From patchwork Wed Nov 11 05:38:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103672 Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3373.1794375526351485394 for ; Tue, 10 Nov 2026 21:38:46 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=TnfB2Ndj; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=11263; q=dns/txt; s=iport01; t=1794375526; x=1795585126; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=ImW/V9cloFa1Ri+m92nS/QgyvHlRoUfTEdoq1k2LwVo=; b=TnfB2NdjG58gJ/pYNuftVxZpM55IWaPp25mKpVikou8XW1AMI+46xgP4 9sTmxd/nVx1BK1eAvCUPddKQjo9DwmyquI+/G4eBHvIMgm+J6Xeq8ZZ4E 06GpyV6B4ccsMyCpHPlOYXCSZd46Zv1FR99tKpVAi5lrV1AdrnGwxJCFg 40XcODkqUN9TRwvjicZ1xcX5C98/1/CTlUcXtlS5o0wJEAFnJQnEfS9mt NLyW+tbiBepoQ4/4bodN4b3hx7f1tOVjaRQ4EwVPJvYQ4C09gVOWO775y BqK4cbXvciDD/8utMECzAt5qA4aBcTNLlzuauHFzf+aCJSNnCQ0+mBQ6z A==; X-CSE-ConnectionGUID: saKxHymzQK+yzymMyRJ5yg== X-CSE-MsgGUID: omhYGcamQja/MKZArKi8AQ== X-IPAS-Result: A0BEAgDZ/vNq/5T/Ja1aHgEBCxIMggULgld1YENJA5ZIniWBfg8BAQEPRA0EAQGFBY4gAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBKgsBRiwDAQJaIyGDAgGCdAMRuWeBeTOBAYR+2zMBCxQBgTiFQogkXRgBhH0nGxuBcoEVg2mBBYFcAoEXhw8EgiJ6EoFaGAaMfAKBT4clSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgRyBHoESgQddgSsoXQEhgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxnCxoFYQgCDQx0ORAwHiQvBRomPhsKfhgNSBEsNxUZBD5uB5JugwMLBwGBDQEKIRcJXxIKMgMzAQEnBUmSZwoyj2SCIYE1n1wKKIN4jCSPQoV4GjOFW6UXC5h9jgqVYSNNhGqBaDyBWXAVgyIJShkPji0MC4NghUEGyRQmMgsDLwEBBwIHDgMLgWiQAi2BTwEB IronPort-Data: A9a23:LIznIqrezSJULZSs1lTpbp7rVQ5eBmJIZBIvgKrLsJaIsI4StFCzt garIBnTa6nZYmWnLY1/b4znpx9VscDVxtFmTAs++Ck9QSoV8OPIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfva8Uo35ZwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0v1+InFu5 PkKERNOfwKSgsen+pDmW+Y506zPLOGzVG8ekmtrwTecCbMtRorOBvyTo9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5LWPrSn8/w7pX7WzFbpVacpLs+y2PS1wd2lrPqNbI5f/TXGZsIxR/B/ DKuE2LRBRQaBfOUwD+88Hvro8z9tDnYWdI7LejtnhJtqBjJroAJMzURTVa9rPyzh0KyVt4aJ 0EK9y4Gqakp6FftScHwWRC9qnOIshMQHd1KHIUHBBql0KHY5UOdQ2MDVDMEMYVgv84tTjts3 ViM9z/0OQFSXHSuYSr13t+pQfmaYED58Udqifc4cDY4 IronPort-HdrOrdr: A9a23:VKuISq+BtNwpmigy/jluk+DuI+orL9Y04lQ7vn2ZhyY7TiX+rb HKoB11737JYVoqNU3I+urwWpVoP0m9yXcd2+B4Vt2ftWLd1ldAQrsP0WKb+UyCJwTOsshAyK xnb69yTPf0DVR8kILGxTPQKadF/DFCm5rY49s3CBxWPGZXV50= X-Talos-CUID: 9a23:xc6gCW/AdwaCXTBVrByVv1UdOdAFY3jP9VSTMl2pDEN4cp/IWFDFrQ== X-Talos-MUID: 9a23:YHhIAg6sS5mON6EvdDcj8Eb4xoxv5qSfJ0sElKwEso6hFh5ZIRSc3B2OF9o= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,207,1787011200"; d="scan'208";a="546531128" Received: from rcdn-l-core-11.cisco.com ([173.37.255.148]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 11 Nov 2026 05:38:39 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-11.cisco.com (Postfix) with ESMTPS id EA54B18000147; Wed, 11 Nov 2026 05:38:38 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id 92491CC1611; Tue, 10 Nov 2026 21:38:38 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: Darsh Kelaiya Subject: [oe][meta-oe][wrynose][PATCH 1/5] libdbi-perl: fix CVE-2026-78030 Date: Tue, 10 Nov 2026 21:38:30 -0800 Message-Id: <20261111053834.3702246-1-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-11.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 05:38:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132126 From: Darsh Kelaiya Backport the module-name validation fix [1] to DBI 1.647 for the arbitrary module loading issue described in [2]. Validate dbm_type and dbm_mldbm before loading the selected backend or serializer. Retain the upstream regression tests and optional Params::Util fallback. Module::Load is already a recipe runtime dependency. [1] https://github.com/perl5-dbi/dbi/commit/315c6ce703b8b3cbe9188062d9ec80730293554a [2] https://github.com/perl5-dbi/dbi/security/advisories/GHSA-wqmw-wqwx-3fr7 Signed-off-by: Darsh Kelaiya --- .../perl/libdbi-perl/CVE-2026-78030.patch | 268 ++++++++++++++++++ .../perl/libdbi-perl_1.647.bb | 1 + 2 files changed, 269 insertions(+) create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-78030.patch diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-78030.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-78030.patch new file mode 100644 index 0000000000..5a2fbf9a4b --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-78030.patch @@ -0,0 +1,268 @@ +From 315c6ce703b8b3cbe9188062d9ec80730293554a Mon Sep 17 00:00:00 2001 +From: Robert Rothenberg +Date: Sat, 22 Aug 2026 01:37:15 +0100 +Subject: [PATCH] Load serializer class using Module::Load (CVE-2026-78030) + +This replaces calls to require with Module::Load, and adds specific +checks that arguments are module names instead of filenames. + +Instead of using our own regex matcher, we attempt to use the +Params::Util _CLASS function. The style of trying to import it or adding +our own is based on similar code in DBD::File. (This uses SPDX +annotations to indicate where the code comes from.) + +This also adds a suggestion for Params::Util in Makefile.PL. + +Note that code of the form + + $INC{"$tie_type.pm"} or require "$tie_type.pm" + +is redundant, since require checks %INC. + +See also the similar vulnerability to the DBI::Profile vulnerability +CVE-2026-14380 in commit b73d5d9901767fc1d16b6661ef08fbed4532e259. + +CVE: CVE-2026-78030 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/315c6ce703b8b3cbe9188062d9ec80730293554a] + +Assisted-By: Claude Opus 5 (1M context) + +Signed-off-by: Robert Rothenberg +Signed-off-by: Darsh Kelaiya +--- + MANIFEST | 1 + + Makefile.PL | 1 + + lib/DBD/DBM.pm | 34 ++++++++++--- + t/53dbm_module_name.t | 115 ++++++++++++++++++++++++++++++++++++++++++ + 4 files changed, 144 insertions(+), 7 deletions(-) + create mode 100644 t/53dbm_module_name.t + +diff --git a/MANIFEST b/MANIFEST +index 23858dc..d7f8e4e 100644 +--- a/MANIFEST ++++ b/MANIFEST +@@ -107,6 +107,7 @@ t/49dbd_file.t DBD::File API and very basic tests + t/50dbm_simple.t simple DBD::DBM tests + t/51dbm_file.t extended DBD::File tests (through DBD::DBM) + t/52dbm_complex.t Complex DBD::DBM tests with SQL::Statement ++t/53dbm_module_name.t dbm_type / dbm_mldbm must name a module, not a path + t/53sqlengine_adv.t + t/54_dbd_mem.t + t/60preparse.t +diff --git a/Makefile.PL b/Makefile.PL +index 3bba048..2ad475a 100644 +--- a/Makefile.PL ++++ b/Makefile.PL +@@ -76,6 +76,7 @@ my %opts = ( + suggests => { + "RPC::PlServer" => 0.2020, + "Net::Daemon" => 0, ++ "Params::Util" => '1.100', + "SQL::Statement" => 1.414, + "Clone" => 0.47, + "MLDBM" => 0, +diff --git a/lib/DBD/DBM.pm b/lib/DBD/DBM.pm +index f77e98a..26b1497 100644 +--- a/lib/DBD/DBM.pm ++++ b/lib/DBD/DBM.pm +@@ -59,6 +59,21 @@ sub CLONE + undef $drh; + } + ++if (eval { require Params::Util; }) { ++ Params::Util->import ("_CLASS"); ++} else { ++ # SPDX-SnippetBegin ++ # SPDX-SnippetCopyrightText: 2005-2012 Adam Kennedy. 2020 Jens Rehsack. ++ # SPDX-License-Identifier: Artistic-1.0-Perl ++ # SPDX-PackageName: pkg:cpan/Params-Util@1.102 ++ # SPDX-Description: taken from Params::Util::PP 1.102 ++ *_CLASS = sub { ++ my $arg = $_[0]; ++ return (defined $arg and not ref $arg and $arg =~ m/^[^\W\d]\w*(?:::\w+)*\z/s) ? $arg : undef; ++ }; ++ # SPDX-SnippetEnd ++} ++ + ##################### + package DBD::DBM::dr; + ##################### +@@ -77,7 +92,8 @@ package DBD::DBM::db; + our $imp_data_size = 0; + our @ISA = qw(DBD::File::db); + +-use Carp qw/carp/; ++use Carp; ++use Module::Load (); + + sub validate_STORE_attr + { +@@ -189,10 +205,9 @@ sub get_dbm_versions + }; + eval { + my $ser_class = "MLDBM::Serializer::" . $meta->{dbm_mldbm}; +- my $ser_mod = $ser_class; +- $ser_mod =~ s|::|/|g; +- $ser_mod .= ".pm"; +- require $ser_mod; ++ DBD::DBM::_CLASS($ser_class) ++ or croak "Invalid dbm_mldbm '$ser_class': expected a module name"; ++ Module::Load::load $ser_class; + $dver = $ser_class->VERSION(); + $dtype .= ' + ' . $ser_class; # (*) + $dver and $dtype .= " ($dver)"; # (*) +@@ -253,6 +268,7 @@ package DBD::DBM::Table; + ######################## + use Carp; + use Fcntl; ++use Module::Load (); + + our @ISA = qw(DBD::File::Table); + +@@ -318,12 +334,14 @@ sub init_table_meta + unless ( defined( $meta->{dbm_tietype} ) ) + { + my $tie_type = $meta->{dbm_type}; +- $INC{"$tie_type.pm"} or require "$tie_type.pm"; ++ DBD::DBM::_CLASS($tie_type) ++ or croak "Invalid dbm_type '$tie_type': expected a module name"; ++ Module::Load::load $tie_type; + $tie_type eq 'BerkeleyDB' and $tie_type = 'BerkeleyDB::Hash'; + + if ( $meta->{dbm_mldbm} ) + { +- $INC{"MLDBM.pm"} or require "MLDBM.pm"; ++ Module::Load::load "MLDBM"; + $meta->{dbm_usedb} = $tie_type; + $tie_type = 'MLDBM'; + } +@@ -389,6 +407,8 @@ sub open_data + { + $MLDBM::UseDB = $meta->{dbm_usedb}; + $MLDBM::Serializer = $meta->{dbm_mldbm}; ++ DBD::DBM::_CLASS($MLDBM::Serializer) ++ or croak "Invalid dbm_mldbm '${MLDBM::Serializer}': expected a module name"; + } + + $meta->{hash} = {}; +diff --git a/t/53dbm_module_name.t b/t/53dbm_module_name.t +new file mode 100644 +index 0000000..e331fa4 +--- /dev/null ++++ b/t/53dbm_module_name.t +@@ -0,0 +1,115 @@ ++#!perl -w ++# dbm_type and dbm_mldbm name a Perl module, never a file path. ++# ++# Both attributes reach require(). require() treats a path-shaped string as a ++# literal file and never consults @INC, so without a grammar check a caller ++# who influences either attribute can make the process load -- and therefore ++# execute -- a .pm from anywhere on the filesystem. ++# ++# The two "rejected" cases below fail on an unvalidated DBD::DBM: the planted ++# module gets loaded and sets the flag. The two "still works" cases pin the ++# behaviour the check must not break. ++ ++use strict; ++use warnings; ++ ++require DBD::DBM; ++ ++use DBI; ++use File::Path qw(mkpath); ++use File::Spec; ++use File::Temp qw(tempdir); ++use Test::More; ++ ++my $dir = tempdir( CLEANUP => 1 ); ++my $dbdir = File::Spec->catdir( $dir, 'db' ); ++mkpath($dbdir); ++ ++# A module planted outside @INC. Loading it is observable and can happen for ++# exactly one reason: something required this path. ++my $plant = File::Spec->catfile( $dir, 'DbmPlant.pm' ); ++open( my $fh, '>', $plant ) or plan skip_all => "cannot write $plant: $!"; ++print {$fh} "\$::DBM_PLANT_LOADED = 1;\n1;\n"; ++close($fh); ++ ++( my $plant_noext = $plant ) =~ s/\.pm\z//; ++ ++my $have_mldbm = eval { require 'MLDBM.pm'; 1 }; ++ ++# --- dbm_type must not name a path -------------------------------------- ++{ ++ local $::DBM_PLANT_LOADED = 0; ++ my $dbh = DBI->connect( "dbi:DBM:f_dir=$dbdir", undef, undef, ++ { RaiseError => 0, PrintError => 0 } ); ++ $dbh->{dbm_type} = $plant_noext; ++ eval { $dbh->do("CREATE TABLE t_reject (id INT, v CHAR(8))"); 1 }; ++ ok( !$::DBM_PLANT_LOADED, ++ "a path-shaped dbm_type does not load the file it names" ); ++ $dbh->disconnect; ++} ++ ++# The same path with its ".pm" suffix left on. This is the case a loader ++# swap alone does not cover: Module::Load treats anything outside [\w:'] as a ++# filename and requires it verbatim, so "/path/Evil" fails only because no ++# such file exists -- "/path/Evil.pm" loads. ++{ ++ local $::DBM_PLANT_LOADED = 0; ++ my $dbh = DBI->connect( "dbi:DBM:f_dir=$dbdir", undef, undef, ++ { RaiseError => 0, PrintError => 0 } ); ++ $dbh->{dbm_type} = $plant; ++ eval { $dbh->do("CREATE TABLE t_reject_pm (id INT, v CHAR(8))"); 1 }; ++ ok( !$::DBM_PLANT_LOADED, ++ "a dbm_type naming a .pm file directly does not load it" ); ++ $dbh->disconnect; ++} ++ ++# --- dbm_type still accepts a real DBM implementation ------------------- ++{ ++ my $dbh = DBI->connect( "dbi:DBM:f_dir=$dbdir;dbm_type=SDBM_File", undef, undef, ++ { RaiseError => 1, PrintError => 0 } ); ++ $dbh->do("CREATE TABLE t_ok (id INT, v CHAR(8))"); ++ $dbh->do("INSERT INTO t_ok VALUES (1, 'hello')"); ++ my ($v) = $dbh->selectrow_array("SELECT v FROM t_ok WHERE id = 1"); ++ is( $v, 'hello', "dbm_type=SDBM_File still round-trips a row" ); ++ $dbh->disconnect; ++} ++ ++# --- dbm_mldbm must not escape the MLDBM::Serializer:: prefix ------------ ++SKIP: { ++ skip "MLDBM not installed", 1 unless $have_mldbm; ++ ++ # "MLDBM::Serializer::" only looks like containment. s|::|/|g rewrites ++ # "::" and leaves a literal "/" alone, and MLDBM ships MLDBM/Serializer/ ++ # into @INC, so every component of a traversal out of it exists. ++ my ($inc) = grep { -d File::Spec->catdir( $_, 'MLDBM', 'Serializer' ) } @INC; ++ skip "no \@INC entry holds MLDBM/Serializer/", 1 unless defined $inc; ++ ++ my @up = File::Spec->splitdir( File::Spec->canonpath($inc) ); ++ shift(@up) while ( @up && $up[0] eq '' ); ++ my $escape = ( '../' x ( scalar(@up) + 2 ) ) . substr( $plant_noext, 1 ); ++ ++ local $::DBM_PLANT_LOADED = 0; ++ my $dbh = DBI->connect( "dbi:DBM:f_dir=$dbdir;dbm_type=SDBM_File", undef, undef, ++ { RaiseError => 0, PrintError => 0, ++ dbm_mldbm => $escape } ); ++ eval { ++ $dbh->do("CREATE TABLE t_ser (id INT, v CHAR(8))"); ++ $dbh->func( 't_ser', 'dbm_versions' ); ++ 1; ++ }; ++ ok( !$::DBM_PLANT_LOADED, ++ "a dbm_mldbm that traverses out of MLDBM::Serializer:: does not load the file it names" ); ++ $dbh->disconnect; ++} ++ ++# --- dbm_mldbm still accepts a real serializer name --------------------- ++{ ++ my $dbh = DBI->connect( "dbi:DBM:f_dir=$dbdir;dbm_type=SDBM_File", undef, undef, ++ { RaiseError => 0, PrintError => 0 } ); ++ my $versions = eval { $dbh->func( 'dbm_versions' ) }; ++ ok( defined $versions && length $versions, ++ "dbm_versions() still reports for an unmodified handle" ); ++ $dbh->disconnect; ++} ++ ++done_testing; diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb index 03be7eabea..e2760d84d5 100644 --- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb +++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb @@ -20,6 +20,7 @@ SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \ file://CVE-2026-73194_p3.patch \ file://CVE-2026-73193_p1.patch \ file://CVE-2026-73193_p2.patch \ + file://CVE-2026-78030.patch \ " SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa" From patchwork Wed Nov 11 05:38:31 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103671 Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3466.1794375520104741194 for ; Tue, 10 Nov 2026 21:38:40 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Qe3SqPyW; spf=pass (domain: cisco.com, ip: 173.37.86.80, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=9851; q=dns/txt; s=iport01; t=1794375520; x=1795585120; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Krdsy0JTAEF0OvNR9nccPPtNQpPzXBVuEzpg67ZSESM=; b=Qe3SqPyWtek4VhneGVwLEmLo5QESaO6yJMK554Dl0CGz7A5VvB67y6Lq pg3DF/yqNKT4ghbN+JPMliiFaHcNE7Pa8HwEZ3au6A8el2OyKVY79QX0l KsOhRq2+Fa7OmqkXvMqYd67DfgJtcJGueGaxQvUzVhWTsfkPoiIK+r8Tq WIOblPwK1PHawsSA2VSsP4i9qrGGMkAHRKOv4TfkYAJoVLdlVy6J2a+6C qV2uZkDYzrggyLD+mk0tTN2J+0xTZMJT+llzw6ghaJxLVbMByRPvWOTAe 8YvJv771Nh5/bWmrssKWFyP328K5lB5ULwXmxUCGrNaAiZdmSpEjSWVPi A==; X-CSE-ConnectionGUID: Xjmi8UTSRfmIk2O+YowORQ== X-CSE-MsgGUID: bTlnixjfQkCHC8I9VtORWQ== X-IPAS-Result: A0BHAgDZ/vNq/4v/Ja1SCB4BAQsSDIIFC4JXdWBDSQOWSAOeIoF+DwEBAQ9EDQQBAYUFAo4eAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLAUYQHAMBAi8rIwgZgwIBgnQDEblngXkzgQGEftszAQsUAYE4hUKIJF0YAYR9JxsbgXKBFYE7gi6BBYFcAoE5D4ZeBIIiehKBWh6MfAKBT4clSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgRyBHoESgQddgSsoXQEhgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxnCxoFYQgCDQx0ORAwHiQvBRomPhsKfhgNSBEsNxUZBD5uB5JugiJyAQFPNAoBExMFFz0rEjw2KZMuBwIBBwooj2SCIYE1n1wKKIN4jCSPQoV4GjOFW6UXC5h9jgqVaRtNhGqBaDxGgRNwFYMiCUoZD44tDAuDYIVHyRQmMgsDLwEBBwIHDgMLgWiQAi2BTwEB IronPort-Data: A9a23:rGI3/KJF495FTqd2FE+RgZQlxSXFcZb7ZxGr2PjKsXjdYENS0TcOz moeXDvUPP2JN2unfN9yYYji/BsEuJ/cyNQwSQQd+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8gmctajt8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN1eDkQ3bbAkwdx5BEBNr 9tbGTcSSSq60rfeLLKTEoGAh+w5J8XteYdasXZ6wHSBV7AtQIvIROPB4towMDUY358VW62BI ZBENHw2N0Wojx5nYj/7DLoyn+qsj3juehVTqUmeouw85G27IAlZjeSwboeNIo3XLSlTtkyko mTH72b3OxIxFPfP6Gu77lWWudaayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PW0lEO6c9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7DQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSv1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:guDt7atAXrBAheFgBLHAkygQ7skDVNV00zEX/kB9WHVpmwKj+P xG+85rsiMc5wxxZJhNo7290ey7MBHhHP1OkO0s1MmZPDUO0VHAROoJ0WKh+UyEJ8SUzIBgPM lbH5SWcOeAbmRSvILd/BSyFcomzZ2s9aClgvqb8lJWJDsaDZ2JK2xCe36m+oocfng+OaYE X-Talos-CUID: 9a23:wu+jqGwgOLG3s25myLBHBgUkGMUkIkDh903eJm67U0EqebqKbmWprfY= X-Talos-MUID: 9a23:mB+AUQxgpXZ9IbO8aJGd1HssTc2aqK6SDEYMgZcIgsqvFQcgGmajkBONfbZyfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,207,1787011200"; d="scan'208";a="545650095" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-9.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 11 Nov 2026 05:38:39 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id EB4F1180007D4; Wed, 11 Nov 2026 05:38:38 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id 9689DCBF201; Tue, 10 Nov 2026 21:38:38 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: Darsh Kelaiya Subject: [oe][meta-oe][wrynose][PATCH 2/5] libdbi-perl: fix CVE-2026-111879 Date: Tue, 10 Nov 2026 21:38:31 -0800 Message-Id: <20261111053834.3702246-2-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261111053834.3702246-1-dkelaiya@cisco.com> References: <20261111053834.3702246-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 05:38:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132125 From: Darsh Kelaiya Backport the lock cleanup fix [1] to DBI 1.647 after the CVE-2026-78030 backport. Reject invalid serializer names before acquiring a table lock and release the lock when opening a table fails, addressing the denial of service described in [2]. Retain the nonblocking-lock regression. Include the helper's explicit unlock from [3] and serializer test cleanup from [4]. Keep the existing DBD::File version and adjust the optional MLDBM skip counts for the additional assertion. [1] https://github.com/perl5-dbi/dbi/commit/99bbf2ab9d137e6f042a770bd3bbba3bc0b3a901 [2] https://github.com/perl5-dbi/dbi/security/advisories/GHSA-8cx8-9vj9-9x7j [3] https://github.com/perl5-dbi/dbi/commit/cd1172e92c8a40f0070c881055c080095d8cb48a [4] https://github.com/perl5-dbi/dbi/commit/291a494d0968da9af1a27292d713d17a608a7398 Signed-off-by: Darsh Kelaiya --- .../perl/libdbi-perl/CVE-2026-111879.patch | 195 ++++++++++++++++++ .../perl/libdbi-perl_1.647.bb | 1 + 2 files changed, 196 insertions(+) create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-111879.patch diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-111879.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-111879.patch new file mode 100644 index 0000000000..8a18c082b8 --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-111879.patch @@ -0,0 +1,195 @@ +From 99bbf2ab9d137e6f042a770bd3bbba3bc0b3a901 Mon Sep 17 00:00:00 2001 +From: Robert Rothenberg +Date: Sat, 17 Oct 2026 12:10:51 +0100 +Subject: [PATCH] fix: validate DBD::DBM MLDBM serializer before lock file is + created (CVE-2026-111879) + +This was a bug introduced by the fix for CVE-2026-78030. + +The exception unwound DBI::DBD::SqlEngine::Table::new before the Table object +was blessed, so no DESTROY ever releases the lock, while $meta (with the +open, locked lockfh) stays cached in $dbh->{sql_meta}{t_ser}. The next +open of the table opens a second descriptor on the same .lck and blocks in +flock() -- forever, because the holder is the same process. + +Why only the Gofer variant hung: in plain mode the DROP reuses the same +$meta, so DBD::File's $meta->{lockfh} = $fh drops the old handle (and +with it the lock) just before it calls flock. Under Gofer the DROP is +served by a different server-side dbh with its own fresh $meta, so the +stale handle is never replaced. The same thing happens without Gofer for +any second handle or any second process: a separate process doing +SELECT * FROM t_ser blocks until the first process exits (measured on +1.652, 1.655 and master). + +This change also factors out code for releasing the lock into a separate +method that is used by DESTROY. + +The version for DBD::File is bumped. + +CVE: CVE-2026-111879 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/99bbf2ab9d137e6f042a770bd3bbba3bc0b3a901] + +Backport Changes: +- Retained DBD::File version 0.44 and omitted release notes. +- Adapted the lock helper to the older close-only cleanup paths. +- Included the flock(..., 0) call from [1] in the lock helper. +- Added serializer DROP cleanup from [2] for the lock regression. +- Set both MLDBM skip counts to two for the added lock check. + +[1] https://github.com/perl5-dbi/dbi/commit/cd1172e92c8a40f0070c881055c080095d8cb48a +[2] https://github.com/perl5-dbi/dbi/commit/291a494d0968da9af1a27292d713d17a608a7398 + +Assisted-By: Claude Mythos 5.1 + +Signed-off-by: Robert Rothenberg +Signed-off-by: Darsh Kelaiya +--- + lib/DBD/DBM.pm | 24 ++++++++++++++++++++---- + lib/DBD/File.pm | 23 +++++++++++++---------- + t/53dbm_module_name.t | 20 ++++++++++++++++++-- + 3 files changed, 51 insertions(+), 16 deletions(-) + +diff --git a/lib/DBD/DBM.pm b/lib/DBD/DBM.pm +index 26b1497..1f21dcd 100644 +--- a/lib/DBD/DBM.pm ++++ b/lib/DBD/DBM.pm +@@ -367,6 +367,17 @@ sub init_table_meta + sub open_data + { + my ( $className, $meta, $attrs, $flags ) = @_; ++ ++ # Validate dbm_mldbm BEFORE SUPER::open_data creates and flock()s the ++ # lock file. A croak after that point leaves $meta->{lockfh} holding an ++ # exclusive lock for as long as the table meta data lives, and the next ++ # open of the same table in this process blocks on it forever. ++ if ( $meta->{dbm_mldbm} and not $flags->{dropMode} ) ++ { ++ DBD::DBM::_CLASS( $meta->{dbm_mldbm} ) ++ or croak "Invalid dbm_mldbm '$meta->{dbm_mldbm}': expected a module name"; ++ } ++ + $className->SUPER::open_data( $meta, $attrs, $flags ); + + unless ( $flags->{dropMode} ) +@@ -407,15 +418,20 @@ sub open_data + { + $MLDBM::UseDB = $meta->{dbm_usedb}; + $MLDBM::Serializer = $meta->{dbm_mldbm}; +- DBD::DBM::_CLASS($MLDBM::Serializer) +- or croak "Invalid dbm_mldbm '${MLDBM::Serializer}': expected a module name"; + } + + $meta->{hash} = {}; + my $tie_class = $meta->{dbm_tietype}; + eval { tie %{ $meta->{hash} }, $tie_class, @tie_args }; +- $@ and croak "Cannot tie(\%h $tie_class @tie_args): $@"; +- -f $meta->{f_fqfn} or croak( "No such file: '" . $meta->{f_fqfn} . "'" ); ++ if ( $@ or not -f $meta->{f_fqfn} ) ++ { ++ # Release the lock SUPER::open_data took, or it outlives this ++ # failure (see above). ++ my $err = $@ ? "Cannot tie(\%h $tie_class @tie_args): $@" ++ : "No such file: '" . $meta->{f_fqfn} . "'"; ++ $className->_release_lock($meta); ++ croak $err; ++ } + } + + unless ( $flags->{createMode} ) +diff --git a/lib/DBD/File.pm b/lib/DBD/File.pm +index 3647acd..e3d27d7 100644 +--- a/lib/DBD/File.pm ++++ b/lib/DBD/File.pm +@@ -894,18 +894,24 @@ sub open_data { + sub drop ($) { + my ($self, $data) = @_; + my $meta = $self->{meta}; +- # We have to close the file before unlinking it: Some OS'es will +- # refuse the unlink otherwise. +- $meta->{fh} and $meta->{fh}->close (); +- $meta->{lockfh} and $meta->{lockfh}->close (); +- undef $meta->{fh}; +- undef $meta->{lockfh}; ++ $self->_release_lock($meta); + $meta->{f_fqfn} and unlink $meta->{f_fqfn}; # XXX ==> sql_data_source + $meta->{f_fqln} and unlink $meta->{f_fqln}; # XXX ==> sql_data_source + delete $data->{Database}{sql_meta}{$self->{table}}; + return 1; + } # drop + ++sub _release_lock { ++ my ($self, $meta) = @_; ++ # We have to close the file before unlinking it: Some OS'es will ++ # refuse the unlink otherwise. ++ $meta->{fh} and $meta->{fh}->close (); ++ $meta->{lockfh} and eval { flock $meta->{lockfh}, 0 }; ++ $meta->{lockfh} and $meta->{lockfh}->close (); ++ undef $meta->{fh}; ++ undef $meta->{lockfh}; ++} ++ + sub seek ($$$$) { + my ($self, $data, $pos, $whence) = @_; + my $meta = $self->{meta}; +@@ -931,10 +937,7 @@ sub truncate ($$) { + sub DESTROY { + my $self = shift; + my $meta = $self->{meta}; +- $meta->{fh} and $meta->{fh}->close (); +- $meta->{lockfh} and $meta->{lockfh}->close (); +- undef $meta->{fh}; +- undef $meta->{lockfh}; ++ $self->_release_lock($meta); + + $self->SUPER::DESTROY(); + } # DESTROY +diff --git a/t/53dbm_module_name.t b/t/53dbm_module_name.t +index e331fa4..7707b18 100644 +--- a/t/53dbm_module_name.t ++++ b/t/53dbm_module_name.t +@@ -20,6 +20,7 @@ use File::Path qw(mkpath); + use File::Spec; + use File::Temp qw(tempdir); + use Test::More; ++use Fcntl qw(:flock); + + my $dir = tempdir( CLEANUP => 1 ); + my $dbdir = File::Spec->catdir( $dir, 'db' ); +@@ -76,13 +77,13 @@ my $have_mldbm = eval { require 'MLDBM.pm'; 1 }; + + # --- dbm_mldbm must not escape the MLDBM::Serializer:: prefix ------------ + SKIP: { +- skip "MLDBM not installed", 1 unless $have_mldbm; ++ skip "MLDBM not installed", 2 unless $have_mldbm; + + # "MLDBM::Serializer::" only looks like containment. s|::|/|g rewrites + # "::" and leaves a literal "/" alone, and MLDBM ships MLDBM/Serializer/ + # into @INC, so every component of a traversal out of it exists. + my ($inc) = grep { -d File::Spec->catdir( $_, 'MLDBM', 'Serializer' ) } @INC; +- skip "no \@INC entry holds MLDBM/Serializer/", 1 unless defined $inc; ++ skip "no \@INC entry holds MLDBM/Serializer/", 2 unless defined $inc; + + my @up = File::Spec->splitdir( File::Spec->canonpath($inc) ); + shift(@up) while ( @up && $up[0] eq '' ); +@@ -99,6 +100,21 @@ SKIP: { + }; + ok( !$::DBM_PLANT_LOADED, + "a dbm_mldbm that traverses out of MLDBM::Serializer:: does not load the file it names" ); ++ ++ # The rejection must happen before the table's lock file is created and ++ # flock()ed. Otherwise the lock outlives the failed CREATE and every ++ # later open of the table in this process blocks on it: the DROP below ++ # hung under DBI_AUTOPROXY=dbi:Gofer:transport=null, where the dbh that ++ # serves the DROP is not the one holding the stale lock. ++ my $lck = File::Spec->catfile( $dbdir, "t_ser.lck" ); ++ my $free = 1; ++ if ( -f $lck and open( my $lfh, "<", $lck ) ) ++ { ++ $free = flock( $lfh, LOCK_EX | LOCK_NB ) ? 1 : 0; ++ close($lfh); ++ } ++ ok( $free, "a rejected dbm_mldbm does not leave the table's lock file locked" ); ++ eval { $dbh->do( "DROP TABLE t_ser" ); 1 }; + $dbh->disconnect; + } + diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb index e2760d84d5..5d766a29cf 100644 --- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb +++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb @@ -21,6 +21,7 @@ SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \ file://CVE-2026-73193_p1.patch \ file://CVE-2026-73193_p2.patch \ file://CVE-2026-78030.patch \ + file://CVE-2026-111879.patch \ " SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa" From patchwork Wed Nov 11 05:38:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103670 Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3371.1794375519992885952 for ; Tue, 10 Nov 2026 21:38:40 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=IZUusj/J; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6832; q=dns/txt; s=iport01; t=1794375520; x=1795585120; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=/F0JgaGqm4gdJFkYsBZa7Yd+haM3jVT08ToehVmeTG4=; b=IZUusj/JoHvbRC/S2l929Djz8Dpa39IIC9OBayNQhz46J3eS/InFqNgm F+++qfkb3rYh2joVCpBpICuuzfGz2QKF8oFw+OD1m4WnXzhB4OAijID0G nrmrJghJTzUqZdPA/5qScNn8eYyluvPIRZ0ot9LEixncqv0nAmBdBbf5J CEkcJsSSY9HVT0Hty8pNJP7ttWNxgw/av/r7sVpxAKlnDgsNjoik26sUz LC1ciMI3ie+HuC/96zOBLBJXWnkQe4OJxW9oBEiBSHw592L0b3/2swGyW Lj7/scH7BGTHD+TCGib0CnHMsDZy7HcVGybg0y0ia0nYQsi2NBEPIlDDk g==; X-CSE-ConnectionGUID: 3gbsDerdSJmxB7uOmJjknw== X-CSE-MsgGUID: /TUtIrmvTZW1GM2oMff8eA== X-IPAS-Result: A0CvJwDZ/vNq/47/Ja1aglmCV3VgQ0kDlkgDnQqBGIF+DwEBAQ9EDQQBAYUFAo4eAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLAUYQHAMBAi8rIwgZgwIBgnQDEblngXkzgQGDWwWBHtszAQsUAYE4hUKIJF0YAUSEOScbG4FygRWDaYEFgVwCgSeGfwSCInoSgVoejHwCgU+HJUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEcgR6BEoEHXYErKF0BIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZwsaBWEIAg0MdDkQMB4kLwUaJj4bCn4YDUgRLDcVGQQ+bgeSboMOB3sTAQckF4FsKZM1kkGhEQoog3iMJJU6GjOqcguYfY4KlgRNhGqBaDyBWXAVgyIJShkPji4LC4NgzlsmMgsDLwEBBwIHDgMLgWiQAIF+AQE IronPort-Data: A9a23:KD04Cq9jlWcyI1t0ModgDrUD0H+TJUtcMsCJ2f8bNWPcYEJGY0x3z mdLXmrXPP/YY2amKdolaN61oBtSucPWmNZrSgo6+yhEQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtaztNs/vrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2ltMocD1uttDVps8 Owydy0qazKBhOSplefTpulE3qzPLeHxN48Z/3UlxjbDALN+HNbIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZP0cn1lQ/UPrSmM+khXT7ejxJoXqepLE85C7YywkZPL3FbYaLJozTHpUO9qqej iX6wnjYGBQECO6gkBWgqHWJiOGfkAquDer+E5X9rJaGmma7wXQeDhATX1a3rfS1z0KzRd9bA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzBZCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3u78Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:ZNJwOKB2uopUhtflHemO55DYdb4zR+YMi2TDGXofdfUzSL3+qy nAppUmPHPP5Qr5HUtQ++xoW5PwJU80i6QU3WB5B97LN2PbUSmTXeRfBODZrQEIdReTygck79 YCT4FOTPvtEFN9kcH2pCO8E9om3Z271ZrAv5a585+oJjsaE52JKGxCe3+mLnE= X-Talos-CUID: 9a23:orzNSm+065Z1DhWyX/mVvxUbENsJf2fR91XVM2XnFEFsar+WT0DFrQ== X-Talos-MUID: 9a23:NAiAXg+cjO3eEUfPTrBBYJaQf4BU3riPEkUTrac54uahbytVNTnNgR3iFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,207,1787011200"; d="scan'208";a="546481383" Received: from rcdn-l-core-05.cisco.com ([173.37.255.142]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 11 Nov 2026 05:38:39 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-05.cisco.com (Postfix) with ESMTPS id EF6201800020E; Wed, 11 Nov 2026 05:38:38 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id 9B8C9CBF202; Tue, 10 Nov 2026 21:38:38 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: Darsh Kelaiya Subject: [oe][meta-oe][wrynose][PATCH 3/5] libdbi-perl: fix CVE-2026-88815 Date: Tue, 10 Nov 2026 21:38:32 -0800 Message-Id: <20261111053834.3702246-3-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261111053834.3702246-1-dkelaiya@cisco.com> References: <20261111053834.3702246-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-05.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 05:38:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132124 From: Darsh Kelaiya Backport the numeric-scalar conversion fix [1] to DBI 1.647 for the crash described in [3]. Stringify SQL_NUMERIC inputs before passing their buffer and length to grok_number(). Include the declaration-placement follow-up [2] to preserve compatibility with older C compilers. Retain the upstream tests and add pure integer and floating-point SQL_NUMERIC assertions. [1] https://github.com/perl5-dbi/dbi/commit/e5ad87e5602da995d28b4d65df222368b58d6702 [2] https://github.com/perl5-dbi/dbi/commit/ff4f1baf0389dfa5e7282e1d8d7423c1b5e06b76 [3] https://github.com/perl5-dbi/dbi/security/advisories/GHSA-c8vq-w3wr-6979 Signed-off-by: Darsh Kelaiya --- .../perl/libdbi-perl/CVE-2026-88815_p1.patch | 85 +++++++++++++++++++ .../perl/libdbi-perl/CVE-2026-88815_p2.patch | 40 +++++++++ .../perl/libdbi-perl_1.647.bb | 2 + 3 files changed, 127 insertions(+) create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-88815_p1.patch create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-88815_p2.patch diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-88815_p1.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-88815_p1.patch new file mode 100644 index 0000000000..91cdd41d2d --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-88815_p1.patch @@ -0,0 +1,85 @@ +From e5ad87e5602da995d28b4d65df222368b58d6702 Mon Sep 17 00:00:00 2001 +From: "H.Merijn Brand - Tux" +Date: Thu, 10 Sep 2026 10:38:30 +0200 +Subject: [PATCH] Fix DBI::sql_type_cast on IV/NV (reported by Raj) + +CVE: CVE-2026-88815 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/e5ad87e5602da995d28b4d65df222368b58d6702] + +Backport Changes: +- Add pure IV/NV SQL_NUMERIC regression assertions and adjust the + computed test plan to cover the vulnerable conversion path. +- Omit release notes, generated Changes.pm, and dbixs_rev.h updates. + +Signed-off-by: Darsh Kelaiya +--- + DBI.xs | 4 +++- + t/90sql_type_cast.t | 27 +++++++++++++++++++++++++++ + 2 files changed, 30 insertions(+), 1 deletion(-) + +diff --git a/DBI.xs b/DBI.xs +index f5c7c29..f661db4 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -1985,8 +1985,10 @@ sql_type_cast_svpv(pTHX_ SV *sv, int sql_type, U32 flags, PERL_UNUSED_DECL void + /* else no error and sv is untouched */ + case SQL_NUMERIC: + /* based on the code in perl's toke.c */ ++ STRLEN len; ++ char *p = SvPV(sv, len); /* force stringify, handle magic */ + uv = 0; +- grok_flags = grok_number(SvPVX(sv), SvCUR(sv), &uv); ++ grok_flags = grok_number(p, len, &uv); + cast_ok = 1; + if (grok_flags == IS_NUMBER_IN_UV) { /* +ve int */ + if (uv <= IV_MAX) /* prefer IV over UV */ +diff --git a/t/90sql_type_cast.t b/t/90sql_type_cast.t +index f7b23b6..ca37f65 100644 +--- a/t/90sql_type_cast.t ++++ b/t/90sql_type_cast.t +@@ -49,6 +49,22 @@ my @tests = ( + "aa", SQL_NUMERIC, 0, NO_CAST_NO_STRICT, q{["aa"]}], + ['non numeric cast to numeric (strict)', + "aa", SQL_NUMERIC, DBIstcf_STRICT, NO_CAST_STRICT, q{["aa"]}], ++ ++ ['invalid sql type', ++ 99, 123456789, 0, INVALID_TYPE, q{[99]}], ++ ['small int cast to int', ++ 99, SQL_INTEGER, 0, CAST_OK, q{[99]}], ++ ['2 byte max signed int cast to int', ++ 32767, SQL_INTEGER, 0, CAST_OK, q{[32767]}], ++ ['2 byte max unsigned int cast to int', ++ 65535, SQL_INTEGER, 0, CAST_OK, q{[65535]}], ++ ['4 byte max signed int cast to int', ++ 2147483647, SQL_INTEGER, 0, CAST_OK, q{[2147483647]}], ++ ['4 byte max unsigned int cast to int', ++ 4294967295, SQL_INTEGER, 0, CAST_OK, q{[4294967295]}], ++ ['small int cast to int (discard)', ++ 99, SQL_INTEGER, DBIstcf_DISCARD_STRING, ++ CAST_OK, q{[99]}], + ); + + unless ($pp) { +@@ -100,6 +116,8 @@ foreach (@tests) { + $tests++ if ($dp) && ($_->[2] == SQL_DOUBLE); + } + ++$tests += 2; # Pure IV/NV SQL_NUMERIC regressions. ++ + plan tests => $tests; + + foreach my $test(@tests) { +@@ -154,4 +172,13 @@ foreach my $test(@tests) { + } + } + ++ ++# Exercise SQL_NUMERIC with values that have no string representation. ++my $numeric_iv = 42; ++is(sql_type_cast($numeric_iv, SQL_NUMERIC, 0), CAST_OK, ++ 'pure IV cast to SQL_NUMERIC'); ++my $numeric_nv = 3.14; ++is(sql_type_cast($numeric_nv, SQL_NUMERIC, 0), CAST_OK, ++ 'pure NV cast to SQL_NUMERIC'); ++ + 1; diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-88815_p2.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-88815_p2.patch new file mode 100644 index 0000000000..729d561266 --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-88815_p2.patch @@ -0,0 +1,40 @@ +From ff4f1baf0389dfa5e7282e1d8d7423c1b5e06b76 Mon Sep 17 00:00:00 2001 +From: Paul Howarth +Date: Fri, 25 Sep 2026 13:12:18 +0100 +Subject: [PATCH] Fix compatibility with old compilers not handling C99 + constructs + +Scope-level declarations require a C99 compiler. Move declarations back +to the start of the function to retain compatibility with older compilers. + +CVE: CVE-2026-88815 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/ff4f1baf0389dfa5e7282e1d8d7423c1b5e06b76] + +Signed-off-by: Darsh Kelaiya +--- + DBI.xs | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/DBI.xs b/DBI.xs +index f661db4..c3b2386 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -1953,6 +1953,8 @@ sql_type_cast_svpv(pTHX_ SV *sv, int sql_type, U32 flags, PERL_UNUSED_DECL void + int cast_ok = 0; + int grok_flags; + UV uv; ++ STRLEN len; ++ char *p; + + /* do nothing for undef (NULL) or non-string values */ + if (!sv || !SvOK(sv)) +@@ -1985,8 +1987,7 @@ sql_type_cast_svpv(pTHX_ SV *sv, int sql_type, U32 flags, PERL_UNUSED_DECL void + /* else no error and sv is untouched */ + case SQL_NUMERIC: + /* based on the code in perl's toke.c */ +- STRLEN len; +- char *p = SvPV(sv, len); /* force stringify, handle magic */ ++ p = SvPV(sv, len); /* force stringify, handle magic */ + uv = 0; + grok_flags = grok_number(p, len, &uv); + cast_ok = 1; diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb index 5d766a29cf..1e2c4f9933 100644 --- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb +++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb @@ -22,6 +22,8 @@ SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \ file://CVE-2026-73193_p2.patch \ file://CVE-2026-78030.patch \ file://CVE-2026-111879.patch \ + file://CVE-2026-88815_p1.patch \ + file://CVE-2026-88815_p2.patch \ " SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa" From patchwork Wed Nov 11 05:38:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103669 Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3372.1794375520008595406 for ; Tue, 10 Nov 2026 21:38:40 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=STBBLqoz; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4005; q=dns/txt; s=iport01; t=1794375520; x=1795585120; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=z5kfGKRBLxRSPm2lduTfiktm4gt6qCfWI5qG/OYi9E0=; b=STBBLqozprChh/Dxlqk6dzL1mY1aLxNbFe0xM8Njf+FpXPjww5wjyIrt Q2RyBSYwsLTPQ92itR1amt20dMSjLOBWrEh2qc8c9O0R5NTJ36upFVjwT 9f90AoJOYEdOzGLvqSrv4A5WW2jmHQRleLznmwHiqpa2vnm9LxG1eDO54 BHxmS3Vfj8NeE6/QWP+6SXRI0SDfJMDsnytvVOJ+DjrBebsul8IHtEqjm gi0lHmZ6NXDPN7o8DdqAoa/szrVE3bdp71PHB4pZnLurN2jfY0UjL2grS W9xiyCpi3r9EZBBgbYdOT+QIIdL//wwLNRdel7dwogOYDyq+9NPEQnrDT A==; X-CSE-ConnectionGUID: EWiJqeCnSp2nrjGI8VX7Pw== X-CSE-MsgGUID: W62sfK48Roufibtz4A09/w== X-IPAS-Result: A0BHAgBY/vNq/4v/Ja1aglmCV3VgQ0kDlkueIoF+DwEBAQ9EDQQBAYUFAo4eAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLAUYQHAMBAi8rIwgZgwIBgnQDEbligXkzgQGEftszAQsUAYE4hUKIJF0YAUSEOScbG4FygRWDaYEFgVwCiCYEgiJ6EoFaHox8AoFPhyVIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHIEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGcLGgVhCAINDHQ5EDAeJC8FGiY+Gwp+GA1IESw3FRkEPm4Hkm6DFQGBDQErF4IVkzWQIIIhoREKKIN4jCSVOhozqnILmH2OCpZRhGqBaDyBWXAVgyIJShkPji0MC4NgzlsmMgsDLwEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:3s4zf6IUiVa5pfcdFE+RgZQlxSXFcZb7ZxGr2PjKsXjdYENSgWEFy GYfD2GAM/iKMGOgKNEjPoSxoEJX6MWHzNA1SFEd+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8gmctajt8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN1DM0AUJIAz/N1vW2dU9 9M5eA49MSic0rfeLLKTEoGAh+w5J8XteYdasXZ6wHSBV7AtQIvIROPB4towMDUY358VW62BI ZBENHw2N0Wojx5nYj/7DLoyn+qsj3juehVTqUmeouw85G27IAlZjeSyaIOEJIbXLSlTtnnG/ HnI3DipOBYHOt2V1SjZ2yr9wfCayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PW0lEO6c9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7DQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSv1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:uzA3xqx1efqubl0czHNKKrPwDr1zdoMgy1knxilNoNJuHfBw8P re+8jzuiWUtN98YhwdcJW7Scu9qBDnhPpICPcqXYtKNTOO0ADDEGgh1/qG/9SKIUPDH4BmuZ uIC5IOa+HYPBxdkdvw5hW+HpILxdmK973tuMLlpk0dKz2Dr8pbnn9E4sHxKDwOeDV7 X-Talos-CUID: 9a23:vpDvTWtr7hYPAi54t678IC6Z6IsITXz/1Xr7JXSgU2BzSpK0GWGgp5t7xp8= X-Talos-MUID: 9a23:i5tq+gj2yFW3HmL2woHg08MpC5ky+KqNVBA3logIusOYJ3BZY2bak2Hi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,207,1787011200"; d="scan'208";a="547019625" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 11 Nov 2026 05:38:39 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id 0005A180007DB; Wed, 11 Nov 2026 05:38:38 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id A146ECBF203; Tue, 10 Nov 2026 21:38:38 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: Darsh Kelaiya Subject: [oe][meta-oe][wrynose][PATCH 4/5] libdbi-perl: fix CVE-2026-88816 Date: Tue, 10 Nov 2026 21:38:33 -0800 Message-Id: <20261111053834.3702246-4-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261111053834.3702246-1-dkelaiya@cisco.com> References: <20261111053834.3702246-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 05:38:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132123 From: Darsh Kelaiya Backport the FetchHashKeyName conversion fix [1] to DBI 1.647 for the crash described in [2]. Stringify numeric attribute values before using them as hash-key names. Use the regression's newly created handle consistently and enable RaiseError so the invalid-attribute check raises the expected exception. [1] https://github.com/perl5-dbi/dbi/commit/70962570212dc60a5428098cf2a0462ad5945851 [2] https://github.com/perl5-dbi/dbi/security/advisories/GHSA-f4qx-mr9m-q2hq Signed-off-by: Darsh Kelaiya --- .../perl/libdbi-perl/CVE-2026-88816.patch | 69 +++++++++++++++++++ .../perl/libdbi-perl_1.647.bb | 1 + 2 files changed, 70 insertions(+) create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-88816.patch diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-88816.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-88816.patch new file mode 100644 index 0000000000..75cfd22488 --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-88816.patch @@ -0,0 +1,69 @@ +From 70962570212dc60a5428098cf2a0462ad5945851 Mon Sep 17 00:00:00 2001 +From: "H.Merijn Brand - Tux" +Date: Thu, 10 Sep 2026 11:26:24 +0200 +Subject: [PATCH] Fix FetchHashKeyName on IV/NV (CVE-2026-88816) (reported by + Raj) + +CVE: CVE-2026-88816 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/70962570212dc60a5428098cf2a0462ad5945851] + +Backport Changes: +- Use the regression's fresh handle for its attribute and prepare + calls, with RaiseError enabled for the expected exception. +- Omit release notes, generated Changes.pm, and dbixs_rev.h updates. + +Signed-off-by: Darsh Kelaiya +--- + DBI.xs | 2 +- + t/06attrs.t | 11 +++++++++++ + t/90sql_type_cast.t | 2 +- + 3 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/DBI.xs b/DBI.xs +index c3b2386..2bef3cb 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -5351,7 +5351,7 @@ fetchrow_hashref(sth, keyattrib=Nullch) + if (!keyattrib || !*keyattrib) { + SV *kn = DBIc_FetchHashKeyName(imp_sth); + if (kn && SvOK(kn)) +- keyattrib = SvPVX(kn); ++ keyattrib = SvPV_nolen(kn); /* Also force stringification */ + else + keyattrib = "NAME"; + } +diff --git a/t/06attrs.t b/t/06attrs.t +index 835e7db..3d80559 100644 +--- a/t/06attrs.t ++++ b/t/06attrs.t +@@ -328,6 +328,17 @@ check_inherited($drh, "ReadOnly", 1, 0); + + } + ++{ # CVE-2026-88816 ++ my $h = DBI->connect("dbi:ExampleP:", "", "", { RaiseError => 1, PrintError => 0 }); ++ $h->{FetchHashKeyName} = 42; ++ my $s = $h->prepare("select mode,size,name from ."); ++ $s->execute; ++ my @err; ++ local $SIG{__DIE__} = sub { push @err => @_ }; ++ eval { $s->fetchrow_hashref; }; ++ like($err[0], qr{Can't use (?:attribute '42'|an undefined)}, "Invalid HashKeyName"); ++} ++ + done_testing(); + + 1; +diff --git a/t/90sql_type_cast.t b/t/90sql_type_cast.t +index ca37f65..0102a06 100644 +--- a/t/90sql_type_cast.t ++++ b/t/90sql_type_cast.t +@@ -49,7 +49,7 @@ my @tests = ( + "aa", SQL_NUMERIC, 0, NO_CAST_NO_STRICT, q{["aa"]}], + ['non numeric cast to numeric (strict)', + "aa", SQL_NUMERIC, DBIstcf_STRICT, NO_CAST_STRICT, q{["aa"]}], +- ++ # CVE-2026-88815 + ['invalid sql type', + 99, 123456789, 0, INVALID_TYPE, q{[99]}], + ['small int cast to int', diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb index 1e2c4f9933..0b444a7980 100644 --- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb +++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb @@ -24,6 +24,7 @@ SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \ file://CVE-2026-111879.patch \ file://CVE-2026-88815_p1.patch \ file://CVE-2026-88815_p2.patch \ + file://CVE-2026-88816.patch \ " SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa" From patchwork Wed Nov 11 05:38:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 103668 Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3465.1794375519972889080 for ; Tue, 10 Nov 2026 21:38:40 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=cKt6Vs15; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4807; q=dns/txt; s=iport01; t=1794375520; x=1795585120; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=AP241zN22NEaq+hOcDRWGGK7n1nygMJk/jopOiEpSaY=; b=cKt6Vs15vXStsrae3UwaVDnVesH9eG6g0jWjuYNWiEzf30rWVtogTh2Q 33howkvAPmfBajjYGPyFsmktX812uONFJGyqo36LQeMXGMXHap2lg684W RgxI8xbVV7tuFz+OdjZ2NinC+/pVz2NmoGCKD6x5TJdsVV81sAjPzZwi+ BDBg2VMFEQSSL1R5UbrauHpODyS64X/ApQwRSZrSlHSztp2xkSqLaacRC rYrMQJeiu+9/H9zEbaQ16V3CJq98VZ5dgD7lfYpsh0/Yby/YqsajCvUua GGJ5/tfIYswR0NIpo4eSKJByUtDMyyqP8WtxYQJCdj+gfA0DJW160iU3v Q==; X-CSE-ConnectionGUID: Rm/TIDE1QMieZV3kFbutRw== X-CSE-MsgGUID: 2abzIIp7QOOyI+8S97/OWA== X-IPAS-Result: A0BJAgBY/vNq/4r/Ja1aglmCV3VgQ0kDlkgDgROdDxSBag8BAQEPRA0EAQGFBQKOHgImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwFGEBwDAQIWGSsjCBmDAgGCdAMRuWKBeTOBAYR+2zMBCxQBgTiFQogkXRgBhH0nGxuBcoEVgnN2gQWBXAKBGYEGhgcEgiJ6EoFaHox8AoFPhyVIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHIEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGcLGgVhCAINDHQ5EDAeJC8FGiY+Gwp+GA1IESw3FRkEPm4Hkm6DFVA+ASuBQw1cHZMYkkGhEQoog3iMJJU6GjOEBKZuC5h9glmLMZYETYRqgWg8RoETcBWDIglKGQ+OLQwLg2DOWyYyCwMvAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:iJ0aNKzQwwWCYGUDiwF6t+dnxyrEfRIJ4+MujC+fZmUNrF6WrkUGx 2dLWTvUPv+KNjSnfttyYYmzphwE65TVn9RgGgI6q1hgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWctaztMsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJHszerE51ssuOERP+ M4mczMjZA2fvf3jldpXSsE07igiBNPgMIVavjRryivUSK5/B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2bM3WjOX9PYH46tOuri332cixRgFmUvqEwpWPUyWSd1ZCwbIeFK4TaHp89ckCw/ GvM7UXYGk4jE/uO6HnVySPzwcjwtHauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8hkOgVtZ3L 00P5jFoqrA/8kGuRNTxUxC05nmesXYht8F4CeY27kSJj6HT+QvcXjFCRT9aY9tgv8gzLdA36 mK0cxrSLWQHmNWopbi1rN94cRva1fApEFI/ IronPort-HdrOrdr: A9a23:juLgsqy/zWnRujXmKTkQKrPwDr1zdoMgy1knxilNoNJuHfBw8P re+8jzuiWUtN98YhwdcJW7Scu9qBDnhPpICPcqXYtKNTOO0ADDEGgh1/qG/9SKIUPDH4BmuZ uIC5IOa+HYPBxdkdvw5hW+HpILxdmK973tuMLlpk0dKz2Dr8pbnn9E4sHxKDwOeDV7 X-Talos-CUID: 9a23:Z8rrmmg7E9fUOXcbl7L8LJtk8zJuSHia8Fb8DhaBLGdkeoPOSnGa5b9ejJ87 X-Talos-MUID: 9a23:Q4+UGQ6pCOAOFdWUBq+30cDXxowy6q68KWEVzqwhnNildnxLamjaqwueF9o= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,207,1787011200"; d="scan'208";a="545890832" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 11 Nov 2026 05:38:39 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 09EB0180001D2; Wed, 11 Nov 2026 05:38:39 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id A9050CBF204; Tue, 10 Nov 2026 21:38:38 -0800 (PST) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: Darsh Kelaiya Subject: [oe][meta-oe][wrynose][PATCH 5/5] libdbi-perl: fix CVE-2026-108518 Date: Tue, 10 Nov 2026 21:38:34 -0800 Message-Id: <20261111053834.3702246-5-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261111053834.3702246-1-dkelaiya@cisco.com> References: <20261111053834.3702246-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 11 Nov 2026 05:38:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132122 From: Darsh Kelaiya Backport the destructor profiling fix [1] to DBI 1.647 for the type-confusion crash described in [2]. Accept the inner handle returned as either a reference or a raw hash during destruction. Retain the upstream regression and update the older profiling test's fixed plan to account for the two added assertions. [1] https://github.com/perl5-dbi/dbi/commit/c2ff4df575d7af625bb4d0d1ef7539f90b22d8b2 [2] https://github.com/perl5-dbi/dbi/security/advisories/GHSA-7393-6f8r-fhh3 Signed-off-by: Darsh Kelaiya --- .../perl/libdbi-perl/CVE-2026-108518.patch | 72 +++++++++++++++++++ .../perl/libdbi-perl_1.647.bb | 1 + 2 files changed, 73 insertions(+) create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-108518.patch diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-108518.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-108518.patch new file mode 100644 index 0000000000..9ec454909a --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-108518.patch @@ -0,0 +1,72 @@ +From c2ff4df575d7af625bb4d0d1ef7539f90b22d8b2 Mon Sep 17 00:00:00 2001 +From: "H.Merijn Brand - Tux" +Date: Fri, 9 Oct 2026 16:04:53 +0200 +Subject: [PATCH] Prevent dbi_profile crash (Henrik Teichmann) + +CVE: CVE-2026-108518 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/c2ff4df575d7af625bb4d0d1ef7539f90b22d8b2] + +Backport Changes: +- Place the new assertions before the older test's exit and update + its fixed test plan from 60 to 62; newer subtests are absent. +- Omit release notes, generated Changes.pm, and dbixs_rev.h updates. + +Signed-off-by: Darsh Kelaiya +--- + DBI.xs | 8 +++++++- + t/40profile.t | 16 +++++++++++++++- + 2 files changed, 22 insertions(+), 2 deletions(-) + +diff --git a/DBI.xs b/DBI.xs +index 2bef3cb..a42b597 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -3031,7 +3031,13 @@ dbi_profile(SV *h, imp_xxh_t *imp_xxh, SV *statement_sv, SV *method, NV t1, NV t + dbh_outer_hv = DBIc_MY_H(imp_dbh); + if (SvTYPE(dbh_outer_hv) != SVt_PVHV) + return &PL_sv_undef; /* presumably global destruction - bail */ +- dbh_inner_hv = (HV*)SvRV(dbih_inner(aTHX_ (SV*)dbh_outer_hv, "profile")); ++ { /* dbih_inner() returns the inner handle as an RV, except when it was ++ * given a raw inner HV (DBIc_MY_H() is set to the inner HV while the ++ * outer handle is being destroyed): then it returns that HV itself, ++ * and SvRV() on it would return its bucket array (HvARRAY). */ ++ SV *irv = dbih_inner(aTHX_ (SV*)dbh_outer_hv, "profile"); ++ dbh_inner_hv = (HV*)(SvROK (irv) ? SvRV (irv) : irv); ++ } + if (SvTYPE(dbh_inner_hv) != SVt_PVHV) + return &PL_sv_undef; /* presumably global destruction - bail */ + } +diff --git a/t/40profile.t b/t/40profile.t +index 7a71b8f..1eb3151 100644 +--- a/t/40profile.t ++++ b/t/40profile.t +@@ -31,7 +31,7 @@ BEGIN { + if $Config{osvers} =~ /xen/ # eg 2.6.18-4-xen-amd64 + and $ENV{AUTOMATED_TESTING}; + +- plan tests => 60; ++ plan tests => 62; + } + + $Data::Dumper::Indent = 1; +@@ -458,6 +458,20 @@ is("@$totals", "27.00 2.93 0.11 0.01 0.23 1023110000.00 1023110010.00", + 'merged time foo/bar'); + is($total_time, 2.93, 'merged nodes foo/bar time'); + ++# The DESTROY of a database handle must be profiled when the Path has {attr} elements. ++# While the outer handle is being destroyed DBIc_MY_H() holds the raw inner HV; dbi_profile() used to ++# call SvRV() on the (raw HV) result of dbih_inner() and so used the hash's bucket array as an HV. ++{ ++ my $prof = DBI::Profile->new(Path => [ '{Username}', '!MethodName' ]); ++ my $dbh = DBI->connect("dbi:ExampleP:", 'usrnam', '', { RaiseError => 1, Profile => $prof }); ++ $dbh->ping; ++ undef $dbh; # DESTROY of the database handle ++ my $node = $prof->{Data}{usrnam}; ++ ok $node && $node->{DESTROY}, 'DESTROY of a database handle is profiled with a {Username} path element'; ++ is $node && $node->{DESTROY} ? $node->{DESTROY}[0] : undef, 1, 'exactly one DESTROY call profiled'; ++ $prof->{Data} = undef; # no report at exit ++} ++ + exit 0; + + diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb index 0b444a7980..5c0826a01b 100644 --- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb +++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb @@ -25,6 +25,7 @@ SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \ file://CVE-2026-88815_p1.patch \ file://CVE-2026-88815_p2.patch \ file://CVE-2026-88816.patch \ + file://CVE-2026-108518.patch \ " SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa"