Commit Graph

67890 Commits

Author SHA1 Message Date
Samantha Jalabert
a171408008 bitbake: Fix disk space monitoring on cephfs
Error occured while running bitbake on cephfs:

WARNING: The free inode of path is running low (-0.001K left)
ERROR: Immediately halt since the disk space monitor action is "HALT"!

(Bitbake rev: a7f6c3e67bd9170e93b2b94676e84018faf0df91)

Signed-off-by: Samantha Jalabert <samantha.jalabert@syslinbit.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-09 04:41:17 -10:00
Denys Dmytriyenko
8d57eddc82 bitbake: runqueue: convert deferral messages from bb.note to bb.debug
Using multiconfig to target baremetal pieces of the system and building
corresponding toolchains for them results in hundreds and hundreds of
"Deferring %s after %s" and "Deferred task %s now buildable".

To clean up the output and to reduce risk of missing important warnings,
convert these notice messages to debug messages.

(Bitbake rev: 3505d8d8c02b041946670ab6bc5751e54fe292ff)

Signed-off-by: Denys Dmytriyenko <denis@denix.org>
Signed-off-by: Denys Dmytriyenko <denys@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 64bc00a46d1aacc23fe7e8d9a46a126f3a4bc318)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-09 04:41:17 -10:00
Peter Kjellerstedt
2fc0a78176 bitbake: tinfoil: Do not fail when logging is disabled and full config is used
If Tinfoil is initialized with setup_logging = False and
Tinfoil.prepare() is called with config_only = False, then it fails
because self.localhandlers is only initialized when
setup_logging = True.

This is seen with, e.g., `bitbake-getvar -q -r busybox MACHINE`:

  Traceback (most recent call last):
    File ".../bitbake/bin/bitbake-getvar", line 41, in <module>
      tinfoil.prepare(quiet=2)
    File ".../bitbake/lib/bb/tinfoil.py", line 390, in prepare
      for handler in self.localhandlers:
  AttributeError: 'Tinfoil' object has no attribute 'localhandlers'.
  Did you mean: 'oldhandlers'?

(Bitbake rev: e452c6d7ba5bb4f78a1d2bfb742794efdf171dbc)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 616101ddb630e2c9975022068b52a87c4cf647f6)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-09 04:41:17 -10:00
Peter Kjellerstedt
0207478c7b bitbake: bitbake-getvar: Make --quiet work with --recipe
Initializing Tinfoil with setup_logging = False only has an effect when
recipe parsing is not needed. To make it work regardless of if --recipe
is used, manipulate the quiet parameter to Tinfoil.prepare() instead.

(Bitbake rev: 161ab0d5bab74732e12d490cee50e14295be0a9f)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 71ee69a20f21f3d37f4f060a7d8e87d9f1dc6aa1)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-09 04:41:17 -10:00
Steve Sakoman
d8d6d921fa build-appliance-image: Update to kirkstone head revision
(From OE-Core rev: 0eb8e67aa6833df0cde29833568a70e65c21d7e5)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
kirkstone-4.0.14 yocto-4.0.14
2023-11-03 04:34:41 -10:00
Steve Sakoman
73e3b5481b poky.conf: bump version for 4.0.14
(From meta-yocto rev: 10e9c5a4c80fe4ee717b9ff63a08c58a9ac094e2)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-03 04:26:14 -10:00
Michael Opdenacker
df56d7c525 test-manual: reproducible-builds: stop mentioning LTO bug
Now that https://bugzilla.yoctoproject.org/show_bug.cgi?id=14481
is closed.

(From yocto-docs rev: 260b446a1a75d99399a3421cd8d6ba276f508f37)

Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-03 04:26:13 -10:00
Marta Rybczynska
5f21fa7de9 dev-manual: add security team processes
Add the initial version of the section on vulnerability reports,
operations of the Security Team with a
transcription of https://wiki.yoctoproject.org/wiki/Security_private_reporting

(From yocto-docs rev: 13927bd3e2f89f301331583b2c5752b963822976)

Signed-off-by: Marta Rybczynska <marta.rybczynska@syslinbit.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-03 04:26:13 -10:00
Michael Opdenacker
b971ffa75e manuals: correct "yocto-linux" by "linux-yocto"
(From yocto-docs rev: 689f682c175e19664c090852d5c649280ce23fa0)

Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-03 04:26:13 -10:00
Peter Marko
f966e16c3b glibc: ignore CVE-2023-4527
This vulnerability was introduced in 2.36, so 2.35 is not vulnerable.

(From OE-Core rev: bf60773c882483f4bfe49e89be8e2f85f78b212b)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-03 04:26:13 -10:00
Vijay Anusuri
83d53dc031 tiff: CVE patch correction for CVE-2023-3576
- The commit [881a070194]
fixes CVE-2023-3576
- Hence, renamed the CVE-2023-3618-1.patch to CVE-2023-3576.patch
- Reference: https://security-tracker.debian.org/tracker/CVE-2023-3576
             https://security-tracker.debian.org/tracker/CVE-2023-3618

(From OE-Core rev: 63daa00279c0c3a8650d6e08a68cc32a2b98d843)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-03 04:26:13 -10:00
Peter Marko
f948c66f75 libxml2: Patch CVE-2023-45322
Backport patch for gitlab issue mentioned in NVD CVE report.
* https://gitlab.gnome.org/GNOME/libxml2/-/issues/583
Backport also one of 14 patches for older issue with similar errors
to have clean cherry-pick without patch fuzz.
* https://gitlab.gnome.org/GNOME/libxml2/-/issues/344

The CVE is disputed because the maintainer does not think that
errors after memory allocation failures are not critical enough
to warrant a CVE ID.
This patch will formally fix reported error case, trying to backport
another 13 patches and resolve conflicts would be probably overkill
due to disputed state.
This CVE was ignored on master branch (as diputed).

(From OE-Core rev: d29a89412b37995857269d617e16ada116f14270)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-03 04:26:13 -10:00
Fahad Arslan
b1ddd4178d linux-firmware: create separate packages
This is backport of commit dfb7d2c426 from poky master.

This is in continuation of earlier commit:
3ddddfc14f
linux-firmware: create separate package for cirrus and cnm firmwares

And creates separate sub packages for firmwares corresponding to following list of
licenses:
LICENSE.amphion_vpu
LICENCE.cw1200
LICENSE.ice_enhanced
LICENCE.mediatek
LICENCE.microchip
LICENCE.moxa
LICENSE.nxp_mc_firmware
LICENCE.OLPC
LICENCE.phanfw
LICENCE.qla2xxx
LICENCE.ti-keystone
LICENCE.wl1251
LICENCE.xc4000
LICENCE.xc5000
LICENCE.xc5000c

(From OE-Core rev: c110e5708465a6becc611acf97f166302a17ebdf)

(From OE-Core rev: 56503e3e80603de3b69acef2f6d32836bc9e5e5d)

Signed-off-by: Fahad Arslan <fahad.arslan@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-01 05:01:26 -10:00
Fahad Arslan
95b430be16 linux-firmware: create separate package for cirrus and cnm firmwares
This is cherry-pick of commit 3ddddfc14f from
poky master.

Some licenses only allow usage of corresponding firmwares when a specific
hardware is present. This requires split of such firmwares from linux-firmware
package to firmware specific sub package. As this split is based off of
licensing, it makes sense to group firmware blobs having the same license in the
same package. This commit is a first step in this direction, and creates
separate packages for cirrus and cnm firmware.

(From OE-Core rev: 53d9d8789efc701609a5a1e985287344c2209d62)

(From OE-Core rev: 9b556e63ba3e89e83ba6e2647656a1fa6def87a4)

Signed-off-by: Fahad Arslan <fahad.arslan@siemens.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-01 05:01:26 -10:00
Niko Mauno
e46e74cd90 package_rpm: Allow compression mode override
Commit 4a4d5f78a6 ("package_rpm: use zstd
instead of xz") changed the rpm package compressor from 'xz' to 'zstd'
which results in decompression failure with BusyBox-provided 'rpm2cpio'
applet and 'rpm' applet when given the '-i' (Install package) option:

  rpm2cpio: no gzip/bzip2/xz magic

Introduce a variable which makes it possible to use a different
compression mode, making it possible to override the default value for
example like

  RPMBUILD_COMPMODE = "${@'w6T%d.xzdio' % int(d.getVar('XZ_THREADS'))}"

to enable rpm decompression without including the full rpm package in
the resulting root filesystem.

(From OE-Core rev: a40d9258148e28cbee2168c93179cd4c1232fb62)

(From OE-Core rev: ad4ea9f225b0dd6396088cc70b34f886c5fa62b4)

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-01 05:01:26 -10:00
Peter Marko
f35f1aaf22 openssl: Upgrade 3.0.11 -> 3.0.12
https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-3011-and-openssl-3012-24-oct-2023

Major changes between OpenSSL 3.0.11 and OpenSSL 3.0.12 [24 Oct 2023]
* Mitigate incorrect resize handling for symmetric cipher keys and IVs. (CVE-2023-5363)

(From OE-Core rev: 5cf9f9426de71a35b06c7b4b9b092f22243676fb)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-01 05:01:25 -10:00
Archana Polampalli
715fc203c2 curl: fix CVE-2023-38546
A flaw was found in the Curl package. This flaw allows an attacker to insert
cookies into a running program using libcurl if the specific series of conditions are met.

(From OE-Core rev: 9c0c09b81594979aafd74511366316419d23046e)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-01 05:01:25 -10:00
Archana Polampalli
e9a7427077 curl: fix CVE-2023-38545
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.

(From OE-Core rev: 44971c945a615d07c91100f514377f7247796334)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-01 05:01:25 -10:00
Steve Sakoman
6f022adb5c cve-exclusion_5.10.inc: update for 5.10.197
(From OE-Core rev: effa2f7a7424e0f25eaf3680326164e859378332)

Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-01 05:01:25 -10:00
BELHADJ SALEM Talel
59077aa77b ref-manual: variables: add example for SYSROOT_DIRS variable
(From yocto-docs rev: 63fcc08bbb053262c3292c884ac91f389f1d9d97)

Signed-off-by: Talel BELHAJSALEM <bhstalel@gmail.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
BELHADJ SALEM Talel
bdea205855 ref-manual: variables: add TOOLCHAIN_OPTIONS variable
(From yocto-docs rev: d7397a985fa085b4ca97aaebedfec5fcaf4e82de)

Signed-off-by: Talel BELHAJSALEM <bhstalel@gmail.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
BELHADJ SALEM Talel
bf5e50a353 ref-manual: variables: add RECIPE_SYSROOT and RECIPE_SYSROOT_NATIVE
(From yocto-docs rev: e4c3fd543cb1b98255dcd3b40819ebcc7ef3a52a)

Signed-off-by: Talel BELHAJSALEM <bhstalel@gmail.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Michael Opdenacker
3fd3ed3b11 dev-manual: start.rst: remove obsolete reference
Remove a reference to a web resource which is clearly marked as obsolete.
Replace the unnecessarily verbose note by just links to the mentioned tools.

[YOCTO #15233]

(From yocto-docs rev: b2db385b859faa775f7c92072ba9bbeebb90e713)

Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Reported-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Michael Opdenacker
b5b18d155e brief-yoctoprojectqs: use new CDN mirror for sstate
Recommended instead of the Yocto Project mirror, because expected
to be faster. Make sure you only set one such mirror.

(From yocto-docs rev: 2c2dae48619f3e2a600fcdba7cd0dcb0bd313b75)

Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
CC: richard.purdie@linuxfoundation.org
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
BELHADJ SALEM Talel
c3032cebe7 dev-manual: layers: Add notes about layer.conf
As discussed before with Richard Purdie, the code supports this but the documentation does not.
Developers in general will not notice this or focus on it because they do not mess with the
layer.conf template file, but in my opinion I think more details can help.

(From yocto-docs rev: c4b94c24ff7e1b1609f9c7f0aebd24fd04d00ae9)

Signed-off-by: Talel BELHAJSALEM <bhstalel@gmail.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Quentin Schulz
955796ad7e ref-manual: variables: provide no-match example for COMPATIBLE_MACHINE
COMPATIBLE_MACHINE is used to forbid the use of a recipe or its packages
for a specific set of machines.

In some cases, it may make more sense to have the logic inverted and
have the recipe always forbidden except for hand-picked machines. Such
could be the case for pieces of software that only support some
architectures. In that scenario, it is sometimes a bit easier on the eye
and for maintenance to use the OVERRIDES mechanism but for that, a
default should be set.

COMPATIBLE_MACHINE:aarch64 = "^(aarch64)$"
COMPATIBLE_MACHINE:mips64 = "^(mips64)$"

wouldn't do much because if COMPATIBLE_MACHINE isn't set, the recipe is
assumed compatible and therefore, if no default is provided we enter
that case.

Hence, we need to add

COMPATIBLE_MACHINE = "^$"

as default so that it only matches the empty string, which isn't
possible for MACHINEOVERRIDES.

Cc: Quentin Schulz <foss+yocto@0leil.net>
(From yocto-docs rev: d66b53eebe5b2320ce12926b309e48c9e32523f3)

Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Robert P. J. Day
650980791e profile-manual: aesthetic cleanups
Various aesthetic cleanups of section 1 of that manual, including:

  * replace 'HOWTO' with manual
  * add more examples of sdk-related images
  * font fixes

(From yocto-docs rev: 3f271b53f2103c3a7eb76ab17f0c945512493471)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
BELHADJ SALEM Talel
0f23056836 ref-manual: Fix PACKAGECONFIG term and add an example
PACKAGECONFIG's first and second flag value will be added to PACKAGECONFIG_CONFARGS
and then it will be added to the appropriate variable (EXTRA_OECMAKE, or ...)
So we need to only mention PACKAGECONFIG_CONFARGS and it will lead to other variables.

I added a custom example that can help understanding very well PACKAGECONFIG.

(From yocto-docs rev: 94eb37ef56cbb19b5b6e28bef522a7288a1a61f9)

Signed-off-by: Talel BELHAJSALEM <bhstalel@gmail.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Paul Eggleton
6fd2902f05 dev/ref-manual: Document INIT_MANAGER
The INIT_MANAGER variable was added in 3.0 but it seems we didn't get
around to documenting it yet. I have added a variable glossary entry and
made the basic adjustment of the "Using systemd Exclusively" section in
the dev manual, however I think the latter section still needs work.

(From yocto-docs rev: a84adfaeda5a790275d020fc77d721e8560a5728)

Signed-off-by: Paul Eggleton <bluelightning@bluelightning.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Robert P. J. Day
720324bd18 dev-manual: new-recipe.rst: add missing parenthesis to "Patching Code" section
Add missing parenthesis, and another example of a compressed patch filename.

(From yocto-docs rev: febc0c6b7b5843c70ed01f9b2bda71c02091eae6)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Michael Opdenacker
6a3b428c7c bsp-guide: bsp: skip Intel machines no longer supported in Poky
(From yocto-docs rev: ab6a260de80e8a73079e1ac5430a3688be025d5d)

Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Reported-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Michael Opdenacker
c969a2456c sdk-manual: appendix-obtain: improve and update descriptions
- Improve text formatting
- Stop mentioning all possible values
- Update examples
- Correct descriptions

(From yocto-docs rev: d44cd995e4abc1bed57a7edbe27fdfd642768d4f)

Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Michael Opdenacker
734069e81b dev-manual: wic: update "wic list images" output
(From yocto-docs rev: 46fdf58f4a26de2989261eb451380905ae0f1a41)

Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Michael Opdenacker
aaf748b95f manuals: update linux-yocto append examples
(From yocto-docs rev: b5d385f20d22566e12a7938a9894b86429f1dcfb)

Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Arne Schwerdt
811cf0320c ref-manual: Warn about COMPATIBLE_MACHINE skipping native recipes
(From yocto-docs rev: 48e5fb383570dc6a067b14cc621e4cb347db900c)

Signed-off-by: Arne Schwerdt <arne.schwerdt@elbbits.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Siddharth Doshi
a6f551f516 vim: Upgrade 9.0.2009 -> 9.0.2048
This includes CVE fix for CVE-2023-5535.

(From OE-Core rev: 7681436190354b5c5b6c3a82b3094badd81113de)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:50 -10:00
Siddharth Doshi
fb38c59633 libx11: Security Fix for CVE-2023-43785, CVE-2023-43786 and CVE-2023-43787
CVE's Fixed:
CVE-2023-43785: libX11: out-of-bounds memory access in _XkbReadKeySyms()
CVE-2023-43786: libX11: stack exhaustion from infinite recursion in PutSubImage()
CVE-2023-43787: libX11: integer overflow in XCreateImage() leading to a heap overflow

(From OE-Core rev: 8175d023c203d524d011d8947f90fbd02786c6db)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:50 -10:00
Meenali Gupta
386672ff8c linux-firmware: upgrade 20230625 -> 20230804
License-Update: additional firmwares

upgrade include fix for CVE-2023-20569 CVE-2022-40982 CVE-2023-20593

Changelog:
      https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/

References:
      https://nvd.nist.gov/vuln/detail/CVE-2023-20569
      https://nvd.nist.gov/vuln/detail/CVE-2022-40982
      https://nvd.nist.gov/vuln/detail/CVE-2023-20593

(From OE-Core rev: d3f1448246c9711f4f23f2e12c664e0ba3ae3f02)

Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:50 -10:00
Peter Marko
e06868eff3 zlib: patch CVE-2023-45853
Backport commit merged to develop branch from PR linked in NVD report:
* https://nvd.nist.gov/vuln/detail/CVE-2023-45853
* https://github.com/madler/zlib/pull/843

(From OE-Core rev: 6e265e44febbb6fdf85c7926b9a64b731c98d814)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:50 -10:00
Vijay Anusuri
024fa046fc gawk: backport Debian patch to fix CVE-2023-4156
Upstream-Status: Backport
[https://git.launchpad.net/ubuntu/+source/gawk/tree/debian/patches?h=ubuntu/jammy-security
&
https://git.savannah.gnu.org/gitweb/?p=gawk.git;a=commitdiff;h=e709eb829448ce040087a3fc5481db6bfcaae212]

(From OE-Core rev: 0547b60d3485c2e3853e5a9e0a3e051882b283f3)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:50 -10:00
Lee Chee Yang
7725c28871 qemu: ignore RHEL specific CVE-2023-2680
(From OE-Core rev: a1256b8fa415002eee78427cc292b866570ee267)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:50 -10:00
Richard Purdie
b1c1d6d048 SECURITY.md: Add file
Add a SECURITY.md file with hints for security researchers and other
parties who might report potential security vulnerabilities.

(From meta-yocto rev: e3c11a51dc814fdd400998f50b17e572d453e1d2)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-24 05:28:15 -10:00
Marta Rybczynska
70f4bd1b3c bitbake: SECURITY.md: add file
Add a SECURITY.md file with hints for security researchers and other
parties who might report potential security vulnerabilities.

(Bitbake rev: 6c1ffa9091d0c53a100e8c8c15122d28642034bd)

Signed-off-by: Marta Rybczynska <marta.rybczynska@syslinbit.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-24 05:28:15 -10:00
Quentin Schulz
72ddfbc89a uboot-extlinux-config.bbclass: fix missed override syntax migration
uboot-extlinux-config allows to specify multiple "labels" (entries in a
menu, à-la grub) and each of them have their own values for some fields.
Each "base" variable, e.g. UBOOT_EXTLINUX_FDT can be overridden for each
label. This is done via the OVERRIDES mechanism based on the label name,
e.g. UBOOT_EXTLINUX_FDT:linux if linux is a label.

However, OVERRIDES doesn't contain the label globally because it's only
necessary in one task. Therefore, the OVERRIDES itself is modified
within the task. This means that the sigdata will not be told the
dependency on UBOOT_EXTLINUX_FDT:linux, because it cannot know about it.

For this reason, we need to explicitly specify which variables this task
depends on via vardeps varflag for the task.

This was done in the past, but we missed updating it during the override
syntax migration so the cache wouldn't get invalidated if someone
modifies UBOOT_EXTLINUX_FDT:linux from a configuration file or a
bbappend for example.

Let's fix this by migrating it to the new syntax.

(From OE-Core rev: 5570e49791b770271f176a4deeb5f6f1a028cb4a)

Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b4dd9d873508128adbbf5ff6cf0a3df3d2ffbcf6)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-21 05:21:36 -10:00
Siddharth Doshi
36a2a0129a libxpm: upgrade to 3.5.17
This release fixes the following CVEs:

- CVE-2023-43788
- CVE-2023-43789

(From OE-Core rev: 1475a47239d77a368bcec69f12e5a63f8bebe14f)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-21 05:21:36 -10:00
Siddharth Doshi
6da1e21e9a tiff: Security fix for CVE-2023-40745
Upstream-Status: Backport from [4fc16f649f]
CVE: CVE-2023-40745
(From OE-Core rev: f1aa2dd493c01e18ee0f534ff00523a1274f9066)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-21 05:21:36 -10:00
Hitendra Prajapati
24e9fed15a libtiff: Add fix for tiffcrop CVE-2023-1916
Add fix for tiffcrop tool CVE-2023-1916 [1].

A flaw was found in tiffcrop, a program distributed by the libtiff
package. A specially crafted tiff file can lead to an out-of-bounds
read in the extractImageSection function in tools/tiffcrop.c, resulting
in a denial of service and limited information disclosure. This issue
affects libtiff versions 4.x.

The tool is no longer part of newer libtiff distributions, hence the
fix is rejected by upstream in [2]. The backport is still applicable
to older versions of libtiff, pick the CVE fix from ubuntu 20.04 [3].

[1] https://nvd.nist.gov/vuln/detail/CVE-2023-1916
[2] https://gitlab.com/libtiff/libtiff/-/merge_requests/535
[3] https://packages.ubuntu.com/source/focal-updates/tiff

(From OE-Core rev: 4d3e7f9a157e56a4a8ffb4d16fd6401a22851307)

Signed-off-by: Marek Vasut <marex@denx.de>

Upstream-Status: Backport from 848434a81c && https://gitlab.com/libtiff/libtiff/-/merge_requests/535
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-21 05:21:36 -10:00
Armin Kuster
f550a63161 binutils: CVE-2022-48063
Source: Binutils
MR: 128800
Type: Security Fix
Disposition: Backport from https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=75393a2d54bcc40053e5262a3de9d70c5ebfbbfd
ChangeID: ab04e4ec62d054c90d94f82230adb2342ce1ee1b
Description:

Affects binutils < 2.40

(From OE-Core rev: 80a8d16a4038868469b4583404b6f73e12bae0f1)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-21 05:21:36 -10:00
Deepthi Hemraj
8391218990 binutils: Fix CVE-2022-47011
(From OE-Core rev: 5ff2e3c880705c2e920a4a61a5165810fadd7b84)

Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-21 05:21:35 -10:00
Deepthi Hemraj
bdcc4c9909 binutils: Fix CVE-2022-47008
(From OE-Core rev: 3a299d1610bf085790017569de090b0a41cf809b)

Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-21 05:21:35 -10:00