- CVE-2026-53614
The SUID binary /usr/bin/mount from util-linux trusts the
environment variable LIBMOUNT_FORCE_MOUNT2 via a raw getenv() call
in libmount/src/hook_mount.c. An unprivileged user can set
LIBMOUNT_FORCE_MOUNT2=always to force the mount process to use the
legacy (non-atomic) bind mount path instead of the secure new mount
API path.
In the legacy path, a bind mount is performed in two separate
syscalls: first mount(src, tgt, MS_BIND) which exposes the source
directory without security flags, then mount(tgt,
MS_REMOUNT|MS_BIND|MS_NOSUID|MS_NOEXEC|MS_NODEV) which applies the
flags. Between these two syscalls, a brief window exists where the
bind-mounted directory is visible without nosuid/noexec protection.
A concurrent process can execute a SUID binary from the bind target
during this window.
For more information, see:
- https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx
- cc81bbcec5
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-53613
A TOCTOU vulnerability exists in the SUID binary /usr/bin/mount from
util-linux. When processing restricted (non-root) mount requests,
libmount validates the mount target against /etc/fstab entries and
checks user permissions, but the actual mount()/move_mount() syscall
re-resolves the target pathname. An attacker can use
renameat2(RENAME_EXCHANGE) to atomically swap an ancestor directory
of the mount target between the permission check and the mount
syscall, redirecting an authorized user-directory mount to any
root-owned path (e.g., /etc/sudoers.d).
For more information, see:
- https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g
- b639bf5c42
- 0b010025a0
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-53612
A TOCTOU (Time-of-Check-Time-of-Use) vulnerability exists in the
SUID binary /usr/bin/mount from util-linux. The hook_owner.c
post-mount hook performs path-based chmod() and lchown() operations
on the mount target after mount() has completed, without verifying
that the target path still resolves to the same filesystem object.
An unprivileged local user can exploit this race window using
renameat2(RENAME_EXCHANGE) to redirect the chmod()/lchown() to an
arbitrary path, achieving arbitrary permission/ownership
modification on any file or directory.
For more information, see:
- https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh
- d0c5adaeb3
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2025-14104:
A flaw was found in util-linux. This vulnerability allows a heap
buffer overread when processing 256-byte usernames, specifically
within the `setpwnam()` function, affecting SUID (Set User ID) login-
utils utilities writing to the password database.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-14104
- aaa9e718c8
- 9a36d77012
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
As indicated in the release notes:
https://github.com/cesanta/mongoose/releases/tag/7.22
This release includes a substantial number of security fixes,
reflecting increased use of AI-powered security tools and valuable
contributions from the security research community.
Please note that many of the resolved issues have not yet been assigned
CVE identifiers. The assignment process is underway, and these release
notes will be updated as additional CVEs become available.
Given the large number of security fixes included in that release, bump the
version for Buildroot LTS instead of applying individual patches
Along with the version bump:
- Remove patch for a security issue fixed by the version bump
- Update license hash following the update of the copyright year in
1f9e1a38b5
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 8fe41d5506)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot commit f89ca996b6 fixed the
build of linux-pam with musl in 2020 but did not remove the restric-
tions in place for login/runuser/su which were added earlier with
these commits:
login (2015): 25ecd24579
runuser (2017): 09860f354a
su (2017): c6488923fb
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 91d356ee7e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This fixes the following vulnerability:
- CVE-2026-11940:
tarfile.extractall() with the 'data' or 'tar' filter could be
bypassed by a crafted archive where a hardlink references a symlink
stored at a deeper name than the hardlink itself. The extraction
fallback validated the symlink at it's archived location but
recreated it at the hardlink's shallower path, letting a relative
target the filter judged contained escape the destination directory.
This allowed a malicious tar archive to create a symlink pointing
outside the destination, enabling out-of-destination file reads or
writes. This was an incomplete fix of CVE-2025-4330.
https://www.cve.org/CVERecord?id=CVE-2026-11940
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 1a0164ac81)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Libepoxy is a library for handling OpenGL function pointer management.
It has backends for egl/glx, which may at one point have been mandatory
to enable, but the library now builds with none of the above enabled
features, as seen below.
libepoxy 1.5.10
User defined options
Cross files : /home/joseph/br-test-pkg/arm-aarch64/build/libepoxy-1.5.10//buildroot-build/cross-compilation.conf
b_pie : false
b_staticpic : true
buildtype : release
build.cmake_prefix_path: /home/joseph/br-test-pkg/arm-aarch64/host/lib/cmake
default_library : shared
docs : false
egl : no
glx : no
libdir : lib
build.pkg_config_path : /home/joseph/br-test-pkg/arm-aarch64/host/lib/pkgconfig
prefix : /usr
strip : false
tests : false
x11 : false
Removing these dependencies allows for some applications that require it
as a build dependency, but otherwise can run headless or without GL, to
build and function, using other graphics APIs or display pipelines.
Weston, for example, can still use Vulkan and DRM when linked to
libepoxy without GL/EGL/X11 support.
Acked-by: Arnout Vanecappelle <arnout@rnout.be>
Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit cd2583ca0a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Commit e8c54ffb3d ("utils/generate-cyclonedx: generate vcs
externalReferences for source repos") added externalReferences to the source
code of packages.
This unfortunately causes issues with packages (in br2-external) fetching
from git using the scp-like syntax, E.G.:
FOO_SITE_METHOD = git
FOO_SITE = git@github.com:<project>/<repo>.git
Which ends up in the SBOM as:
[
{
"type": "vcs",
"url": "git@github.com:<project>/<repo>.git",
"comment": "git repository"
}
]
This (correctly) causes Dependency track to reject the SBOM import with:
{
"status": 400,
"title": "The uploaded BOM is invalid",
"detail": "Schema validation failed",
"errors": [
"$.components[2].externalReferences[0].url: does not match the iri-reference pattern must be a valid RFC 3987 IRI-reference",
"$.components[2].externalReferences[0].url: does not match the iri-reference pattern must be a valid RFC 3987 IRI-reference",
"$.components[2].externalReferences[0].url: does not match the regex pattern ^urn:cdx:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/[1-9][0-9]*$",
]
}
The CycloneDX spec indeed requires a URI:
The URI (URL or URN) to the external reference. External references are
URIs and therefore can accept any URL scheme including https (RFC-7230),
mailto (RFC-2368), tel (RFC-3966), and dns (RFC-4501)
https://cyclonedx.org/docs/1.6/json/#metadata_tools_oneOf_i0_components_items_externalReferences_items_url
The user@host:project/repo.git is a git-specific shorthand for a git-over-ssh URL. From man git-clone:
Git supports ssh, git, http, and https protocols (in addition, ftp and ftps
can be used for fetching, but this is inefficient and deprecated; do not use
them).
The native transport (i.e. git:// URL) does no authentication and should
be used with caution on unsecured networks.
The following syntaxes may be used with them:
• ssh://[user@]host.xz[:port]/path/to/repo.git/
• git://host.xz[:port]/path/to/repo.git/
• http[s]://host.xz[:port]/path/to/repo.git/
• ftp[s]://host.xz[:port]/path/to/repo.git/
An alternative scp-like syntax may also be used with the ssh protocol:
• [user@]host.xz:path/to/repo.git/
So convert the scp-like syntax to ssh:// URLs in parse_uris() for spec
compliance.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ebcfdb8b0a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
There are a number of runtime tests that checks that a command fails as
expected, so add an assertRunNotOk() similar to the existing assertRunOk()
to handle that instead of open coding it everywhere.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 03783de150)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
* Explicitly set shell type. Shellcheck doesn't know OpenRC, but the
script as such is POSIX shell.
* Override warnings not applicable in context.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 3e2cc4e46f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
With the action function as the last command in the script its return
code automatically becomes that of the script, and without explicit
exit shellcheck does not complain about unused functions.
Also wait for the process to stop in "stop", and simplify restart.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit b4884a2937)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
If sending the stop signal failed for whatever reason, waiting for an
existing PID file to disappear is likely to block indefinitely.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Tested-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit b2d84525f9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The exit status of the last command automatically becomes the exit
status of the script. And if there is no explicit exit shellcheck
accepts unused functions (here: start/stop/... called via variable).
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Tested-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 118ffb20b5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This fixes the following vulnerability:
- CVE-2026-9669:
bz2.BZ2Decompressor objects could be reused after a decompression
error. If an application caught the resulting OSError and retried with
the same decompressor, crafted input could cause the decompressor to
resume from an invalid internal state and perform out-of-bounds writes
to a stack buffer. This could crash the process when processing
untrusted data.
https://www.cve.org/CVERecord?id=CVE-2026-9669
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 5cd9188c3e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
