitted test/view.test because the extracted source lacks the upstream + test tree. +- Omitted manifest and manifest.uuid because they are Fossil metadata. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 16 ++++++++++++++-- + sqlite3.h | 6 ++++-- + 2 files changed, 18 insertions(+), 4 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 7385344f84..13c687dde4 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -4418,7 +4418,8 @@ SQLITE_API int sqlite3_limit(sqlite3*, int id, int newVal); + ** or in an ORDER BY or GROUP BY clause.)^ + ** + ** [[SQLITE_LIMIT_EXPR_DEPTH]] ^(
SQLITE_LIMIT_EXPR_DEPTH
+-**
The maximum depth of the parse tree on any expression.
)^ ++**
The maximum depth of the parse tree on any expression and ++** the maximum nesting depth for subqueries and VIEWs
)^ + ** + ** [[SQLITE_LIMIT_COMPOUND_SELECT]] ^(
SQLITE_LIMIT_COMPOUND_SELECT
+ **
The maximum number of terms in a compound SELECT statement.
)^ +@@ -4445,7 +4446,8 @@ SQLITE_API int sqlite3_limit(sqlite3*, int id, int newVal); + **
The maximum index number of any [parameter] in an SQL statement.)^ + ** + ** [[SQLITE_LIMIT_TRIGGER_DEPTH]] ^(
SQLITE_LIMIT_TRIGGER_DEPTH
+-**
The maximum depth of recursion for triggers.
)^ ++**
The maximum depth of recursion for triggers, and the maximum ++** nesting depth for separate triggers.
)^ + ** + ** [[SQLITE_LIMIT_WORKER_THREADS]] ^(
SQLITE_LIMIT_WORKER_THREADS
+ **
The maximum number of auxiliary worker threads that a single +@@ -19755,6 +19757,7 @@ struct Parse { + int szOpAlloc; /* Bytes of memory space allocated for Vdbe.aOp[] */ + int iSelfTab; /* Table associated with an index on expr, or negative + ** of the base register during check-constraint eval */ ++ int nNestSel; /* Number of nested SELECT statements and/or VIEWs */ + int nLabel; /* The *negative* of the number of labels used */ + int nLabelAlloc; /* Number of slots in aLabel */ + int *aLabel; /* Space to hold the labels */ +@@ -144384,6 +144387,13 @@ SQLITE_PRIVATE Table *sqlite3ResultSetOfSelect(Parse *pParse, Select *pSelect, c + sqlite3 *db = pParse->db; + u64 savedFlags; + ++ pParse->nNestSel++; ++#if SQLITE_MAX_EXPR_DEPTH>0 ++ if( pParse->nNestSel >= db->aLimit[SQLITE_LIMIT_EXPR_DEPTH] ){ ++ sqlite3ErrorMsg(pParse, "VIEWs and/or subqueries nested too deep"); ++ return 0; ++ } ++#endif + savedFlags = db->flags; + db->flags &= ~(u64)SQLITE_FullColNames; + db->flags |= SQLITE_ShortColNames; +@@ -144405,6 +144415,8 @@ SQLITE_PRIVATE Table *sqlite3ResultSetOfSelect(Parse *pParse, Select *pSelect, c + sqlite3DeleteTable(db, pTab); + return 0; + } ++ pParse->nNestSel--; ++ assert( pParse->nNestSel>=0 ); + return pTab; + } + +diff --git a/sqlite3.h b/sqlite3.h +index 056511f577..705217e7ff 100644 +--- a/sqlite3.h ++++ b/sqlite3.h +@@ -4127,7 +4127,8 @@ SQLITE_API int sqlite3_limit(sqlite3*, int id, int newVal); + ** or in an ORDER BY or GROUP BY clause.
)^ + ** + ** [[SQLITE_LIMIT_EXPR_DEPTH]] ^(
SQLITE_LIMIT_EXPR_DEPTH
+-**
The maximum depth of the parse tree on any expression.
)^ ++**
The maximum depth of the parse tree on any expression and ++** the maximum nesting depth for subqueries and VIEWs
)^ + ** + ** [[SQLITE_LIMIT_COMPOUND_SELECT]] ^(
SQLITE_LIMIT_COMPOUND_SELECT
+ **
The maximum number of terms in a compound SELECT statement.
)^ +@@ -4154,7 +4155,8 @@ SQLITE_API int sqlite3_limit(sqlite3*, int id, int newVal); + **
The maximum index number of any [parameter] in an SQL statement.)^ + ** + ** [[SQLITE_LIMIT_TRIGGER_DEPTH]] ^(
SQLITE_LIMIT_TRIGGER_DEPTH
+-**
The maximum depth of recursion for triggers.
)^ ++**
The maximum depth of recursion for triggers, and the maximum ++** nesting depth for separate triggers.
)^ + ** + ** [[SQLITE_LIMIT_WORKER_THREADS]] ^(
SQLITE_LIMIT_WORKER_THREADS
+ **
The maximum number of auxiliary worker threads that a single +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119371.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119371.patch new file mode 100644 index 0000000000..03588c983b --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119371.patch @@ -0,0 +1,104 @@ +From 15f41e88d9729b80cf61f1d4893e166a61be10bb Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Mon, 5 Oct 2026 09:32:24 +0000 +Subject: [PATCH] Limit the depth of recursion for CTEs using + SQLITE_LIMIT_EXPR_DEPTH. [bugs:/info/2026-10-04T04:58:58Z|Bug + 2026-10-04T04:58:58Z]. + +FossilOrigin-Name: f54730871303e655a70f3167ce1a39dcd4e53fcf017d225f429e2bb67ad96604 + +CVE: CVE-2026-119371 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb] + +Backport Changes: +- Ported src/select.c changes into the amalgamated sqlite3.c file. +- Kept pFrom->pTab in the comment, as used in the current version. +- Omitted test/with2.test because the extracted source lacks the + upstream test tree. +- Omitted manifest and manifest.uuid because they are Fossil metadata. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 36 ++++++++++++++++++++++++------------ + 1 file changed, 24 insertions(+), 12 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 13c687dde4..27b3bff8ea 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -144378,6 +144378,20 @@ SQLITE_PRIVATE void sqlite3SubqueryColumnTypes( + pTab->szTabRow = 1; /* Any non-zero value works */ + } + ++/* ++** Check the current subquery nesting depth. Return true and set an ++** error if it has gone too deep. ++*/ ++static int checkSubqueryNestingDepth(Parse *pParse){ ++#if SQLITE_MAX_EXPR_DEPTH>0 ++ if( pParse->nNestSel >= pParse->db->aLimit[SQLITE_LIMIT_EXPR_DEPTH] ){ ++ sqlite3ErrorMsg(pParse, "VIEWs and/or subqueries nested too deep"); ++ return 1; ++ } ++#endif ++ return 0; ++} ++ + /* + ** Given a SELECT statement, generate a Table structure that describes + ** the result set of that SELECT. +@@ -144388,12 +144402,7 @@ SQLITE_PRIVATE Table *sqlite3ResultSetOfSelect(Parse *pParse, Select *pSelect, c + u64 savedFlags; + + pParse->nNestSel++; +-#if SQLITE_MAX_EXPR_DEPTH>0 +- if( pParse->nNestSel >= db->aLimit[SQLITE_LIMIT_EXPR_DEPTH] ){ +- sqlite3ErrorMsg(pParse, "VIEWs and/or subqueries nested too deep"); +- return 0; +- } +-#endif ++ if( checkSubqueryNestingDepth(pParse) ) return 0; + savedFlags = db->flags; + db->flags &= ~(u64)SQLITE_FullColNames; + db->flags |= SQLITE_ShortColNames; +@@ -147651,14 +147660,13 @@ SQLITE_PRIVATE With *sqlite3WithPush(Parse *pParse, With *pWith, u8 bFree){ + } + + /* +-** This function checks if argument pFrom refers to a CTE declared by ++** This function checks to see if argument pFrom refers to a CTE declared by + ** a WITH clause on the stack currently maintained by the parser (on the +-** pParse->pWith linked list). And if currently processing a CTE +-** CTE expression, through routine checks to see if the reference is +-** a recursive reference to the CTE. ++** pParse->pWith linked list). And if currently processing a CTE expression, ++** it also checks to see if the reference is a recursive reference to the CTE. + ** +-** If pFrom matches a CTE according to either of these two above, pFrom->pTab +-** and other fields are populated accordingly. ++** If pFrom matches a CTE, pFrom->pTab and other fields are populated ++** accordingly. + ** + ** Return 0 if no match is found. + ** Return 1 if a match is found. +@@ -147781,6 +147789,8 @@ static int resolveFromTermToCte( + pRecTerm = pRecTerm->pPrior; + } + ++ pParse->nNestSel++; ++ if( checkSubqueryNestingDepth(pParse) ) return 2; + pCte->zCteErr = "circular reference: %s"; + pSavedWith = pParse->pWith; + pParse->pWith = pWith; +@@ -147805,6 +147815,8 @@ static int resolveFromTermToCte( + } + } + pParse->pWith = pWith; ++ pParse->nNestSel--; ++ assert( pParse->nNestSel>=0 ); + + for(pLeft=pSel; pLeft->pPrior; pLeft=pLeft->pPrior); + pEList = pLeft->pEList; +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb index 761087f1a3..da12a6194a 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb @@ -21,6 +21,8 @@ SRC_URI = "http://www.sqlite.org/2024/sqlite-autoconf-${SQLITE_PV}.tar.gz \ file://CVE-2026-119372.patch \ file://CVE-2026-119378.patch \ file://CVE-2026-119376.patch \ + file://CVE-2026-119371-dependent.patch \ + file://CVE-2026-119371.patch \ " SRC_URI[sha256sum] = "b2809ca53124c19c60f42bf627736eae011afdcc205bb48270a5ee9a38191531" From patchwork Fri Nov 6 08:54:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103241 Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.2177.1793955248827567715 for ; Fri, 06 Nov 2026 00:54:09 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=jQ71jls+; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2871; q=dns/txt; s=iport01; t=1793955249; x=1795164849; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=5jXhlhKdSDJumgOn4Xg2ojQ3iiiZywaLTqF0xHSfViA=; b=jQ71jls+n6s9QDRghaCcSi4qRLmRix78bECr63KTeK6xwafd39GvXaPC Ks439IrYXT/T8T0vEF/1ZqZ/wio0tAvGrWpWGyieq5PEhjwTubnXHuktu WI1CK0e0IJ+gSEMh7iheiQmtJuUz09XCxPt8Djq7qgxd6V3iZ4qLyReLU IwLydv3pbD3asULZjtB51HRo7dRkVRdPqdh8pCoDFZ7XGriUWMAoxZA/a WT8hWDjyVtS5ig7rfW+Q6Cq1ki8pdHFBthHyFBlgqEF/ZIjL5YHxE0Sj4 OI8pzkt3SATXGNsqD+d0W+UeSJ5shxAb7+NKbSz98FizthTRuOpOHw077 g==; X-CSE-ConnectionGUID: aGcNW6QnR8C2QAKHLzuMCw== X-CSE-MsgGUID: WPSY3zaAROq7wklMspRUoA== X-IPAS-Result: A0BJAgBUle1q/5D/Ja1aglmCV3VgQ0mWSwOeIYF+DwEBAQ9EDQQBAYQ/RgKOHQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAS0QHAMBAi8rIwgZCYJ5AYJ0AxG8BoF5M4EBgykBPwJDUNlLgWgBCxQBBYEzhUAyh3FdGAGEfScbgUlEhH6BBYFcAQGCLYV5BIMcEoFaHox6AoFRhnlIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHQ5EDAeJC8FHCY+GwovGA1IESw3FRkEPm4Hkj2DEQEBgQ0BKgGBQ3oroxmCIaERhCqBaIo8lToaM6pxC5h9jgqWUYRpgWg8gUcLBzMaCBsVgyIJShkPji4LC4NggX+DFMZ9JjICCTIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:ru7etaD4XmJVjBVW/3/iw5YqxClBgxIJ4kV8jS/XYbTApGgkhGQCz TRMUW2POfaOMTOjet4ga4Xl80hU75TWmoRmOVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGcYZsCCCM/n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXGthh fuo+5eBYQb9hmYtWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TEytplKn5oBIsiqs0tOEht1 dgKNRUmcUXW7w626OrTpuhEnM8vKozveYgYoHwllW6fBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGYzBPjDS0Un1lM/AYgmnfuwj1H0ciZTrxSeoq9fD237kVAtgeiwboOPEjCMbfptpXfDt GvvxUPgXQ4ZMPmE0QC49Vv504cjmgu+Aur+DoaQ8eZnhlCWzGEfBBAaEFC8u/SRjk+lR8kZL FQZ/Ccrp6U++EGnCN7nUHWFTGWspBUQXZ9UVuY98gzIkvWS6AeCDW9CRTlEADA7iPILqfUR/ gfht7vU6fZH7NV5lVr1Gm+okA6P IronPort-HdrOrdr: A9a23:JtIo467J2rEyhdr6pAPXwBDXdLJyesId70hD6qm+c3Nom6uj5q eTdZsgtCMc5Ax9ZJhko6HjBEDiewK5yXcK2+ks1N6ZNWGM0ldAbrsSiLcKqAePJ8SRzIJgPI 5bAs5D4aXLfDtHpPe/xhWkGNA9x9TC2qWpieDCi0pJd2hRGthdB8MTMHfhLqWwLzM2faYEKA == X-Talos-CUID: 9a23:DEhoWG+Ok9LM44UF2zaVv0c7EeYaLETb9if7eXaRKkZNWqCwYkDFrQ== X-Talos-MUID: 9a23:mC03hwxemr92mdCJ48NOUDoQA/uaqJuWM3FWg5wvge6dajNzPxKGlA6KRaZyfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,197,1787011200"; d="scan'208";a="544985612" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 06 Nov 2026 08:54:08 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 06F7D180003CF; Fri, 6 Nov 2026 08:54:08 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id 646C3CBEF83; Fri, 6 Nov 2026 00:54:07 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][scarthgap][PATCH 10/10] sqlite3: fix CVE-2026-119591 Date: Fri, 6 Nov 2026 00:54:05 -0800 Message-Id: <20261106085405.3517095-10-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261106085405.3517095-1-arpitpa@cisco.com> References: <20261106085405.3517095-1-arpitpa@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 08:54:21 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249621 This patch applies the upstream fix [1] for stack exhaustion in the count-of-view optimization. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2 [2] https://sqlite.org/src/info/ab621a3e11ee4acc Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119591 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119591.patch | 40 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.45.3.bb | 1 + 2 files changed, 41 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119591.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119591.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119591.patch new file mode 100644 index 0000000000..3162d7af45 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119591.patch @@ -0,0 +1,40 @@ +From 5dbe255431ad2b935db31e8e3c2c66284e2709ef Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Mon, 5 Oct 2026 12:18:23 +0000 +Subject: [PATCH] Prevent the expression generated by the count-of-view + optimization from getting too deep and causing a CPU stack overflow. + [bugs:/info/2026-10-04T05:34:47Z|Bug 2026-10-04T05:34:47Z] + +FossilOrigin-Name: ab621a3e11ee4accce14bf6c90a7cc273d9c25a7c3d9dd2466f2bdc2bbbf8084 + +CVE: CVE-2026-119591 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2] + +Backport Changes: +- Ported the src/select.c change into the amalgamated sqlite3.c. +- Omitted manifest and manifest.uuid because they are Fossil metadata + and are not needed for this source layout. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sqlite3.c b/sqlite3.c +index 27b3bff8ea..788e23a839 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -149172,6 +149172,10 @@ static int countOfViewOptimization(Parse *pParse, Select *p){ + }else{ + pExpr = sqlite3PExpr(pParse, TK_PLUS, pTerm, pExpr); + } ++ if( pParse->nErr ){ ++ sqlite3ExprDelete(db, pExpr); ++ pExpr = 0; ++ } + pSub = pPrior; + } + p->pEList->a[0].pExpr = pExpr; +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb index da12a6194a..3b682613c3 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb @@ -23,6 +23,7 @@ SRC_URI = "http://www.sqlite.org/2024/sqlite-autoconf-${SQLITE_PV}.tar.gz \ file://CVE-2026-119376.patch \ file://CVE-2026-119371-dependent.patch \ file://CVE-2026-119371.patch \ + file://CVE-2026-119591.patch \ " SRC_URI[sha256sum] = "b2809ca53124c19c60f42bf627736eae011afdcc205bb48270a5ee9a38191531"