mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-09 16:01:54 -09:00
5541178b12
Thanks to OpenEmbedded Community for providing the patches:
https://github.com/openembedded/meta-openembedded/blob/scarthgap/meta-python/recipes-devtools/python/python3-cbor2/
- CVE-2025-64076:
Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the
decode_definite_long_string() function of the C extension decoder
(source/decoder.c): (1) Integer Underflow Leading to Out-of-Bounds
Read (CWE-191, CWE-125): An incorrect variable reference and missing
state reset in the chunk processing loop causes buffer_length to not
be reset to zero after UTF-8 character consumption. This results in
subsequent chunk_length calculations producing negative values (e.g.,
chunk_length = 65536 - buffer_length), which are passed as signed
integers to the read() method, potentially triggering unlimited read
operations and resource exhaustion. (2) Memory Leak via Missing
Reference Count Release (CWE-401): The main processing loop fails to
release Python object references (Py_DECREF) for chunk objects
allocated in each iteration. For CBOR strings longer than 65536 bytes,
this causes cumulative memory leaks proportional to the payload size,
enabling memory exhaustion attacks through repeated processing of
large CBOR payloads. Both vulnerabilities can be exploited remotely
without authentication by sending specially-crafted CBOR data
containing definite-length text strings with multi-byte UTF-8
characters positioned at 65536-byte chunk boundaries. Successful
exploitation results in denial of service through process crashes
(CBORDecodeEOF exceptions) or memory exhaustion. The vulnerabilities
affect all applications using cbor2's C extension to process untrusted
CBOR data, including web APIs, IoT data collectors, and message queue
processors. Fixed in commit 851473490281f82d82560b2368284ef33cf6e8f9
pushed with released version 5.7.1.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-64076
- CVE-2025-68131:
cbor2 provides encoding and decoding for the Concise Binary Object
Representation (CBOR) serialization format. Starting in version 3.0.0
and prior to version 5.8.0, whhen a CBORDecoder instance is reused
across multiple decode operations, values marked with the shareable
tag (28) persist in memory and can be accessed by subsequent CBOR
messages using the sharedref tag (29). This allows an attacker-
controlled message to read data from previously decoded messages if
the decoder is reused across trust boundaries. Version 5.8.0 patches
the issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-68131
- CVE-2026-26209:
cbor2 provides encoding and decoding for the Concise Binary Object
Representation (CBOR) serialization format. Versions prior to 5.9.0
are vulnerable to a Denial of Service (DoS) attack caused by
uncontrolled recursion when decoding deeply nested CBOR structures.
This vulnerability affects both the pure Python implementation and the
C extension `_cbor2`. The C extension relies on Python's internal
recursion limits `Py_EnterRecursiveCall` rather than a data-driven
depth limit, meaning it still raises `RecursionError` and crashes the
worker process when the limit is hit. While the library handles
moderate nesting levels, it lacks a hard depth limit. An attacker can
supply a crafted CBOR payload containing approximately 100,000 nested
arrays `0x81`. When `cbor2.loads()` attempts to parse this, it hits
the Python interpreter's maximum recursion depth or exhausts the
stack, causing the process to crash with a `RecursionError`. Because
the library does not enforce its own limits, it allows an external
attacker to exhaust the host application's stack resource. In many web
application servers (e.g., Gunicorn, Uvicorn) or task queues (Celery),
an unhandled `RecursionError` terminates the worker process
immediately. By sending a stream of these small (<100KB) malicious
packets, an attacker can repeatedly crash worker processes, resulting
in a complete Denial of Service for the application. Version 5.9.0
patches the issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-26209
(cherry picked from commit b676a4f51b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot is a simple, efficient and easy-to-use tool to generate embedded Linux systems through cross-compilation. The documentation can be found in docs/manual. You can generate a text document with 'make manual-text' and read output/docs/manual/manual.text. Online documentation can be found at https://buildroot.org/docs.html To build and use the buildroot stuff, do the following: 1) run 'make menuconfig' 2) select the target architecture and the packages you wish to compile 3) run 'make' 4) wait while it compiles 5) find the kernel, bootloader, root filesystem, etc. in output/images You do not need to be root to build or run buildroot. Have fun! Buildroot comes with a basic configuration for a number of boards. Run 'make list-defconfigs' to view the list of provided configurations. Please feed suggestions, bug reports, insults, and bribes back to the buildroot mailing list: buildroot@buildroot.org You can also find us on #buildroot on OFTC IRC. If you would like to contribute patches, please read https://buildroot.org/manual.html#submitting-patches