linux/poky.git/meta/recipes-connectivity, branch yocto-4.0.29

avahi: fix CVE-2024-52615

2025-08-08T13:30:55+00:00

CVE-2024-52615: A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-52615] [https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g] Upstream patches: [https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942] (From OE-Core rev: 7bd9fee6d654326ea921b51113de99f793e11545) Signed-off-by: Zhang Peng Signed-off-by: Steve Sakoman

ofono: fix CVE-2023-4235

2025-07-18T15:32:26+00:00

A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_deliver_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for this memcpy length in decode_submit(), but it was forgotten in decode_deliver_report(). (From OE-Core rev: 3a3519324ec390044ff9f97c0f32027782699124) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

ofono: fix CVE-2023-4232

2025-07-18T15:32:26+00:00

A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_status_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for this memcpy length in decode_submit(), but it was forgotten in decode_status_report(). (From OE-Core rev: 02005c81a55930d9f57d44674cdc5eb6171c8c76) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

openssl: fix CVE-2024-41996

2025-07-18T15:32:26+00:00

Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key. Reference: https://github.com/openssl/openssl/pull/25088 (From OE-Core rev: 635fc639a13a6b28cac5c67cff23b7f4477bc41c) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

openssl: upgrade 3.0.16 -> 3.0.17

2025-07-18T15:32:26+00:00

Release information: https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-3016-and-openssl-3017-1-jul-2025 (From OE-Core rev: 678f4f98f145c887a220b846babc9648ea6ff974) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

nfs-utils: don't use signals to shut down nfs server.

2025-06-04T16:06:31+00:00

Since Linux v2.4 it has been possible to stop all NFS server by running rpc.nfsd 0 i.e. by requesting that zero threads be running. This is preferred as it doesn't risk killing some other process which happens to be called "nfsd". Since Linux v6.6 - and other stable kernels to which Commit: 390390240145 ("nfsd: don't allow nfsd threads to be signalled.") has been backported - sending a signal no longer works to stop nfs server threads. This patch changes the nfsserver script to use "rpc.nfsd 0" to stop server threads. (From OE-Core rev: 415e73d53e5342f3f6ff6acd521ded2df3fbca1f) Signed-off-by: NeilBrown Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 7b09ad289a36) Signed-off-by: Haixiao Yan Signed-off-by: Steve Sakoman

connman :fix CVE-2025-32366

2025-05-28T15:46:32+00:00

In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen) and memcpy(response+offset,*end,*rdlen) without a check for whether the sum of *end and *rdlen exceeds max. Consequently, *rdlen may be larger than the amount of remaining packet data in the current state of parsing. Values of stack memory locations may be sent over the network in a response. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-32366 Upstream-patch: https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=8d3be0285f1d4667bfe85dba555c663eb3d704b4 (From OE-Core rev: 1b9156124b4a07e0e3e0ab09e87d654eae6c7b4e) Signed-off-by: Praveen Kumar Signed-off-by: Steve Sakoman

openssh: Fix CVE-2025-32728

2025-05-28T15:46:32+00:00

Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/fc86875e6acb36401dfc1dfb6b628a9d1460f367] (From OE-Core rev: 68413e1413eb87254d68f30920574b0e2c766782) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

connman :fix CVE-2025-32743

2025-05-14T13:38:21+00:00

In ConnMan through 1.44, the lookup string in ns_resolv in dnsproxy.c can be NULL or an empty string when the TC (Truncated) bit is set in a DNS response. This allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code, because those lookup values lead to incorrect length calculations and incorrect memcpy operations. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-32743 Upstream-patch: https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=d90b911f6760959bdf1393c39fe8d1118315490f (From OE-Core rev: ece0fb01bf28fa114f0a6e479491b4b6f565c80c) Signed-off-by: Praveen Kumar Signed-off-by: Steve Sakoman

ppp: patch CVE-2024-58250

2025-05-02T15:12:41+00:00

Backport patch to remove vulnerable component. This is a breaking change, but there will be no other fix for this CVE as upstream did the deletion without providing a fix first. If someone really needs this feature, which the commit message describes as deprecated, bbappend with patch removal is possible. License-Update: passprompt plugin removed (From OE-Core rev: d04a2b5f4899845429e1c5893535f5df1221fcbf) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman