linux/meta-openembedded.git/meta-oe/recipes-extended, branch kirkstone-next

libblockdev: fix CVE-2025-6019

2025-07-13T18:35:44+00:00

CVE-2025-6019: A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system. Refer: https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt Signed-off-by: Changqing Li Signed-off-by: Armin Kuster

canutils: use https instead of git protocol

2025-07-03T00:36:29+00:00

The git server at git.pengutronix.de no longer supports the git protocol, so switch to https. Signed-off-by: Bastian Krause Signed-off-by: Armin Kuster

libsocketcan: use https instead of git protocol

2025-07-03T00:36:26+00:00

The git server at git.pengutronix.de no longer supports the git protocol, so switch to https. Signed-off-by: Bastian Krause Signed-off-by: Armin Kuster

redis: Fix CVE-2025-21605

2025-07-03T00:30:58+00:00

Upstream-Status: Backport from https://github.com/redis/redis/commit/42fb340ce426364d64f5dccc9c2549e58f48ac6f Signed-off-by: Vijay Anusuri Signed-off-by: Armin Kuster

libmodbus: patch CVE-2024-10918

2025-03-20T13:56:59+00:00

Pick commit mentioning the bug and two follow-up commits mentioning the first commit. Tested by running the test-suite (test starter scripts were copied from scarthgap version which has them working). Signed-off-by: Peter Marko Signed-off-by: Armin Kuster

dlt-daemon: fix CVE-2023-36321

2025-03-06T14:44:32+00:00

Connected Vehicle Systems Alliance (COVESA) up to v2.18.8 wwas discovered to contain a buffer overflow via the component /shared/dlt_common.c. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-36321 Upstream patch: https://github.com/michael-methner/dlt-daemon/commit/8ac9a080bee25e67e49bd138d81c992ce7b6d899 Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster

dlt-daemon: fix CVE-2022-39836 and CVE-2022-39837

2025-03-06T14:43:54+00:00

CVE-2022-39836: An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a heap-based buffer over-read of one byte. CVE-2022-39837: An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a NULL pointer dereference. Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-39836 https://nvd.nist.gov/vuln/detail/CVE-2022-39837 Upstream patch: https://github.com/COVESA/dlt-daemon/commit/855e0017a980d2990c16f7dbf3b4983b48fac272 Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster

redis: fix CVE-2024-51741

2025-02-09T15:55:22+00:00

Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-51741 Upstream-patch: https://github.com/redis/redis/commit/15e212bf69de28d2b4585aa79cc2a40f49e4a94d Signed-off-by: Divya Chellam Signed-off-by: Armin Kuster

redis: fix CVE-2024-46981

2025-02-09T15:55:20+00:00

Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-46981 Upstream-patch: https://github.com/redis/redis/commit/e344b2b5879aa52870e6838212dfb78b7968fcbf Signed-off-by: Divya Chellam Signed-off-by: Armin Kuster

redis: fix CVE-2024-31449

2025-02-09T15:55:17+00:00

Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-31449 Upstream-patches: https://github.com/redis/redis/commit/1f7c148be2cbacf7d50aa461c58b871e87cc5ed9 https://github.com/redis/redis/commit/fe8de4313f85e0f8af2eff1f78b52cfe56fb4c71 Signed-off-by: Divya Chellam Signed-off-by: Armin Kuster