From patchwork Wed Nov 11 05:25:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103649 Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3330.1794374735166642856 for ; Tue, 10 Nov 2026 21:25:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Y2S88M6g; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=12843; q=dns/txt; s=iport01; t=1794374735; x=1795584335; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=YIxuvdqWtCdsMKXotK+mPdAzGMdhJqb+dbrOU/5UaZk=; b=Y2S88M6gj256xO3G+2XSyvzhTrAXkUGxGGFIjKDhvLeMMSfcg/GMciju 5ADtWNXcmKcyLy1GWswBNPRYxZdmQcWWeeagK3gfZpNWyXFJ2RwgggqVD 7R15YoaEDT2Lhw1IXsLMhbOd7ra6wx7Ue853bbs+V1h2I4WmeTB4zczV2 +x7JKZ8TUnvLCj2rpoPKA35zganRygwjsBp9jeWrfL7+HouX6hpHCzLx3 e61fh3nRbphUy0tUAmLsPgebxzNDgzRIExftVWb2bDSWmSIa1m0X5fRqg d85guq8D3KyI1D2xa9k5FF54N5T57vzn43RWRfCoQgWNyGQ4wTjcbRHFW w==; X-CSE-ConnectionGUID: pr1tVwlkQgSWGHBZI3OKzg== X-CSE-MsgGUID: NUj1NXBYR/aujUA5LZmkmw== X-IPAS-Result: A0AaAAAG+/Nq/43/Ja1aHAEBAQEBAQcBARIBAQQEAQGBfAcBAQsBglZ1YENJjHKJWZ4lgX4PAQEBD0QNBAEBhD9GAo4eAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBKgsBGAEtLAMBAlojIQmCeQGCdAMRuVaBeTOBAYJmQwE/AkNQ2UuBaAELFAEFgTMBhUEyh3JdGAGEfScbgUlEhH6BBYFcAQGIJgSDLoFaHoYhhlsCgU+HJUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEcgR6BEoEHXYErKF0BIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZwsaBWEIAg0MdDkQMB4kLwUaJj4bCn4YDUgRLDcVGQQ+bgeSboMOBgEBWCITAQcjAXsdcDU6owqCIaERhCqBaIo8lToaM4VbpRcLmH2OCpZRhGqBaDyBRwsHMxoIGxWDIglKGQ+OLgsLg2CBf4MUyUgmMgIJMgEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:qiRQ9qhSmXPSPf5ZdSKaFvh4X161NhEKZh0ujC45NGQN5FlHY01je htvUTiDb/feYmb9LYhxb4vloB8H7ceAmtRmTVY5+HwxRC5jpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNsvva8EoHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqUA4L9rP35K9 sUXEw8iTjqxprmR46C0H7wEasQLdKEHPasFsX1miDWcBvE8TNWbH+PB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZg5/5JEWxI9EglH2aSVZtEqcjaE2+GPUigd21dABNfKIJoLRHZsFwx/wS mTu2Vn7WzcqHu2ljjOY8E+F28v9mCD+R9dHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUg4w2Lj66R6AGDCy1cEnhKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/Nxd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:M4fK0q1UvD7AnBaxEo7jZQqjBJ4kLtp133Aq2lEZdPWaSKOlfq eV7ZEmPHDP6Qr5NEtMpTniAtjjfZqjz/5ICOAqVN/INjUO01HHEGgN1+ffKhTbaknDH5ZmpM RdWpk7LsHsBl5nisu/ygy5H9E8hOSjysmT9IDjJ7MHd3ASV0mmhD0JbDqmLg== X-Talos-CUID: 9a23:2ISJRmGAz9W58OGSqmJ/7hcIJN8hcUTS90j/A2WKKD1Oa6+aHAo= X-Talos-MUID: 9a23:TWAgAgxG+b0GV9yh45lw7XyepnWaqIKTChkrob83gY6NKC5NEmq5vjG0R5Byfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,207,1787011200"; d="scan'208";a="546306851" Received: from rcdn-l-core-04.cisco.com ([173.37.255.141]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 11 Nov 2026 05:25:34 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-04.cisco.com (Postfix) with ESMTPS id 0C7D3180001AE; Wed, 11 Nov 2026 05:25:34 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id A52DECC2EF1; Tue, 10 Nov 2026 21:25:33 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][blacksail][PATCH 01/10] sqlite3: Fix CVE-2026-119377 Date: Tue, 10 Nov 2026 21:25:23 -0800 Message-Id: <20261111052532.1258975-1-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-04.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 05:25:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249942 This patch applies the upstream fix series [1], [3], [5], and [7] for the authorizer bypass. Commits [1] and [3] are dependent commits. Commit [5] adds authorizer checks for RIGHT JOIN USING terms, and commit [7] corrects the loop so every term is checked. The GitHub mirror commits correspond to the SQLite Fossil check-ins shown in [2], [4], [6], and [8], respectively. [1] https://github.com/sqlite/sqlite/commit/c70fbd39f9c130bbe1cc45269c3b490dfdf7f259 [2] https://sqlite.org/src/info/625f78a630bb [3] https://github.com/sqlite/sqlite/commit/ddea119f825bf07f145c55f623022286bc644664 [4] https://sqlite.org/src/info/4ef88a36f9d9 [5] https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237 [6] https://sqlite.org/src/info/bbd69ce27462 [7] https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8 [8] https://sqlite.org/src/info/2cb228776836 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119377 Signed-off-by: Arpit Patel --- .../CVE-2026-119377-dependent_p1.patch | 86 +++++++++++++++++++ .../CVE-2026-119377-dependent_p2.patch | 61 +++++++++++++ .../sqlite/sqlite3/CVE-2026-119377_p1.patch | 52 +++++++++++ .../sqlite/sqlite3/CVE-2026-119377_p2.patch | 51 +++++++++++ meta/recipes-support/sqlite/sqlite3_3.53.4.bb | 8 +- 5 files changed, 256 insertions(+), 2 deletions(-) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p1.patch create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p2.patch create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p1.patch create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p2.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p1.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p1.patch new file mode 100644 index 0000000000..57f44bc645 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p1.patch @@ -0,0 +1,86 @@ +From c3cab0322ae36fe6ca21df300c670af379c0a423 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Sat, 2 May 2026 17:30:33 +0000 +Subject: [PATCH] Minor optimization to the authorizer. + +FossilOrigin-Name: 625f78a630bbf897f945065f1b85a92fe26e426302c8f6edc4d26a817ff62358 + +CVE: CVE-2026-119377 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/c70fbd39f9c130bbe1cc45269c3b490dfdf7f259] + +Backport Changes: +- Applied the src/auth.c and src/resolve.c changes to sqlite3.c because + the Yocto sqlite-autoconf source uses the amalgamated SQLite layout. +- Kept SQLITE_PRIVATE on sqlite3AuthCheck() to match the amalgamated + source. +- Omitted manifest and manifest.uuid because they are repository + metadata and are not needed for this sqlite3.c backport. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 27 ++++++++++++++++++++++----- + 1 file changed, 22 insertions(+), 5 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 0644a39..6a795f7 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -111320,9 +111320,7 @@ lookupname_end: + if( cnt==1 ){ + assert( pNC!=0 ); + #ifndef SQLITE_OMIT_AUTHORIZATION +- if( pParse->db->xAuth +- && (pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER) +- ){ ++ if( db->xAuth && (pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER) ){ + sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList); + } + #endif +@@ -126468,8 +126466,14 @@ SQLITE_PRIVATE void sqlite3AuthRead( + ** either SQLITE_OK (zero) or SQLITE_IGNORE or SQLITE_DENY. If SQLITE_DENY + ** is returned, then the error count and error message in pParse are + ** modified appropriately. ++** ++** Divided into two routines. realAuthCheck() does the work. The ++** sqlite3AuthCheck() routine is usually a fast no-op but invokes ++** realAuthCheck() (and spends time doing some stack pushes and pops ++** as a result) in the uncommon case where an authorization check is ++** actually needed. + */ +-SQLITE_PRIVATE int sqlite3AuthCheck( ++static int SQLITE_NOINLINE realAuthCheck( + Parse *pParse, + int code, + const char *zArg1, +@@ -126483,7 +126487,7 @@ SQLITE_PRIVATE int sqlite3AuthCheck( + ** or if the parser is being invoked from within sqlite3_declare_vtab. + */ + assert( !IN_RENAME_OBJECT || db->xAuth==0 ); +- if( db->xAuth==0 || db->init.busy || IN_SPECIAL_PARSE ){ ++ if( IN_SPECIAL_PARSE ){ + return SQLITE_OK; + } + +@@ -126508,6 +126512,19 @@ SQLITE_PRIVATE int sqlite3AuthCheck( + } + return rc; + } ++SQLITE_PRIVATE int sqlite3AuthCheck( ++ Parse *pParse, ++ int code, ++ const char *zArg1, ++ const char *zArg2, ++ const char *zArg3 ++){ ++ if( pParse->db->xAuth!=0 && pParse->db->init.busy==0 ){ ++ return realAuthCheck(pParse,code,zArg1,zArg2,zArg3); ++ }else{ ++ return SQLITE_OK; ++ } ++} + + /* + ** Push an authorization context. After this routine is called, the +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p2.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p2.patch new file mode 100644 index 0000000000..121424308e --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p2.patch @@ -0,0 +1,61 @@ +From 4ad8d0b4f4de75182a835bfadf0dc14c1c8c1a70 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Mon, 1 Jun 2026 16:49:39 +0000 +Subject: [PATCH] Make sure the authenticator is called for columns that are + part of a USING in a FULL JOIN. [bugs:/info/2026-05-31T02:00:37Z|Bug + 2026-05-31T02:00:37Z]. + +FossilOrigin-Name: 4ef88a36f9d9669b0d74c58f79ad497803885ff6078e5f9685f13c96eab397cc + +CVE: CVE-2026-119377 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/ddea119f825bf07f145c55f623022286bc644664] + +Backport Changes: +- Applied the src/resolve.c change to sqlite3.c because this recipe + uses the amalgamated SQLite source. +- Omitted manifest and manifest.uuid updates because they are Fossil + repository metadata and are not needed in this backport. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 17 +++++++++++++--- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 6a795f7..9353a03 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -111237,7 +111237,7 @@ static int lookupName( + ** cnt>1 means there were two or more matches. + ** + ** cnt==0 is always an error. cnt>1 is often an error, but might +- ** be multiple matches for a NATURAL LEFT JOIN or a LEFT JOIN USING. ++ ** be multiple matches for a NATURAL OUTER JOIN or a OUTER JOIN USING. + */ + assert( pFJMatch==0 || cnt>0 ); + assert( !ExprHasProperty(pExpr, EP_xIsSelect|EP_IntValue) ); +@@ -111320,9 +111320,18 @@ + if( cnt==1 ){ + assert( pNC!=0 ); + #ifndef SQLITE_OMIT_AUTHORIZATION +- if( db->xAuth && (pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER) ){ +- sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList); +- } ++ if( db->xAuth ){ ++ if( pFJMatch ){ ++ assert( pExpr->op==TK_FUNCTION ); ++ assert( sqlite3_stricmp(pExpr->u.zToken,"coalesce")==0 ); ++ assert( pExpr->x.pList==pFJMatch ); ++ assert( pFJMatch->nExpr>0 ); ++ pExpr = pFJMatch->a[0].pExpr; ++ } ++ if( pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER ){ ++ sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList); ++ } ++ } + #endif + /* Increment the nRef value on all name contexts from TopNC up to + ** the point where the name matched. */ +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p1.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p1.patch new file mode 100644 index 0000000000..4ab2f652bf --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p1.patch @@ -0,0 +1,52 @@ +From 7e76b79f06869f46def99a3ec08d9dfb53a346b1 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Sun, 5 Jul 2026 16:06:33 +0000 +Subject: [PATCH] Be sure to invoke the authorizer callback on all terms of the + USING clause in a RIGHT JOIN. [bugs:/info/2026-07-05T08:15:45Z|Bug + 2026-07-05T08:15:45Z] + +FossilOrigin-Name: bbd69ce27462000873af053bfebdd305c53deac85c426b1e7dbd927b5f17d622 + +CVE: CVE-2026-119377 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237] + +Backport Changes: +- Applied the src/resolve.c change in sqlite3.c because the Yocto + sqlite-autoconf source uses the amalgamated layout. +- Omitted test/auth.test because the extracted recipe source lacks the + upstream Tcl test tree. +- Omitted manifest and manifest.uuid because they are repository + metadata and are not needed in this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 9353a03..411a39a 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -111322,13 +111322,16 @@ lookupname_end: + #ifndef SQLITE_OMIT_AUTHORIZATION + if( db->xAuth ){ + if( pFJMatch ){ ++ int ii; + assert( pExpr->op==TK_FUNCTION ); + assert( sqlite3_stricmp(pExpr->u.zToken,"coalesce")==0 ); + assert( pExpr->x.pList==pFJMatch ); + assert( pFJMatch->nExpr>0 ); +- pExpr = pFJMatch->a[0].pExpr; +- } +- if( pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER ){ ++ for(ii=0; iinExpr; ii++){ ++ assert( pFJMatch->a[0].pExpr->op==TK_COLUMN ); ++ sqlite3AuthRead(pParse, pFJMatch->a[0].pExpr, pSchema, pNC->pSrcList); ++ } ++ }else if( pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER ){ + sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList); + } + } +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p2.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p2.patch new file mode 100644 index 0000000000..827d5fe750 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p2.patch @@ -0,0 +1,51 @@ +From a98f25c8a88d1e0e24f677279ac90b30567f93ee Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Fri, 24 Jul 2026 14:53:59 +0000 +Subject: [PATCH] Fix a bug in the check-in [bbd69ce274620008] causing that + bug-fix check-in to fail to completely fix the original bug. This fix is in + response to the follow-up report at [bugs:/info/2026-07-24T02:52:08Z|Bug + 2026-07-24T02:52:08Z]. + +FossilOrigin-Name: 2cb22877683680c1f89bcc9edb47bd1a4a8755d4a6b846a1a20136a657dacdcc + +CVE: CVE-2026-119377 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8] + +Backport Changes: +- Applied the src/resolve.c correction to sqlite3.c because the Yocto + recipe source uses the amalgamated SQLite layout. +- Omitted test/auth.test because the extracted recipe source lacks the + upstream Tcl test tree. +- Omitted manifest and manifest.uuid because they are Fossil + repository metadata and are not needed in the source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 273ef4a..6130466 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -111322,14 +111322,13 @@ lookupname_end: + #ifndef SQLITE_OMIT_AUTHORIZATION + if( db->xAuth ){ + if( pFJMatch ){ +- int ii; + assert( pExpr->op==TK_FUNCTION ); + assert( sqlite3_stricmp(pExpr->u.zToken,"coalesce")==0 ); + assert( pExpr->x.pList==pFJMatch ); + assert( pFJMatch->nExpr>0 ); +- for(ii=0; iinExpr; ii++){ +- assert( pFJMatch->a[0].pExpr->op==TK_COLUMN ); +- sqlite3AuthRead(pParse, pFJMatch->a[0].pExpr, pSchema, pNC->pSrcList); ++ for(i=0; inExpr; i++){ ++ assert( pFJMatch->a[i].pExpr->op==TK_COLUMN ); ++ sqlite3AuthRead(pParse,pFJMatch->a[i].pExpr,pSchema,pNC->pSrcList); + } + }else if( pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER ){ + sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList); +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb index 007a823dc5..c7c081b393 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb @@ -20,8 +20,12 @@ S = "${UNPACKDIR}/sqlite-autoconf-${SQLITE_PV}" B = "${WORKDIR}/build" SRC_URI = "http://www.sqlite.org/2026/sqlite-autoconf-${SQLITE_PV}.tar.gz" -SRC_URI += "file://0001-Add-option-to-disable-zlib.patch" - +SRC_URI += "file://0001-Add-option-to-disable-zlib.patch \ + file://CVE-2026-119377-dependent_p1.patch \ + file://CVE-2026-119377-dependent_p2.patch \ + file://CVE-2026-119377_p1.patch \ + file://CVE-2026-119377_p2.patch \ +" SRC_URI[sha256sum] = "0e9483900e92cd5de8fd48d16bf9200145a61f7fd5be542a5ac81d8a9516eb9c" UPSTREAM_CHECK_URI = "http://www.sqlite.org/" From patchwork Wed Nov 11 05:25:24 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103650 Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3329.1794374735153528165 for ; Tue, 10 Nov 2026 21:25:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=VoXBugIX; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3761; q=dns/txt; s=iport01; t=1794374735; x=1795584335; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=kI37wRmVJpItNV/N2UpC01h8aJB/Y2pigqgJi+Rzfv4=; b=VoXBugIXy3eEHdfwBYJLhR6PY88BWWVHCot5vgygxxlt4A5emMm6XizS Wo+1nJueqN2XMxJim/Wt36SEW1vDCRYFKVsATa7R0L9w3Oj+eYytEQHev VWQ++D88ZkQkPvzYMgZBINEXWp6RDPpya9ibjqpb6JdeMvkA7lDCU6vxe gKqujkLMllfH8AR19zh9VYI+vwpK6Pe7tFIPajDUv0J+UKV4r3zvUinUX 1d/MBRJwaQf09svGzxMgO9MZGRSmeaLaBXV2IX6u3Hdeh0qQgnevpwzBw 4bCimTO90U1rT2JJk2rYsveihjKDbR10KuKYjeL0aoVnv84H2VJBvI+f5 A==; X-CSE-ConnectionGUID: MHZZ9RE4SPK5WDPjEHxcOg== X-CSE-MsgGUID: GkskoFREQouMznIv/0HswA== X-IPAS-Result: A0AnAAAG+/Nq/5T/Ja1aHQEBAQEJARIBBQUBgXwIAQsBglZ1YENJjHKJWQOeIhSBag8BAQEPRA0EAQGEP0YCjh4CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAEtEBwDAQIWGSsjCBmDAgGCdAMRuVaBeTOBAYMpAT8CQ1DZS4FoAQsUAQWBMwGFQTKHcl0YAYR9JxuBSUSEfoEFgVwBAYEZgQaGBwSDHBKBWoECjBgCgU+HJUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEcgR6BEoEHXYErKF0BIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZwsaBWEIAg0MdDkQMB4kLwUaJj4bCn4YDUgRLDcVGQQ+bgeSboMVAVg1ASuCPaNEgiGhEYQqgWiKPJU6GjOFW6UXC5h9jgqWUYRqgWg8gUcLBzMaCBsVgyIJShkPji4LC4NggX+DFMlIJjICCTIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:kg9MCaDeHTPNhxVW/3/iw5YqxClBgxIJ4kV8jS/XYbTApGx00mAGz zEcXT+BM/mONmXxKNogOty3900Ov5/dyN4wOVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGcYZsCCCM/n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXGthh fuo+5eBYQb8gmYtWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TE5tVcPhAMENEjwsUqPk129 9E4ODsqYUXW7w626OrTpuhEnM8vKozveYgYoHwllGifBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGY/BPjDS0Un1lM/AYgmnfuwj1H0ciZTrxSeoq9fD237kVcriua0YIuMEjCMbepWhUWfi FjrxmPkJwMcFcLYkRqe7Vv504cjmgu+Aur+DoaQ8eZnhlCWzGEfBBAaEFC8u/SRjk+lR8kZL FQZ/Ccrp6U++EGnCN7nUHWFTGWspBUQXZ9UVuY98gzIk/OS6AeCDW9CRTlEADA7iPILqfUR/ gfht7vU6fZH6dV5lVr1Gm+okA6P IronPort-HdrOrdr: A9a23:jIpxKq/7nqLLrCX22I5uk+AAI+orL9Y04lQ7vn2ZhyY7TiX+rb HIoB11737JYVoqNU3I3OrwWpVoIkmskaKdn7NwAV7KZmCP0wGVxcNZnO7fKlbbdREWmNQw6U 5ISdkZNDSJNykYse/KpC+lDt0n3N6LtIqshevY0jNRaDsCUdAY0++8YTzraXGfg2J9dOIEKK Y= X-Talos-CUID: 9a23:RHfDyGxy5Lbn2eVEAN5DBgUxOvIXI0fwkEzoABKHJV5rZZ2FQnifrfY= X-Talos-MUID: 9a23:FuT++guqtBedROSxWc2nqzJ5N8BG2YmXD10og5MnpY7cFTdvEmLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,207,1787011200"; d="scan'208";a="532261891" Received: from rcdn-l-core-11.cisco.com ([173.37.255.148]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 11 Nov 2026 05:25:34 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-11.cisco.com (Postfix) with ESMTPS id 0EA8F1800024D; Wed, 11 Nov 2026 05:25:34 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id AA067CBF22E; Tue, 10 Nov 2026 21:25:33 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][blacksail][PATCH 02/10] sqlite3: fix CVE-2026-119373 Date: Tue, 10 Nov 2026 21:25:24 -0800 Message-Id: <20261111052532.1258975-2-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261111052532.1258975-1-arpitpa@cisco.com> References: <20261111052532.1258975-1-arpitpa@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-11.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 05:25:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249943 This patch applies the upstream fix [1], which prevents a buffer overflow when merging FTS5 detail=none prefix lists with negative docids. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80 [2] https://sqlite.org/src/info/a7f8c92f62 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119373 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119373.patch | 56 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.53.4.bb | 1 + 2 files changed, 57 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119373.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119373.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119373.patch new file mode 100644 index 0000000000..bb2eb09d0a --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119373.patch @@ -0,0 +1,56 @@ +From 2ea652e191b5fd3e2ff13eadd907519b74e3db94 Mon Sep 17 00:00:00 2001 +From: dan +Date: Tue, 4 Aug 2026 11:04:17 +0000 +Subject: [PATCH] In fts5, account for the possibility of negative docids when + allocating a buffer to store the results of merging detail=none prefix lists. + Fix for report [bugs:/info/2026-08-04T08:49:27Z | 2026-08-04T08:49:27Z]. + +FossilOrigin-Name: a7f8c92f623e9cbe8a61266d949916acc9e5110c94dff4aa6fd1ad2ea8a60d4e + +CVE: CVE-2026-119373 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80] + +Backport Changes: +- Applied the FTS5 fix from ext/fts5/fts5_index.c to sqlite3.c because + the recipe source uses the amalgamated SQLite layout. +- Omitted ext/fts5/test/fts5prefix2.test because the extracted source + does not include SQLite's Tcl test tree. +- Omitted manifest and manifest.uuid because they are Fossil + repository metadata and are not needed for this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 6130466..06ceecf 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -256971,7 +256971,7 @@ static void fts5MergeRowidLists( + (void)nBuf; + memset(&out, 0, sizeof(out)); + assert( nBuf==1 ); +- sqlite3Fts5BufferSize(&p->rc, &out, p1->n + p2->n); ++ sqlite3Fts5BufferSize(&p->rc, &out, p1->n + p2->n + 9); + if( p->rc ) return; + + fts5NextRowid(p1, &i1, &iRowid1); +@@ -256979,12 +256979,12 @@ static void fts5MergeRowidLists( + while( i1>=0 || i2>=0 ){ + if( i1>=0 && (i2<0 || iRowid1iOut ); +- fts5BufferSafeAppendVarint(&out, iRowid1 - iOut); ++ fts5BufferSafeAppendVarint(&out, (u64)iRowid1 - (u64)iOut); + iOut = iRowid1; + fts5NextRowid(p1, &i1, &iRowid1); + }else{ + assert( iOut==0 || iRowid2>iOut ); +- fts5BufferSafeAppendVarint(&out, iRowid2 - iOut); ++ fts5BufferSafeAppendVarint(&out, (u64)iRowid2 - (u64)iOut); + iOut = iRowid2; + if( i1>=0 && iRowid1==iRowid2 ){ + fts5NextRowid(p1, &i1, &iRowid1); +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb index c7c081b393..4ec6eb230e 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb @@ -25,6 +25,7 @@ SRC_URI += "file://0001-Add-option-to-disable-zlib.patch \ file://CVE-2026-119377-dependent_p2.patch \ file://CVE-2026-119377_p1.patch \ file://CVE-2026-119377_p2.patch \ + file://CVE-2026-119373.patch \ " SRC_URI[sha256sum] = "0e9483900e92cd5de8fd48d16bf9200145a61f7fd5be542a5ac81d8a9516eb9c" From patchwork Wed Nov 11 05:25:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103653 Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3242.1794374735135445517 for ; Tue, 10 Nov 2026 21:25:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=htKjh6T3; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4170; q=dns/txt; s=iport01; t=1794374735; x=1795584335; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=xVTOL/Wnc6Jdvw14ZV4Ay5UxD9tbPaVyI/GJMRbIRrw=; b=htKjh6T3D1K4l+c7x54nMlqEU5VAgHFiOtp2GZfUwUwB4Vzmzt6SbanO 0YcxSaSJAp8VQ6YXi05wPgMEvO66B6uJRHCAjJ0jC9imbWp44KkxdI9s/ v9+iOlZt58Bj0btMr+3a1HDYtn06RqgQVb7EzoiDwFfu8J2VRdUYzTerf qwTijrYRSE0NhJVvbgA8yiXxqSLIQGBigns9DX8WcUqrgC8b4NxNBrCaX UYHICCGJjxBn9l00WtDze9WcekG3SF3xSaLI3v6sq46IcPq/b34hEO1G8 SLsX5LWuJ94PwVuNV5hftU7EjrJtIbLgn1j7dUrfporXUjC0n1SspLnhE w==; X-CSE-ConnectionGUID: KJfEiatETS+HtqfKfMwUAQ== X-CSE-MsgGUID: vYi4WS2gSZi1PvSZitI9OA== X-IPAS-Result: A0AaAAAG+/Nq/5P/Ja1aHAEBAQEBAQcBARIBAQQEAQGBfAcBAQsBglZ1YENJjHKJWQOeIoF+DwEBAQ9EDQQBAYQ/RgKOHgImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAS0QHAMBAi8rIwgZgwIBgnQDEblWgXkzgQGCZkMBPwJDUNlLgWgBCxQBBYEzAYVBModyXRgBhH0nG4FJRIR+gQWBXAEBiCYEgxwSgVqNGgKBT4clSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgRyBHoESgQddgSsoXQEhgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxnCxoFYQgCDQx0ORAwHiQvBRomPhsKfhgNSBEsNxUZBD5uB5JugxUBWDUBK4EFQGIWo0SCIaERhCqBaIo8lToaM4VbpRcLmH2OCpZRhGqBaDxGgQELBzMaCBsVgyIJShkPjisDCwuDYIF/gxTJSCYyAgkyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:OvBu66sHK0vsgWefJrFJ2Ka5cOfnVABfMUV32f8akzHdYApBsoF/q tZmKW6FOa6CMDCnL4tyPo229kkC65CBytFmSwE9/C1jRngTgMeUXt7xwmUckM+xwmwvaGo9s q3yv/GZdJhcokf0/0nrb/656yYsjclkf5KkYMbcICd9WAR4fykojBNnioYRj5Vh6TSDK1vlV eja/YuFZzdJ5xYuajhKsvva8Us21BjPkGpwUmIWNKgjUGD2zxH5PLpHTYmtIn3xRJVjH+LSb 47r0LGj82rFyAwmA9Wjn6yTWhVirmn6ZFXmZtJ+AsBOszAazsAA+v9T2Mk0NS+7vw60c+VZk 72hg3AfpTABZcUgkMxFO/VR/roX0aduoNcrKlDn2SCfItGvn3bEm51T4E8K0YIw2cR5LGBH6 dEkE3MtcgmNpOyT34+Sc7w57igjBJGD0II3oHpsy3TdSP0hW52GGv2M7t5D1zB2jcdLdRrcT 5NGMnw0M1KaPkAJYwtIYH49tL/Aan3XeidAqU6NrII84nPYy0p6172F3N/9J4DUGZoFxxbCz o7A13rIA00lD4aQ8giEq0qyvd3OgQKqf6tHQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHtlYM UE8/is1sbN081SmSNT4VRC0rHOI+BkGVLJt//YS8gqBzO/Qpg2eHGVBF2YHY909v8hwTjsvv rOUo+7U6fVUmOX9YRqgGn2891te5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:UZf6869M///hACbmwuxuk+AAI+orL9Y04lQ7vn2ZhyY7TiX+rb HIoB11737JYVoqNU3I3OrwWpVoIkmskaKdn7NwAV7KZmCP0wGVxcNZnO7fKlbbdREWmNQw6U 5ISdkZNDSJNykYse/KpC+lDt0n3N6LtIqshevY0jNRaDsCUdAY0++8YTzraXGfg2J9dOIEKK Y= X-Talos-CUID: 9a23:G6E5dWtMpetFz/colFGdsxui6IsGUHPwzX7MDnODSkZ1UbO2R3qPxYpdxp8= X-Talos-MUID: 9a23:VP2tLwWnJFzACrrq/CHdhW1dD51n2JavUXgTqqcHp+jVEgUlbg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,207,1787011200"; d="scan'208";a="546478182" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 11 Nov 2026 05:25:34 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id 115691800025B; Wed, 11 Nov 2026 05:25:34 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id AABE3CBF22F; Tue, 10 Nov 2026 21:25:33 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][blacksail][PATCH 03/10] sqlite3: fix CVE-2026-119374 Date: Tue, 10 Nov 2026 21:25:25 -0800 Message-Id: <20261111052532.1258975-3-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261111052532.1258975-1-arpitpa@cisco.com> References: <20261111052532.1258975-1-arpitpa@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 05:25:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249946 This patch applies the upstream fix [1], which addresses an FTS5 secure-delete buffer overrun when handling a corrupted database. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9 [2] https://sqlite.org/src/info/9cd4f9e920 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119374 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119374.patch | 78 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.53.4.bb | 1 + 2 files changed, 79 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch new file mode 100644 index 0000000000..15ca70d338 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch @@ -0,0 +1,78 @@ +From 6875e24f0c0612feccb97ab4c3f92c8444833373 Mon Sep 17 00:00:00 2001 +From: dan +Date: Tue, 11 Aug 2026 14:16:12 +0000 +Subject: [PATCH] Fix a problem in fts5 secure-delete code that could lead to a + buffer overrun when dealing with a strategically corrupted database. Problem + reported by YEONBA. + +FossilOrigin-Name: 9cd4f9e9205c5a5096388397a39349db9ff5377d19095c6b20388ff799969c31 + +CVE: CVE-2026-119374 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9] + +Backport Changes: +- Applied the fix from ext/fts5/fts5_index.c to sqlite3.c because the + recipe uses SQLite's amalgamated source. +- Omitted ext/fts5/test/fts5corruptB.test because the extracted source + does not include the upstream Tcl test tree. +- Omitted manifest and manifest.uuid because they are Fossil metadata + and are not needed for this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 06ceecf..4fb0674 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -256381,34 +256381,38 @@ static void fts5DoSecureDelete( + if( p->rc==SQLITE_OK ){ + const int nMove = nPg - iNextOff; /* Number of bytes to move */ + int nShift = iNextOff - iOff; /* Distance to move them */ +- ++ int nNewPg = 0; + int iPrevKeyOut = 0; +- int iKeyIn = 0; ++ i64 iKeyIn = 0; + + if( nMove>0 ){ + memmove(&aPg[iOff], &aPg[iNextOff], nMove); + } + iPgIdx -= nShift; +- nPg = iPgIdx; ++ nNewPg = iPgIdx; + fts5PutU16(&aPg[2], iPgIdx); + + for(iIdx=0; iIdxnPg ){ ++ FTS5_CORRUPT_IDX(p); ++ break; ++ } + if( iKeyIn!=iDelKeyOff ){ + int iKeyOut = (iKeyIn - (iKeyIn>iOff ? nShift : 0)); +- nPg += sqlite3Fts5PutVarint(&aPg[nPg], iKeyOut - iPrevKeyOut); ++ nNewPg += sqlite3Fts5PutVarint(&aPg[nNewPg], iKeyOut - iPrevKeyOut); + iPrevKeyOut = iKeyOut; + } + } + +- if( iPgIdx==nPg && nIdx>0 && pSeg->iLeafPgno!=1 ){ ++ if( p->rc==SQLITE_OK && iPgIdx==nNewPg && nIdx>0 && pSeg->iLeafPgno!=1 ){ + fts5SecureDeleteIdxEntry(p, iSegid, pSeg->iLeafPgno); + } + +- assert_nc( nPg>4 || fts5GetU16(aPg)==0 ); +- fts5DataWrite(p, FTS5_SEGMENT_ROWID(iSegid,pSeg->iLeafPgno), aPg, nPg); ++ assert_nc( nNewPg>4 || fts5GetU16(aPg)==0 ); ++ fts5DataWrite(p, FTS5_SEGMENT_ROWID(iSegid,pSeg->iLeafPgno), aPg, nNewPg); + } + sqlite3_free(aIdx); + } +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb index 4ec6eb230e..0c7b713728 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb @@ -26,6 +26,7 @@ SRC_URI += "file://0001-Add-option-to-disable-zlib.patch \ file://CVE-2026-119377_p1.patch \ file://CVE-2026-119377_p2.patch \ file://CVE-2026-119373.patch \ + file://CVE-2026-119374.patch \ " SRC_URI[sha256sum] = "0e9483900e92cd5de8fd48d16bf9200145a61f7fd5be542a5ac81d8a9516eb9c" From patchwork Wed Nov 11 05:25:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103652 Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3241.1794374735021977710 for ; Tue, 10 Nov 2026 21:25:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Xn9ow8hT; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3212; q=dns/txt; s=iport01; t=1794374735; x=1795584335; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=669SM/KE6Se+XIYzm29Z3NWMZc51EYPHVzDKJIGpMZg=; b=Xn9ow8hT1FfFDt36MxTr+bd0QfHZPpdn7N4DS6DCFkXToHtBGcmJC9VK rPPzbHsW6Tkk3rOZzkanI2LySXKd2j9QE+j/peXXvejoUhATVPP8F4fbG gFlKZrCQgHTJySE30r/R3uGGCpt7KQ2rtCfAUC7uZpVJsdsfRgdRVaE1B KVHLHBl55qobxB4IoicAgYDrY92E7quwv8JfzX5vS7OjHmqAKlewaZYDs fo2FX4p8nSnX1Gd6/ZzxnJb2nWu759iDG1nDaM08OpMaIOLr+d+SCPCEM YQVCwkLj8QfxUyBETQkVynx326zAq1MoIK+aVtL8v3VqenxkVaI1BBYe4 A==; X-CSE-ConnectionGUID: CKgEhCQeQgG7wqn7X7SV/w== X-CSE-MsgGUID: z/7Olts6Rlm0GixYylCy2g== X-IPAS-Result: A0BIAgAG+/Nq/5H/Ja1aglmCV3VgQ0mWSwOeIoF+DwEBAQ9EDQQBAYQ/RgKOHgImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAS0QHAMBAi8rIwgZgwIBgnQDEblWgXkzgQGDKQE/AkNQ2UuBaAELFAEFgTOFQjKHcl0YAYR9JxuBSUSEfoEFgVwBAYEnhn8EgxwSgVqNGgKBT4clSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgRyBHoESgQddgSsoXQEhgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxnCxoFYQgCDQx0ORAwHiQvBRomPhsKfhgNSBEsNxUZBD5uB5JugxQBAVg1ASuCBTijRIIhoRGEKoFoijyVOhozhASUGpJUC5h9jgqWUYRqgWg8RoEBCwczGggbFYMiCUoZD44uCwuDYIF/gxTJSCYyAgkyAQEHAgcOAwuBaJAAgX4BAQ IronPort-Data: A9a23:8bncE6OPAhh5/bvvrR3zlsFynXyQoLVcMsEvi/4bfWQNrUoj1mBTy 2dLCm3Saf7fZDOkeoh1b4+09RsHvpeGxt5hS3M5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeap1yFjmD9k/F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WVzlV e/a+ZWFZgb8gmcsawr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj695NA2w2FrQVw+lYXn5X8 6ModwszKQ/W0opawJrjIgVtrt4oIM+uOMYUvWttiGmJS/0nWpvEBa7N4Le03h9p2ZsIRqmYP ZdEL2MzMXwsYDUXUrsTIJskhOa0nnDXeDxDo1XTrq0yi4TW5FEtjuW3YIKFKrRmQ+1H2Rm/o n7doV79B0k1Ncyu2D6u4yij07qncSTTHdh6+KeD3vlyjVuew2YeBBEbWR6wpuO0okq/QM5Eb UsM9ywjqKI/+ECmQp/6RRLQnZKflgQXV9wVF6gx7xuAj/KEpQ2YHWMDCDVGbbTKqfMLeNDj7 XfR9/uBONClmOT9pa61nltMkQ6PBA== IronPort-HdrOrdr: A9a23:H9sSFqxCWTcQLy2fCmyVKrPw9L1zdoMgy1knxilNoNJuHfBw8P re+8jzuiWUtN98YhwdcJW7Scu9qBDnhPpICPcqXYtKNTOO0ADDEGgh1/qG/9SKIUPDH4BmuZ uIWpIObuEYdWIK7vrS0U2fD8sqxsWB/eSDgOfTyGoocCRRApsQljuQzm2gYzZLrM4sP+tAKK ah X-Talos-CUID: 9a23:8WN1fWOKd/6EDO5Dcwpo2U4/I80cfVKC027WfH/nMlguV+jA X-Talos-MUID: 9a23:DHr00ASwNzIhB27bRXT+w25FMNtzvZ6qDRgikIU3qs2vJHZ/bmI= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,207,1787011200"; d="scan'208";a="546528088" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 11 Nov 2026 05:25:34 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id 156801800044B; Wed, 11 Nov 2026 05:25:34 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id AE82ACBF230; Tue, 10 Nov 2026 21:25:33 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][blacksail][PATCH 04/10] sqlite3: fix CVE-2026-119375 Date: Tue, 10 Nov 2026 21:25:26 -0800 Message-Id: <20261111052532.1258975-4-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261111052532.1258975-1-arpitpa@cisco.com> References: <20261111052532.1258975-1-arpitpa@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 05:25:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249945 This patch applies the upstream fix [1], which fully initializes the page read when the WAL and database page sizes differ, preventing disclosure of uninitialized page data. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e [2] https://sqlite.org/src/info/f9b4ee369557c36c Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119375 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119375.patch | 47 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.53.4.bb | 1 + 2 files changed, 48 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119375.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119375.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119375.patch new file mode 100644 index 0000000000..149889f90c --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119375.patch @@ -0,0 +1,47 @@ +From c9e05db641c387aad309081b35afa3e703aa075d Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Sun, 16 Aug 2026 10:49:39 +0000 +Subject: [PATCH] When reading a frame from a WAL file where the WAL pagesize + and the database pagesize disagree, be sure to fully initialize the page that + is read. + +FossilOrigin-Name: f9b4ee369557c36c606666bd7e6d8dc4685d87531993d3ce4e7a718aa814a5ac + +CVE: CVE-2026-119375 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e] + +Backport Changes: +- Applied the src/wal.c change to sqlite3.c because the recipe source + uses the amalgamated SQLite layout. +- Omitted manifest and manifest.uuid because they are Fossil + repository metadata and are not needed in this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 4fb0674..04f4eea 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -71183,11 +71183,15 @@ SQLITE_PRIVATE int sqlite3WalReadFrame( + i64 iOffset; + sz = pWal->hdr.szPage; + sz = (sz&0xfe00) + ((sz&0x0001)<<16); ++ if( nOut>sz ){ ++ memset(pOut+sz, 0, nOut-sz); ++ nOut = sz; ++ } + testcase( sz<=32768 ); + testcase( sz>=65536 ); + iOffset = walFrameOffset(iRead, sz) + WAL_FRAME_HDRSIZE; + /* testcase( IS_BIG_INT(iOffset) ); // requires a 4GiB WAL */ +- return sqlite3OsRead(pWal->pWalFd, pOut, (nOut>sz ? sz : nOut), iOffset); ++ return sqlite3OsRead(pWal->pWalFd, pOut, nOut, iOffset); + } + + /* +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb index 0c7b713728..29187e75b4 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb @@ -27,6 +27,7 @@ SRC_URI += "file://0001-Add-option-to-disable-zlib.patch \ file://CVE-2026-119377_p2.patch \ file://CVE-2026-119373.patch \ file://CVE-2026-119374.patch \ + file://CVE-2026-119375.patch \ " SRC_URI[sha256sum] = "0e9483900e92cd5de8fd48d16bf9200145a61f7fd5be542a5ac81d8a9516eb9c" From patchwork Wed Nov 11 05:25:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103651 Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3243.1794374735250697674 for ; Tue, 10 Nov 2026 21:25:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=aKaa6iOs; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4189; q=dns/txt; s=iport01; t=1794374735; x=1795584335; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=OJu5z3OqhAxaExsyR9qa9XVo5jUSO5xTc6URp1YSQbQ=; b=aKaa6iOsQmx39ikA2dPJ3AcecN7HbkySui29eJwem7Yos6H7dtfnmolg 5QYGNEv6fypQrPITt223ItNIzY9d3015O4trKegllw02C56htnxwUKFIi VXpPyKFPgzEyINXlMfogGUeLRZHi/VbeDYO8CBzGOpcOMLF6CsXDOJjGv OY8rhdVUlZ4KE3dmpqhWhAQOsFTXziZyOXYqtZyb8DrakQhu8vrIiu3yS Says9fjul4lUI7vPl3SGWf8hQ49T6eP8Fb5QqzhrjoIbcQa7n9zK8Om6L GYNZ0YhreeEA9qhV5X16py6aPFlsotJkTdy0DUJFGkYUmLZUu2GTe13Cf A==; X-CSE-ConnectionGUID: xmlWm2LLRuOR202xDdBcAQ== X-CSE-MsgGUID: 9ZwKf1nYRmu+8yPQneYitQ== X-IPAS-Result: A0BIAgAG+/Nq/4v/Ja1aHgEBCxIMggULgld1YENJlksDniKBfg8BAQEPRA0EAQGEP0YCjh4CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAEtEBwDAQIvKyMIGYMCAYJ0AxG5VoF5M4EBgmZDAT8CQ1DZS4FoAQsUAQWBM4VCModyXRgBhH0nG4FJRIJQgi6BBYFcAQGIJgSDHBKBWo0aAoFPhyVIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHIEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGcLGgVhCAINDHQ5EDAeJC8FGiY+Gwp+GA1IESw3FRkEPm4Hkm6DFQE8HDUBK4IENgOTAJBEgiGhEYQqgWiKPJU6GjOFW6UXC5h9jgqWUYRqgWg8gUcLBzMaCBsVgyIJShkPji4LC4NggX+DFMlIJjICCTIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:q2gI4axuqSNRnBc29gB6t+dhxyrEfRIJ4+MujC+fZmUNrF6WrkUCy GtKXW/TMvfZZzPwe9pwb43n90IBvcfXzdVqSVdopVhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWctaztMsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJFEzObIdoMJTO3xpz 6ZAciAhYjqIrtvjldpXSsE07igiBNPgMIVavjRryivUSK58B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2bMnWjOX9PYH46tO6ynnjjazRwo1OOrq1x6G/WpOB0+OWxbYqFKoLXG625mG7Jl H3l8T3/MysfKZ/P2AK89H+dh/P2yHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rbyyjVSzc9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7DQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSv1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:sKUndKzw68AJsFTsREKMKrPw9L1zdoMgy1knxilNoNJuHfBw8P re+8jzuiWUtN98YhwdcJW7Scu9qBDnhPpICPcqXYtKNTOO0ADDEGgh1/qG/9SKIUPDH4BmuZ uIWpIObuEYdWIK7vrS0U2fD8sqxsWB/eSDgOfTyGoocCRRApsQljuQzm2gYzZLrM4sP+tAKK ah X-Talos-CUID: 9a23:h+Qjk2p0MdrCVi0WJkm61TrmUdAgdkLYllP0GVKfMzwxEq25RXWb0Zoxxg== X-Talos-MUID: 9a23:Mehm8gvY5EPxALNsWM2n1QN9F8kx5ZWUDV1OwYQ+gs+JBC1sAmLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,207,1787011200"; d="scan'208";a="545888656" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 11 Nov 2026 05:25:34 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id 1B38E18000203; Wed, 11 Nov 2026 05:25:34 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id B3CCFCBF231; Tue, 10 Nov 2026 21:25:33 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][blacksail][PATCH 05/10] sqlite3: fix CVE-2026-119379 Date: Tue, 10 Nov 2026 21:25:27 -0800 Message-Id: <20261111052532.1258975-5-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261111052532.1258975-1-arpitpa@cisco.com> References: <20261111052532.1258975-1-arpitpa@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 05:25:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249944 This patch applies the upstream fix [1], which prevents a buffer overrun when applying a strategically corrupted changeset through SQLite's session extension. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52 [2] https://sqlite.org/src/info/3f57024aecea0f3b Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119379 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119379.patch | 79 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.53.4.bb | 1 + 2 files changed, 80 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119379.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119379.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119379.patch new file mode 100644 index 0000000000..1fad466b3d --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119379.patch @@ -0,0 +1,79 @@ +From 17e3b5a6f6c3a5e852a86597ad68f259d802296a Mon Sep 17 00:00:00 2001 +From: dan +Date: Mon, 17 Aug 2026 11:31:59 +0000 +Subject: [PATCH] Avoid a buffer overrun when processing a strategically + corrupted changeset. Report [bugs:/info/2026-08-16T10:15:25Z | + 2026-08-16T10:15:25Z]. + +FossilOrigin-Name: 3f57024aecea0f3b565ed823cf94b085031c481fd6323c1f2e4319a53500864f + +CVE: CVE-2026-119379 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52] + +Backport Changes: +- Applied the ext/session/sqlite3session.c fix to sqlite3.c because + the recipe source uses the amalgamated SQLite layout. +- Omitted ext/session/sessioncorrupt.test because the extracted source + does not include the upstream test tree. +- Omitted manifest and manifest.uuid because they are Fossil + metadata and are not required for this backport. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 04f4eea..39b300c 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -239370,10 +239370,10 @@ static int sessionChangesetApply( + int schemaMismatch = 0; + int rc = SQLITE_OK; /* Return code */ + const char *zTab = 0; /* Name of current table */ +- int nTab = 0; /* Result of sqlite3Strlen30(zTab) */ + SessionApplyCtx sApply; /* changeset_apply() context object */ + int bPatchset; + u64 savedFlag = db->flags & SQLITE_FkNoAction; ++ int bNew = 0; /* True for first entry of new table */ + + assert( xConflict!=0 ); + +@@ -239395,15 +239395,16 @@ static int sessionChangesetApply( + if( rc==SQLITE_OK ){ + rc = sqlite3_exec(db, "PRAGMA defer_foreign_keys = 1", 0, 0, 0); + } +- while( rc==SQLITE_OK && SQLITE_ROW==sqlite3changeset_next(pIter) ){ ++ while( rc==SQLITE_OK && SQLITE_ROW==sessionChangesetNext(pIter, 0, 0,&bNew) ){ + int nCol; + int op; + const char *zNew; + + sqlite3changeset_op(pIter, &zNew, &nCol, &op, 0); + +- if( zTab==0 || sqlite3_strnicmp(zNew, zTab, nTab+1) ){ ++ if( bNew ){ + u8 *abPK; ++ bNew = 0; + + rc = sessionRetryConstraints( + db, pIter->bPatchset, zTab, &sApply, xConflict, pCtx +@@ -239438,7 +239439,6 @@ static int sessionChangesetApply( + rc = SQLITE_NOMEM; + break; + } +- nTab = (int)strlen(zTab); + sApply.azCol = (const char **)zTab; + }else{ + int nMinCol = 0; +@@ -239491,7 +239491,6 @@ static int sessionChangesetApply( + sApply.bStat1 = 0; + } + } +- nTab = sqlite3Strlen30(zTab); + } + } + +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb index 29187e75b4..2a0517efe6 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb @@ -28,6 +28,7 @@ SRC_URI += "file://0001-Add-option-to-disable-zlib.patch \ file://CVE-2026-119373.patch \ file://CVE-2026-119374.patch \ file://CVE-2026-119375.patch \ + file://CVE-2026-119379.patch \ " SRC_URI[sha256sum] = "0e9483900e92cd5de8fd48d16bf9200145a61f7fd5be542a5ac81d8a9516eb9c" From patchwork Wed Nov 11 05:25:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103658 Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3242.1794374735135445517 for ; Tue, 10 Nov 2026 21:25:36 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=fjUm5kqD; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3655; q=dns/txt; s=iport01; t=1794374735; x=1795584335; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=lA8igl0ZwOBXzc5LTqlG5/sfZKQo64NebVILOF3/VY8=; b=fjUm5kqDw3baLHI1PUD3sXUt66m4rn0+PfrkSHlBioXxBzaZedgntzFp GU6fBFEce+fseKzzOxf5jaxJVWmdTvr1kuF3SPLt+H40dPf35F/DihMZw xHjUaCMfNrcEsIx0I1URPwyEi7P1yX7oCCcL6eZ83hNyf/higDjUmzhHG M8aKant/CgaqEnKwj3nK3Q3/cyzJCFTA/22wQPC4NwSKDEIWp/M5l9Pxg oNrZ+O7/kYuGndBwEf3uuLjDl6D2xaFMUXIvjKo+Wv1faO+jf24qcEdqs AB7XBgQ3BA7di4H2koCZrEMtI8WJgfPWkG1UqZHz5voG4bVXVN1LJCYTh w==; X-CSE-ConnectionGUID: 4SQsZZBTQrGcBzIz9MXp3w== X-CSE-MsgGUID: lZ3vHABASNSoZg2IfZGneA== X-IPAS-Result: A0AnAAAG+/Nq/4r/Ja1aHQEBAQEJARIBBQUBgXwIAQsBglZ1YENJjHKJWQOeIoF+DwEBAQ9EDQQBAYQ/RgKOHgImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAS0QHAMBAi8rIwgZgwIBgnQDEblWgXkzgQGDKQE/AkNQ2UuBaAELFAEFgTMBhUEyh3JdGAGEfScbgUlEhH6BBYFcAQGIJgSDHBKBWo0aAoFPhyVIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHIEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGcLGgVhCAINDHQ5EDAeJC8FGiY+Gwp+GA1IESw3FRkEPm4Hkm6DDgcBWDUBExiBBUB4kwCQRIIhoRGEKoFoijyVOhozhVulFwuYfY4KllGEaoFoPIFHCwczGggbFYMiCUoZD44rAwsLg2CBf4MUyUgmMgIJMgEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:Gu7SKa6qjCOKGp/vGhf/2AxRtG7GchMFZxGqfqrLsTDasY5as4F+v mUbCj+Ca/zYZGLxfNsjaYy29UpQvpCBn9Q3HgBq/iwwZn8b8sCt6fZ1gavT04J+CuWZESqLO u1HMoGowPgcFyGa+1H1dOex9RGQ7InQLpLkEunIJyttcgFtTSYlmHpLlvUw6mJSqYDR7zil5 5Wo/KUzBHf/g2QqaztNsvrawP9SlK2aVA0w7wRWic9j5Dcyp1FNZLoDKKe4KWfPQ4U8NoaSW +bZwbilyXjS9hErB8nNuu6TnpoiG+O60aCm0xK6aoD66vRwjnVaPpUTaJLwXXxqZwChxLid/ jniWauYEm/FNoWU8AgUvoIx/ytWZcWq85efSZSzXFD6I0DuKxPRL/tS4E4eYbYh4dRFK1137 9MTAiIsfEGmt/rt3+fuIgVsrpxLwMjDJogTvDRkiDreF/tjGcmFSKTR7tge1zA17ixMNa+BP IxCNnw1MUmGOkYfUrsUIMpWcOOAj2PnciFAoXqepLE85C7YywkZPL3FbYaLJoPaHJUI9qqej mb0pHrZKzszD/qkzgiKqFOitMDJkAquDer+E5X9rJaGmma7wXQeDhATX1a3rfS1z0W5Qd93L 00P5jFoqrA/8kGuRNTxUxC05nmesXYht8F4CeY27kSJj6HT+QvcXjFCRT9aY9tgv8gzLdA36 mK0cxrSLWQHmNWopbi1r994cRva1fApEFI/ IronPort-HdrOrdr: A9a23:SaTlVKBj3T9MEVDlHel055DYdb4zR+YMi2TDGXofdfUzSL3+qy nAppUmPHPP5Qr5HUtQ++xoW5PwJU80i6QU3WB5B97LN2PbUSmTXeRfBODZrQEIdReTygd179 YHT0EHMqySMXFKyeDn/QK/D9EshPOD8KyumKPi6k0Fd3ASV0mlhD0JcTpy1SZNNXF7OaY= X-Talos-CUID: 9a23:ATbuA2iQApRcAefI+hZCMbA2ZDJuLkbk10XiCXOBE0liYq+0Ww61yLs/jJ87 X-Talos-MUID: 9a23:VHH/lgWgRnm4LEzq/Dve3y9CHe1B2IKVD3ICy7QIieaCOAUlbg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,207,1787011200"; d="scan'208";a="546478185" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 11 Nov 2026 05:25:34 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 74268180001CD; Wed, 11 Nov 2026 05:25:34 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id B7CF7CBF23C; Tue, 10 Nov 2026 21:25:33 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][blacksail][PATCH 06/10] sqlite3: fix CVE-2026-119372 Date: Tue, 10 Nov 2026 21:25:28 -0800 Message-Id: <20261111052532.1258975-6-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261111052532.1258975-1-arpitpa@cisco.com> References: <20261111052532.1258975-1-arpitpa@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 05:25:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249951 This patch applies the upstream fix [1], which prevents a use-after-free in FTS3 snippet() processing. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731 [2] https://sqlite.org/src/info/e4635c41536a Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119372 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119372.patch | 56 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.53.4.bb | 1 + 2 files changed, 57 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119372.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119372.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119372.patch new file mode 100644 index 0000000000..37fbba21be --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119372.patch @@ -0,0 +1,56 @@ +From a5fe767d0ba12d3082bd22b3c5341fdb6cc6ef95 Mon Sep 17 00:00:00 2001 +From: dan +Date: Mon, 17 Aug 2026 13:55:38 +0000 +Subject: [PATCH] Avoid a problem causing a use-after-free in the fts3 + snippet() function. Report [bugs:/info/2026-08-17T09:18:24Z | + 2026-08-17T09:18:24Z]. + +FossilOrigin-Name: e4635c41536a0b3620780c3f1c872de33121370bafb608fce9fe7e3113e2ae01 + +CVE: CVE-2026-119372 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731] + +Backport Changes: +- Applied the ext/fts3/fts3_snippet.c fix to sqlite3.c because the + recipe source uses the amalgamated SQLite layout. +- Omitted test/fts3snippet2.test because the extracted source does not + include the upstream Tcl test tree. +- Omitted manifest and manifest.uuid because they are Fossil + repository metadata and are not needed for this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 8a0f44c..76cb284 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -210732,6 +210732,7 @@ static int fts3BestSnippet( + sqlite3_int64 nByte; /* Number of bytes of space to allocate */ + int iBestScore = -1; /* Best snippet score found so far */ + int i; /* Loop counter */ ++ Fts3Expr *pExpr = pCsr->pExpr; + + memset(&sIter, 0, sizeof(sIter)); + +@@ -210760,9 +210761,12 @@ static int fts3BestSnippet( + sIter.nSnippet = nSnippet; + sIter.nPhrase = nList; + sIter.iCurrent = -1; +- rc = sqlite3Fts3ExprIterate( +- pCsr->pExpr, fts3SnippetFindPositions, (void*)&sIter +- ); ++ rc = sqlite3Fts3ExprIterate(pExpr, fts3SnippetFindPositions, (void*)&sIter); ++ if( rc==SQLITE_OK ){ ++ /* Iterate through the expression twice, in case pointers garnered during ++ ** the first iteration are invalidated by a call to fts5EvalRestart(). */ ++ rc = sqlite3Fts3ExprIterate(pExpr, fts3SnippetFindPositions, (void*)&sIter); ++ } + if( rc==SQLITE_OK ){ + + /* Set the *pmSeen output variable. */ +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb index 2a0517efe6..911f572029 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb @@ -29,6 +29,7 @@ SRC_URI += "file://0001-Add-option-to-disable-zlib.patch \ file://CVE-2026-119374.patch \ file://CVE-2026-119375.patch \ file://CVE-2026-119379.patch \ + file://CVE-2026-119372.patch \ " SRC_URI[sha256sum] = "0e9483900e92cd5de8fd48d16bf9200145a61f7fd5be542a5ac81d8a9516eb9c" From patchwork Wed Nov 11 05:25:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103656 Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3243.1794374735250697674 for ; Tue, 10 Nov 2026 21:25:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=O6aHDJO1; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3630; q=dns/txt; s=iport01; t=1794374735; x=1795584335; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=HGpxgNU2phkS3O8ytwWI+me0ofNXFcQgXVeY3ste6vg=; b=O6aHDJO1ERgBpmYeLFVSTHaWT8H+M9rAB09FrIM0nSwwYccUDszG+XND Ha41UYxAC8bgozhLGoGbz1Ht+uN+MOodyK2Bqi0pOuqg3BeTZo8k0Jzzu eC+lpF/pCwThH2b3yJnNtgn0okVBC26zJF4shHVwEfvlZLqzxn8eEMZG6 dmoiQTuHTdW/QEZZzLvB0YKCnKQj68kk7KwnC9fwU32UV1t4tMVWmEkjU lglcMu7gC71x5C60ML20789gxpKRATAgYDPeLzDHuoybZlAZvgC2y/uzr RQSi//rYdfIU7YQlE5tiLOFcDkKuBc1IzlQ8Zd11pe2W7OUAnyrhufCx6 g==; X-CSE-ConnectionGUID: DFLtKCtyRBqzgQG870hwNw== X-CSE-MsgGUID: 7s9Tc5TQSIWQ8N8S1doVCA== X-IPAS-Result: A0BIAgAG+/Nq/4z/Ja1aHgEBCxIMggULgld1YENJlksDniKBfg8BAQEPRA0EAQGEP0YCjh4CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAEtEBwDAQIvKyMIGYMCAYJ0AxG5VoF5M4EBgmZDAT8CQ1DZS4FoAQsUAQWBM4VCModyXRgBhH0nG4FJRIQIdoEFgVwBAYEnhn8EgxwSgVqNGgKBT4clSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgRyBHoESgQddgSsoXQEhgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxnCxoFYQgCDQx0ORAwHiQvBRomPhsKfhgNSBEsNxUZBD5uB5Jugw4HASwsGxoBExiBRXiTAJBEgiGhEYQqgWiKPJU6GjOFW6UXC5h9jgqWUYRqgWg8gUcLBzMaCBsVgyIJShkPji0BCwuDYIF/gxTJSCYyAgkyAQEHAgcOAwuBaJAAgX4BAQ IronPort-Data: A9a23:UAaoV6p8+Lx330baf6EUklqnWAZeBmJOZBIvgKrLsJaIsI4StFCzt garIBmFOPyNamX8etwkbY608U1U6pKHyNBmTFA5rnxjRCwW9+PIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfva8Uo35ZwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0spZJX1t3 uAJEhoUfB+6qLLpmLKkbPY506zPLOGzVG8ekmtrwTecCbMtRorOBv2Ro9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5LUPrSn8/w7pX7WzRCsFOJvaMf6GnIxws327/oWDbQUoHWGJUFzhjF+ Qoq+UymGUAmP4Gj8AGkzUv8oL/0xC/8Zqk7QejQGvlCxQf7KnYoIBoOWF22pPO0hkKzV5dUL FYZ0i4vtrQpskuzQ9/wWhe1rHKJslgbQdU4LgEhwBuGxqyR50OSAXIJC2YaLtcnr8QxAzct0 zdlgu/UONCmi5XNIVr1y1tehWna1fQ9RYPaWRI5cA== IronPort-HdrOrdr: A9a23:C4Vj86nmF1Eem5KH7HmVY/5ZM4rpDfL03DAbv31ZSRFFG/FwWf rAoB19726StN9/YhAdcLy7VZVoBEmsl6KdgrNhWYtKIjOHhILAFugLhuHfKn/bakjDH4Vmu5 uIHZITNDTYNykdsS+D2njaL/8QhP+a7auvmeDSi11pTQ1sduVcyj0RMHfjLqWzLzM2fqbQ0/ Gnl7J6mwY= X-Talos-CUID: 9a23:3vrnJGveMVvPJp9W5eVCbWW/6IsJXFnB71zMMnWSEHRmcZLFFgeQ54V7xp8= X-Talos-MUID: 9a23:amFhLA8C7+2AswDYrZsE4x6Qf5hzspilVXw0qrQ5gpmiZRcpNzCjpx3iFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,207,1787011200"; d="scan'208";a="545888657" Received: from rcdn-l-core-03.cisco.com ([173.37.255.140]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 11 Nov 2026 05:25:34 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-03.cisco.com (Postfix) with ESMTPS id 74956180001C1; Wed, 11 Nov 2026 05:25:34 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id BE2FDCBF23D; Tue, 10 Nov 2026 21:25:33 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][blacksail][PATCH 07/10] sqlite3: fix CVE-2026-119378 Date: Tue, 10 Nov 2026 21:25:29 -0800 Message-Id: <20261111052532.1258975-7-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261111052532.1258975-1-arpitpa@cisco.com> References: <20261111052532.1258975-1-arpitpa@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-03.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 05:25:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249949 This patch applies the upstream fix [1], which prevents a use-after-free in R-Tree when a manipulated shadow-table schema causes sqlite3_last_insert_rowid() to return 0. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04 [2] https://sqlite.org/src/info/6a9e1415659f9e75 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119378 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119378.patch | 52 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.53.4.bb | 1 + 2 files changed, 53 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119378.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119378.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119378.patch new file mode 100644 index 0000000000..23d9aaf6aa --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119378.patch @@ -0,0 +1,52 @@ +From 347b0263ce597345446fcfd259d063ef86228191 Mon Sep 17 00:00:00 2001 +From: dan +Date: Thu, 24 Sep 2026 20:14:31 +0000 +Subject: [PATCH] Avoid a use-after-free problem in rtree triggered by an + attacker manipulating the shadow table schema to ensure + sqlite3_last_insert_rowid() returns 0 after certain INSERTs. Problem reported + by Claude and Ada Logics. + +FossilOrigin-Name: 6a9e1415659f9e75940b3c3a6f6e123f61c5e9e2a7a612693ee395d7b7567bef + +CVE: CVE-2026-119378 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04] + +Backport Changes: +- Applied the ext/rtree/rtree.c fix to sqlite3.c because the recipe + source uses the amalgamated SQLite layout. +- Omitted ext/rtree/rtreeI.test because the extracted source does not + include the upstream test tree. +- Omitted manifest and manifest.uuid because they are Fossil + repository metadata and are not needed for this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 76cb284..d2c0f23 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -219417,7 +219417,17 @@ static int nodeWrite(Rtree *pRtree, RtreeNode *pNode){ + sqlite3_bind_null(p, 2); + if( pNode->iNode==0 && rc==SQLITE_OK ){ + pNode->iNode = sqlite3_last_insert_rowid(pRtree->db); +- nodeHashInsert(pRtree, pNode); ++ if( pNode->iNode==0 ){ ++ /* If the SQL statement has succeeded but sqlite3_last_insert_rowid() ++ ** returns 0, then the shadow table schema has been corrupted somehow ++ ** (e.g. the %_node table has been replaced by a WITHOUT ROWID table). ++ ** It would be dangerous to continue in this case as the hash table ++ ** implementation assumes iNode==0 means that the node is not part ++ ** of the hash table. */ ++ rc = SQLITE_CORRUPT_VTAB; ++ }else{ ++ nodeHashInsert(pRtree, pNode); ++ } + } + } + return rc; +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb index 911f572029..1aea7cb374 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb @@ -30,6 +30,7 @@ SRC_URI += "file://0001-Add-option-to-disable-zlib.patch \ file://CVE-2026-119375.patch \ file://CVE-2026-119379.patch \ file://CVE-2026-119372.patch \ + file://CVE-2026-119378.patch \ " SRC_URI[sha256sum] = "0e9483900e92cd5de8fd48d16bf9200145a61f7fd5be542a5ac81d8a9516eb9c" From patchwork Wed Nov 11 05:25:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103654 Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3331.1794374735405499012 for ; Tue, 10 Nov 2026 21:25:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=VGCO8994; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4810; q=dns/txt; s=iport01; t=1794374735; x=1795584335; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=KuFJzfQ+JGmOGk7By8RkrrZyU4zv8FSXH+dGlyOBQyU=; b=VGCO8994fFUTDPqj1lFOhuXNFh5p+EjZiPIeN01b3AaxI0aQom6vfhoC B34QlQHqZwthMdNpc7wVxgJABrjJlX9FmfTLEwaWGt802/9zpDdkio9yt li145s8/kiYh6b51YiXNZgCIGBQ+M3dhLgyQgqptmBTWS+UEPBUmEzDzf 0X3xZREWFPKQHrT5T1P2RkHzUUF4Jzyd7rq9frOfE/W5m2UuqE8MqqLMY fMhZv2a9fOKQjkbyUwNcrPyRg0bACgO1qID9m13qlRJ+K9hsQjeDfifud Lw/jmS0sxNsyMUTlNBOfTrxVSRzRgoqbT7adOqKtiNOWmkWu5bKesTbDn w==; X-CSE-ConnectionGUID: 0y8YjfvCSMuH/gsu3/2Nsg== X-CSE-MsgGUID: 5iV5rabnRu6LGICQrWb65w== X-IPAS-Result: A0AnAAAG+/Nq/5P/Ja1aHQEBAQEJARIBBQUBgXwIAQsBglZ1YENJjHKJWQOeIoF+DwEBAQ9EDQQBAYQ/RgKOHgImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAS0QHAMBAi8rIwgZgwIBgnQDEblWgXkzgQGCZkMBPwJDUNlLgWgBCxQBBYEzAYVBModyXRgBhH0nG4FJRIJQgi6BBYFcAQGBOIZuBIMcEoFajRoCgU+HJUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEcgR6BEoEHXYErKF0BIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZwsaBWEIAg0MdDkQMB4kLwUaJj4bCn4YDUgRLDcVGQQ+bgeSboMCEwFYNQErgj2jRIIhoRGEKoFoijyVOhozhVulFwuYfY4KllGEaoFoPIFHCwczGggbFYMiCUoZD44uCwuDYIF/gxTJSCYyAgkyAQEHAgcOAwuBaJABgX0BAQ IronPort-Data: A9a23:M6/IWaOLpYLvfxLvrR3zlsFynXyQoLVcMsEvi/4bfWQNrUoq1jxVy jBNUDiOOq3eNjbxKdxxPtvj8BhUvpWDztJkQXM5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeap1yFjmD9k/F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WVzlV e/a+ZWFZgb8gmcsawr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj661/XHA0M5MzwcNqISZB7 uFDb2ordR/W0opawJrjIgVtrt4oIM+uOMYUvWttiGiBS/0nWpvEBa7N4Le03h9p2ZsIRqmYP ZdEL2MzM3wsYDUXUrsTIJskhOa0nnDXeDxDo1XTrq0yi4TW5FEtjue8b4eEKrRmQ+0In3jFv GvM+V7kXDU1Ffem0wWPrC+z07qncSTTHdh6+KeD3vlyjVuew2YeBBEbWR6wpuO0okq/QM5Eb UsM9ywjqKI/+ECmQp/6RRLQnZKflgQXV9wVF6gx7xuAj/OMpQ2YHWMDCDVGbbTKqfMLeNDj7 XfR9/uBONClmOT9pa61nltMkQ6PBA== IronPort-HdrOrdr: A9a23:erdmpa0dTS71b6bUJpGArQqjBGokLtp133Aq2lEZdPWaSKOlfq eV7ZMmPHDP6Qr5NEtMpTnEAtjjfZq+z+8Q3WBuB9eftWDd0QPCRr2Kr7GSpgEIcBeRygcy78 tdmoFFebvN5CBB/KXHyTj9Nco8y9+a963tr+Lfw3BxCTxOUchbnn5E4sLxKDwMeOGAbqBJbK ah2g== X-Talos-CUID: 9a23:DF+HK2FUvJm3H0VRqmI/5R4lGM47WUb40VeXLFSlUiEzbqaaHAo= X-Talos-MUID: 9a23:g2fTFgthc/4RM7I+I82n2TBcad1h6aKUFR4pvrQtgtO7P3ItJGLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,207,1787011200"; d="scan'208";a="546797598" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 11 Nov 2026 05:25:34 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id 74B551800025B; Wed, 11 Nov 2026 05:25:34 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id C461ACBF23E; Tue, 10 Nov 2026 21:25:33 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][blacksail][PATCH 08/10] sqlite3: fix CVE-2026-119376 Date: Tue, 10 Nov 2026 21:25:30 -0800 Message-Id: <20261111052532.1258975-8-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261111052532.1258975-1-arpitpa@cisco.com> References: <20261111052532.1258975-1-arpitpa@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 05:25:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249947 This patch applies the upstream fix [1], which includes COLLATE expressions in expression tree depth calculations and prevents bypass of the expression depth limit. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2 [2] https://sqlite.org/src/info/252c0b7bf5a727d2 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119376 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119376.patch | 75 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.53.4.bb | 1 + 2 files changed, 76 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119376.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119376.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119376.patch new file mode 100644 index 0000000000..5a6bc97259 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119376.patch @@ -0,0 +1,75 @@ +From 2af844923ba3e32fb16b06adab4e4ad3b2f4da49 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Sun, 4 Oct 2026 21:54:17 +0000 +Subject: [PATCH] Fix expression tree depth calculations for COLLATE. + [bugs:/info/2026-10-04T04:50:56Z|Bug 2026-10-04T04:50:56Z] + +FossilOrigin-Name: 252c0b7bf5a727d29605672bb58e06c758173c276671df3e388a68294998b4d3 + +CVE: CVE-2026-119376 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2] + +Backport Changes: +- Ported the src/expr.c and src/sqliteInt.h changes into sqlite3.c + because the recipe source uses the amalgamated SQLite layout. +- Omitted test/sqllimits1.test because the extracted source does not + include the upstream test tree. +- Omitted manifest and manifest.uuid because they are Fossil + repository metadata and are not needed for this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index d2c0f23..cb678b2 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -22409,8 +22409,8 @@ SQLITE_PRIVATE void sqlite3SetTextEncoding(sqlite3 *db, u8); + SQLITE_PRIVATE CollSeq *sqlite3ExprCollSeq(Parse *pParse, const Expr *pExpr); + SQLITE_PRIVATE CollSeq *sqlite3ExprNNCollSeq(Parse *pParse, const Expr *pExpr); + SQLITE_PRIVATE int sqlite3ExprCollSeqMatch(Parse*,const Expr*,const Expr*); +-SQLITE_PRIVATE Expr *sqlite3ExprAddCollateToken(const Parse *pParse, Expr*, const Token*, int); +-SQLITE_PRIVATE Expr *sqlite3ExprAddCollateString(const Parse*,Expr*,const char*); ++SQLITE_PRIVATE Expr *sqlite3ExprAddCollateToken(Parse *pParse, Expr*, const Token*, int); ++SQLITE_PRIVATE Expr *sqlite3ExprAddCollateString(Parse*,Expr*,const char*); + SQLITE_PRIVATE Expr *sqlite3ExprSkipCollate(Expr*); + SQLITE_PRIVATE Expr *sqlite3ExprSkipCollateAndLikely(Expr*); + SQLITE_PRIVATE int sqlite3CheckCollSeq(Parse *, CollSeq *); +@@ -113018,23 +113018,29 @@ SQLITE_PRIVATE int sqlite3ExprDataType(const Expr *pExpr){ + ** and the pExpr parameter is returned unchanged. + */ + SQLITE_PRIVATE Expr *sqlite3ExprAddCollateToken( +- const Parse *pParse, /* Parsing context */ ++ Parse *pParse, /* Parsing context */ + Expr *pExpr, /* Add the "COLLATE" clause to this expression */ + const Token *pCollName, /* Name of collating sequence */ + int dequote /* True to dequote pCollName */ + ){ +- if( pCollName->n>0 ){ ++ if( pCollName->n>0 && pParse->nErr==0 ){ + Expr *pNew = sqlite3ExprAlloc(pParse->db, TK_COLLATE, pCollName, dequote); ++ assert( pExpr!=0 ); + if( pNew ){ + pNew->pLeft = pExpr; + pNew->flags |= EP_Collate|EP_Skip; ++#if SQLITE_MAX_EXPR_DEPTH>0 ++ pNew->nHeight = pExpr->nHeight+1; ++ sqlite3ExprCheckHeight(pParse, pNew->nHeight); ++ testcase( pParse->nErr>0 ); ++#endif + pExpr = pNew; + } + } + return pExpr; + } + SQLITE_PRIVATE Expr *sqlite3ExprAddCollateString( +- const Parse *pParse, /* Parsing context */ ++ Parse *pParse, /* Parsing context */ + Expr *pExpr, /* Add the "COLLATE" clause to this expression */ + const char *zC /* The collating sequence name */ + ){ +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb index 1aea7cb374..06cd34818f 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb @@ -31,6 +31,7 @@ SRC_URI += "file://0001-Add-option-to-disable-zlib.patch \ file://CVE-2026-119379.patch \ file://CVE-2026-119372.patch \ file://CVE-2026-119378.patch \ + file://CVE-2026-119376.patch \ " SRC_URI[sha256sum] = "0e9483900e92cd5de8fd48d16bf9200145a61f7fd5be542a5ac81d8a9516eb9c" From patchwork Wed Nov 11 05:25:31 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103655 Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3330.1794374735166642856 for ; Tue, 10 Nov 2026 21:25:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=i0qBo1s8; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=5379; q=dns/txt; s=iport01; t=1794374735; x=1795584335; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=iyEI8mweewzXXWsqUO+WHzPWm48hsfqk+iIukcbE4cg=; b=i0qBo1s80W2/4F6lYpaoScC4dfQP9pBpZrcuJHkC246krpA4VNhT9ed9 qMVb+I/X3pZaJNTppwbE4mZPigHtdW55htWpTXqxwYHd8MCJ/yc1yNkIv om3tsqUvLgnH76AWZPIzR4rmo27AkuOtPwl077Q85LSXGn4InJcuEeb8e UKyTw+00wmRAyW1nC5VcfZttm+ns3cLZJPNJD4PocwDxTR7cOy5FCGVKs qFlrDuqmT+oF7L4JBfZ7BCRSCkTlYyueQ+VI7iXT+GjhIBivUhwD0l3js EJy06Si2vwWWO6WJm2ZD0Jo+yC1M8nzVGqinzVwB+iA+Tdn38CDur+oMg A==; X-CSE-ConnectionGUID: pt7GoCpNR16Jkh31ubQz3w== X-CSE-MsgGUID: 8K05nqK8SU2IDt3BERMZ4g== X-IPAS-Result: A0AnAAAG+/Nq/4z/Ja1aHQEBAQEJARIBBQUBgXwIAQsBglZ1YENJjHKJWQOTIIsCgX4PAQEBD0QNBAEBhD9GAo4eAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBLRAcAwECLysjCBmDAgGCdAMRuVaBeTOBAYMpAT8CQ1DZS4FoAQsUAQWBMwGFQTKHcl0YAYR9JxuBSUSEfoEFgVwBAYE4hm4EgxwSgVqBAowYAoFPhyVIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHIEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGcLGgVhCAINDHQ5EDAeJC8FGiY+Gwp+GA1IESw3FRkEPm4Hkm6DFQE8HCITASuCPZMukBaCIaERhCqBaIo8lToaM4VbpRcLmH2OCpZRhGqBaDyBRwsHMxoIGxU7gmcJShkPji4LC4NggX+DFMlIJjICCTIBAQcCBw4DC4FokAGBfQEB IronPort-Data: A9a23:eVsxnaJSMyAKH7KzFE+Rh5QlxSXFcZb7ZxGr2PjKsXjdYENS1zcEz GIeWGCFOPjZamune9l1Oty1p04G7cLczNIyQFMd+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8gmctajt8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN12EB4ZOqYA3NwuX0NN9 adBNTo0fEuc0rfeLLKTEoGAh+w5J8XteYdasXZ6wHSBVrAtQIvIROPB4towMDUY358VW62BI ZBENHw2MEyojx5nYj/7DLo3hv+pmmH2WzZZs1mS46Ew5gA/ySQsjOa2aISFJ4biqcN9zmXA+ 2Tf3DTCP0s7GMDE4xe/10Dwibqa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++MuECSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXMIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:xkDIrq4fIB85pKiLrgPXwBDXdLJyesId70hD6qm+c3Nom6uj5q eTdZsgtCMc5Ax9ZJhko6HjBEDiewK5yXcK2+ks1N6ZNWGM0ldAbrsSiLcKqAePJ8SRzIJgPI 5bAs5D4aXLfDtHpPe/xhWkGNA9x9TC2qWpieDCi0pJd2hRGthdB8MTMHfhLqWwLzM2faYEKA == X-Talos-CUID: 9a23:lWiN0W0gJp+peQm2ly2A+7xfAtx6XXr21FHqehGaCmYyEaCfcE3L5/Yx X-Talos-MUID: 9a23:G+pGsAvDIwL78OYMx82n1BI6acFxwPSVNRosvYldkeS+EB4sNGLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,207,1787011200"; d="scan'208";a="546306852" Received: from rcdn-l-core-03.cisco.com ([173.37.255.140]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 11 Nov 2026 05:25:34 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-03.cisco.com (Postfix) with ESMTPS id 77269180001C8; Wed, 11 Nov 2026 05:25:34 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id C8678CBF23F; Tue, 10 Nov 2026 21:25:33 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][blacksail][PATCH 09/10] sqlite3: fix CVE-2026-119371 Date: Tue, 10 Nov 2026 21:25:31 -0800 Message-Id: <20261111052532.1258975-9-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261111052532.1258975-1-arpitpa@cisco.com> References: <20261111052532.1258975-1-arpitpa@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-03.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 05:25:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249948 This patch applies the upstream CTE recursion limit [1]. It uses the expression-depth counter and limit already present in SQLite 3.53.4, so the prerequisite patch is not needed. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb [2] https://sqlite.org/src/info/f54730871303e655 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119371 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119371.patch | 103 ++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.53.4.bb | 1 + 2 files changed, 104 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119371.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119371.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119371.patch new file mode 100644 index 0000000000..ecd644dd3d --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119371.patch @@ -0,0 +1,103 @@ +From e6ff280c839fdfc7418fd5add12e8f32702a17fb Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Mon, 5 Oct 2026 09:32:24 +0000 +Subject: [PATCH] Limit the depth of recursion for CTEs using + SQLITE_LIMIT_EXPR_DEPTH. [bugs:/info/2026-10-04T04:58:58Z|Bug + 2026-10-04T04:58:58Z]. + +FossilOrigin-Name: f54730871303e655a70f3167ce1a39dcd4e53fcf017d225f429e2bb67ad96604 + +CVE: CVE-2026-119371 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb] + +Backport Changes: +- Ported src/select.c changes into the amalgamated sqlite3.c file. +- Omitted test/with2.test because the extracted source lacks the + upstream Tcl test tree. +- Omitted manifest and manifest.uuid because they are Fossil metadata. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 36 ++++++++++++++++++++++++------------ + 1 file changed, 24 insertions(+), 12 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 816b998..3432915 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -151472,6 +151472,20 @@ SQLITE_PRIVATE void sqlite3SubqueryColumnTypes( + pTab->szTabRow = 1; /* Any non-zero value works */ + } + ++/* ++** Check the current subquery nesting depth. Return true and set an ++** error if it has gone too deep. ++*/ ++static int checkSubqueryNestingDepth(Parse *pParse){ ++#if SQLITE_MAX_EXPR_DEPTH>0 ++ if( pParse->nNestSel >= pParse->db->aLimit[SQLITE_LIMIT_EXPR_DEPTH] ){ ++ sqlite3ErrorMsg(pParse, "VIEWs and/or subqueries nested too deep"); ++ return 1; ++ } ++#endif ++ return 0; ++} ++ + /* + ** Given a SELECT statement, generate a Table structure that describes + ** the result set of that SELECT. +@@ -151482,12 +151496,7 @@ SQLITE_PRIVATE Table *sqlite3ResultSetOfSelect(Parse *pParse, Select *pSelect, c + u64 savedFlags; + + pParse->nNestSel++; +-#if SQLITE_MAX_EXPR_DEPTH>0 +- if( pParse->nNestSel >= db->aLimit[SQLITE_LIMIT_EXPR_DEPTH] ){ +- sqlite3ErrorMsg(pParse, "VIEWs and/or subqueries nested too deep"); +- return 0; +- } +-#endif ++ if( checkSubqueryNestingDepth(pParse) ) return 0; + savedFlags = db->flags; + db->flags &= ~(u64)SQLITE_FullColNames; + db->flags |= SQLITE_ShortColNames; +@@ -154703,14 +154712,13 @@ SQLITE_PRIVATE With *sqlite3WithPush(Parse *pParse, With *pWith, u8 bFree){ + } + + /* +-** This function checks if argument pFrom refers to a CTE declared by ++** This function checks to see if argument pFrom refers to a CTE declared by + ** a WITH clause on the stack currently maintained by the parser (on the +-** pParse->pWith linked list). And if currently processing a CTE +-** CTE expression, through routine checks to see if the reference is +-** a recursive reference to the CTE. ++** pParse->pWith linked list). And if currently processing a CTE expression, ++** it also checks to see if the reference is a recursive reference to the CTE. + ** +-** If pFrom matches a CTE according to either of these two above, pFrom->pSTab +-** and other fields are populated accordingly. ++** If pFrom matches a CTE, pFrom->pSTab and other fields are populated ++** accordingly. + ** + ** Return 0 if no match is found. + ** Return 1 if a match is found. +@@ -154839,6 +154847,8 @@ static int resolveFromTermToCte( + pRecTerm = pRecTerm->pPrior; + } + ++ pParse->nNestSel++; ++ if( checkSubqueryNestingDepth(pParse) ) return 2; + pCte->zCteErr = "circular reference: %s"; + pSavedWith = pParse->pWith; + pParse->pWith = pWith; +@@ -154863,6 +154873,8 @@ static int resolveFromTermToCte( + } + } + pParse->pWith = pWith; ++ pParse->nNestSel--; ++ assert( pParse->nNestSel>=0 ); + + for(pLeft=pSel; pLeft->pPrior; pLeft=pLeft->pPrior); + pEList = pLeft->pEList; +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb index 06cd34818f..93ee778292 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb @@ -32,6 +32,7 @@ SRC_URI += "file://0001-Add-option-to-disable-zlib.patch \ file://CVE-2026-119372.patch \ file://CVE-2026-119378.patch \ file://CVE-2026-119376.patch \ + file://CVE-2026-119371.patch \ " SRC_URI[sha256sum] = "0e9483900e92cd5de8fd48d16bf9200145a61f7fd5be542a5ac81d8a9516eb9c" From patchwork Wed Nov 11 05:25:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 103657 Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3329.1794374735153528165 for ; Tue, 10 Nov 2026 21:25:35 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=e5AFpVBC; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2838; q=dns/txt; s=iport01; t=1794374735; x=1795584335; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=EqQPfC2cr+UViCLSuSm6Pm/ogaJuIrbOnt1rpfh83Vw=; b=e5AFpVBCMO9ZKzbqm+Wi559VwhmWXZD6Yn9dKVBNbSNbU9HJqv7nscEC SJ8VydvnFxx3r2bHzasVXGd9Z5CT7eFpuhZJ283OKHoNLBYQ9gXTysiVv 2RL/Lhyat9nK3YFY9zv6iYyLI4hS843gV3yXXg1KFARkkL53EuwcEpAVp yTYjetxisaqWxiUmVV1PsyPetmhaO+nBmCNvpnCQDiSEaebVwO007ZmYb YT+wDTlFDX97J0F0mvzKX2Uv+ryhQR65PPFABFlSQ3scq/5dKdGDa7FV0 APjYnkebWNFFRYzXtmguCd9enUhOZ1LKFZzcDjTKfEhkCf7U/rp1pN5VB Q==; X-CSE-ConnectionGUID: 1aaD7UvlRhuTWeKXIDHv/w== X-CSE-MsgGUID: 4Kl/JRzrTPelR2IHv63wYA== X-IPAS-Result: A0BIAgAG+/Nq/5L/Ja1aHgEBCxIMggULgld1YENJlksDniKBfg8BAQEPRA0EAQGEP0YCjh4CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAEtEBwDAQIvKyMIGYMCAYJ0AxG5VoF5M4EBgykBPwJDUNlLgWgBCxQBBYEzhUIyh3JdGAGEfScbgUlEhH6BBYFcAQGCLYV5BIMcEoFajRoCgU+HJUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEcgR6BEoEHXYErKF0BIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZwsaBWEIAg0MdDkQMB4kLwUaJj4bCn4YDUgRLDcVGQQ+bgeSboMUAQFYNQErgUN6K6MZgiGhEYQqgWiKPJU6GjOqcguYfY4KllGEaoFoPIFHCwczGggbFYMiCUoZD44uCwuDYIF/gxTJSCYyAgkyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:rPc+WKpjqNwzm6f3x8IhTOiY3aheBmJOZBIvgKrLsJaIsI4StFCzt garIBmDOP3ZZmb9eYokPtu/pExSvp/dmINmTwdsqS8xQi9Gp+PIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfva8Uo35ZwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0r9+CE0Ry OIcEjAQUi+OpNKX7JKlDfY506zPLOGzVG8ekmtrwTecCbMtRorOBv2bo9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5LVvrSn8/w7pX7WzRCsFOJvaMf6GnIxws327/oWDbQUoHRH58LxxbJ+ woq+UylIRVdFuaN0wa9/3aW3M7vg32gR7M7QejQGvlCxQf7KnYoIBoOWF22pPO0hkKzV5dUL FYZ0i4vtrQpskuzQ9/wWhe1rHKJslgbQdU4LgEhwBuGxqyR50OSAXIJC2YQLtcnr8QxAzct0 zdlgu/UONCmi5XNIVr1y1tehWna1fQ9RYPaWRI5cA== IronPort-HdrOrdr: A9a23:GSN7wKDvx94fNaHlHel055DYdb4zR+YMi2TDGXofdfUzSL3+qy nAppUmPHPP5Qr5HUtQ++xoW5PwJU80i6QU3WB5B97LN2PbUSmTXeRfBODZrQEIdReTygd179 YHT0EHMqySMXFKyeDn/QK/D9EshPOD8KyumKPi6k0Fd3ASV0mlhD0JcTpy1SZNNXF7OaY= X-Talos-CUID: 9a23:RgP2yWz5DjtktBzpN6egBgVNE8kJLUDDyE3QPnOHBEVZaZG1VxiPrfY= X-Talos-MUID: 9a23:/f2pNwgHy8H2Br1okZtb8sMpaORspIaUGloxqZgCgZOlFTIuYCispWHi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,207,1787011200"; d="scan'208";a="532261895" Received: from rcdn-l-core-09.cisco.com ([173.37.255.146]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 11 Nov 2026 05:25:34 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-09.cisco.com (Postfix) with ESMTPS id 7A5E218000230; Wed, 11 Nov 2026 05:25:34 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id CF70CCBEF83; Tue, 10 Nov 2026 21:25:33 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][blacksail][PATCH 10/10] sqlite3: fix CVE-2026-119591 Date: Tue, 10 Nov 2026 21:25:32 -0800 Message-Id: <20261111052532.1258975-10-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261111052532.1258975-1-arpitpa@cisco.com> References: <20261111052532.1258975-1-arpitpa@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-09.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 05:25:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249950 This patch applies the upstream fix [1] for stack exhaustion in the count-of-view optimization. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2 [2] https://sqlite.org/src/info/ab621a3e11ee4acc Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119591 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119591.patch | 40 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.53.4.bb | 1 + 2 files changed, 41 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119591.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119591.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119591.patch new file mode 100644 index 0000000000..57ca37d909 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119591.patch @@ -0,0 +1,40 @@ +From 5dbe255431ad2b935db31e8e3c2c66284e2709ef Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Mon, 5 Oct 2026 12:18:23 +0000 +Subject: [PATCH] Prevent the expression generated by the count-of-view + optimization from getting too deep and causing a CPU stack overflow. + [bugs:/info/2026-10-04T05:34:47Z|Bug 2026-10-04T05:34:47Z] + +FossilOrigin-Name: ab621a3e11ee4accce14bf6c90a7cc273d9c25a7c3d9dd2466f2bdc2bbbf8084 + +CVE: CVE-2026-119591 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2] + +Backport Changes: +- Ported the src/select.c change into the amalgamated sqlite3.c. +- Omitted manifest and manifest.uuid because they are Fossil metadata + and are not needed for this source layout. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sqlite3.c b/sqlite3.c +index dc245c4..d814a1c 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -156251,6 +156251,10 @@ static int countOfViewOptimization(Parse *pParse, Select *p){ + }else{ + pExpr = sqlite3PExpr(pParse, TK_PLUS, pTerm, pExpr); + } ++ if( pParse->nErr ){ ++ sqlite3ExprDelete(db, pExpr); ++ pExpr = 0; ++ } + pSub = pPrior; + } + p->pEList->a[0].pExpr = pExpr; +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb index 93ee778292..f616c70073 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.53.4.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.53.4.bb @@ -33,6 +33,7 @@ SRC_URI += "file://0001-Add-option-to-disable-zlib.patch \ file://CVE-2026-119378.patch \ file://CVE-2026-119376.patch \ file://CVE-2026-119371.patch \ + file://CVE-2026-119591.patch \ " SRC_URI[sha256sum] = "0e9483900e92cd5de8fd48d16bf9200145a61f7fd5be542a5ac81d8a9516eb9c"