mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-12 06:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

util-linux: Fix CVE-2026-3184

Browse Source 
Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-3184
[2] 8b29aeb081

(From OE-Core rev: 2b3600a80144dcf4ca2632b010c59e8df254a6f9)

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Jaipaul Cheernam
2026-08-25 06:38:03 +02:00
committed by Richard Purdie
parent c71dd3cb0d
commit 04cc7f252d
2 changed files with 62 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-core/util-linux/util-linux.inc
View File

@@ -48,6 +48,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin
file://CVE-2025-14104-02.patch \
file://CVE-2026-27456.patch \
file://CVE-2026-13595.patch \
file://CVE-2026-3184.patch \
"
SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f"

61
meta/recipes-core/util-linux/util-linux/CVE-2026-3184.patch Normal file
View File

@@ -0,0 +1,61 @@
From 3fb64ddbffbc9442dca56eb6d4f263d525708b64 Mon Sep 17 00:00:00 2001
From: Karel Zak <kzak@redhat.com>
Date: Thu, 19 Feb 2026 12:20:28 +0100
Subject: [PATCH] login: use original FQDN for PAM_RHOST
When login -h <remotehost> is invoked, init_remote_info() strips the
local domain suffix from the hostname (FQDN to short name) before
storing it in cxt->hostname. This truncated value is then used for
PAM_RHOST, which can bypass pam_access host deny rules that match on
the FQDN.
Preserve the original -h hostname in a new cmd_hostname field and use
it for PAM_RHOST, while keeping the truncated hostname for utmp/wtmp
and logging unchanged.
Note, the real-world impact is low -- login -h is only used by legacy
telnet/rlogin daemons, and exploitation requires FQDN-specific
pam_access rules on a system still using these obsolete services.
Reported-by: Asim Viladi Oglu Manizada <manizada@pm.me>
Signed-off-by: Karel Zak <kzak@redhat.com>
(cherry picked from commit 8b29aeb081e297e48c4c1ac53d88ae07e1331984)
CVE: CVE-2026-3184
Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/8b29aeb081e297e48c4c1ac53d88ae07e1331984]
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
login-utils/login.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/login-utils/login.c b/login-utils/login.c
index 321f9d6ce..0c5c805aa 100644
--- a/login-utils/login.c
+++ b/login-utils/login.c
@@ -128,6 +128,7 @@ struct login_context {
char *thishost; /* this machine */
char *thisdomain; /* this machine's domain */
char *hostname; /* remote machine */
+ char *cmd_hostname; /* remote machine as specified on command line */
char hostaddress[16]; /* remote address */
pid_t pid;
@@ -906,7 +907,7 @@ static pam_handle_t *init_loginpam(struct login_context *cxt)
/* hostname & tty are either set to NULL or their correct values,
* depending on how much we know. */
- rc = pam_set_item(pamh, PAM_RHOST, cxt->hostname);
+ rc = pam_set_item(pamh, PAM_RHOST, cxt->cmd_hostname);
if (is_pam_failure(rc))
loginpam_err(pamh, rc);
@@ -1249,6 +1250,8 @@ static void init_remote_info(struct login_context *cxt, char *remotehost)
get_thishost(cxt, &domain);
+ cxt->cmd_hostname = xstrdup(remotehost);
+
if (domain && (p = strchr(remotehost, '.')) &&
strcasecmp(p + 1, domain) == 0)
*p = '\0';