mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-08 00:20:38 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/systemd: add patch for CVE-2026-40226

Browse Source 
This backports the fix for the following vulnerability:
- CVE-2026-40226:
    In nspawn in systemd 233 through 259 before 260, an escape-to-host
    action can occur via a crafted optional config file.
    https://www.cve.org/CVERecord?id=CVE-2026-40226

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit f6e0ad3858)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Titouan Christophe
2026-04-20 17:45:59 +02:00
committed by Thomas Perale
parent 55e8d6f420
commit 290f86e05e
2 changed files with 93 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

90
package/systemd/0001-Fix-CVE-2026-40226.patch Normal file
View File

@@ -0,0 +1,90 @@
From b3131f63747db53ad76a9aab2d21da1ce9d59b9d Mon Sep 17 00:00:00 2001
From: Titouan Christophe <titouan.christophe@mind.be>
Date: Mon, 20 Apr 2026 12:04:45 +0200
Subject: [PATCH] Fix CVE-2026-40226
This is the concatenation of the 2 upstream commits:
===============================================================================
[1/2] nspawn: apply BindUser/Ephemeral from settings file only if trusted
Originally reported on yeswehack.com as:
YWH-PGM9780-116
Follow-up for 2f8930449079403b26c9164b8eeac78d5af2c8df
Follow-up for a2f577fca0be79b23f61f033229b64884e7d840a
Upstream: https://github.com/systemd/systemd/commit/61bceb1bff4b1f9c126b18dc971ca3e6d8c71c40
===============================================================================
[2/2] nspawn: normalize pivot_root paths
Originally reported on yeswehack.com as:
YWH-PGM9780-116
Follow-up for b53ede699cdc5233041a22591f18863fb3fe2672
Upstream: https://github.com/systemd/systemd/commit/7b85f5498a958e5bb660c703b8f4a71cceed3373
===============================================================================
CVE: CVE-2026-34155
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
---
src/nspawn/nspawn-mount.c | 4 +++-
src/nspawn/nspawn.c | 18 ++++++++++++++----
2 files changed, 17 insertions(+), 5 deletions(-)
diff --git a/src/nspawn/nspawn-mount.c b/src/nspawn/nspawn-mount.c
index 874d54e734..cba69cf0a9 100644
--- a/src/nspawn/nspawn-mount.c
+++ b/src/nspawn/nspawn-mount.c
@@ -1311,7 +1311,9 @@ int pivot_root_parse(char **pivot_root_new, char **pivot_root_old, const char *s
if (!path_is_absolute(root_new))
return -EINVAL;
- if (root_old && !path_is_absolute(root_old))
+ if (!path_is_normalized(root_new))
+ return -EINVAL;
+ if (root_old && (!path_is_absolute(root_old) || !path_is_normalized(root_old)))
return -EINVAL;
free_and_replace(*pivot_root_new, root_new);
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 459caa7c58..8692c771ba 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -4626,8 +4626,13 @@ static int merge_settings(Settings *settings, const char *path) {
}
if ((arg_settings_mask & SETTING_EPHEMERAL) == 0 &&
- settings->ephemeral >= 0)
- arg_ephemeral = settings->ephemeral;
+ settings->ephemeral >= 0) {
+
+ if (!arg_settings_trusted)
+ log_warning("Ignoring ephemeral setting, file %s is not trusted.", path);
+ else
+ arg_ephemeral = settings->ephemeral;
+ }
if ((arg_settings_mask & SETTING_DIRECTORY) == 0 &&
settings->root) {
@@ -4795,8 +4800,13 @@ static int merge_settings(Settings *settings, const char *path) {
}
if ((arg_settings_mask & SETTING_BIND_USER) == 0 &&
- !strv_isempty(settings->bind_user))
- strv_free_and_replace(arg_bind_user, settings->bind_user);
+ !strv_isempty(settings->bind_user)) {
+
+ if (!arg_settings_trusted)
+ log_warning("Ignoring bind user setting, file %s is not trusted.", path);
+ else
+ strv_free_and_replace(arg_bind_user, settings->bind_user);
+ }
if ((arg_settings_mask & SETTING_NOTIFY_READY) == 0 &&
settings->notify_ready >= 0)
--
2.53.0

3
package/systemd/systemd.mk
View File

@@ -63,6 +63,9 @@ SYSTEMD_SELINUX_MODULES = systemd udev xdg
SYSTEMD_PROVIDES = udev
# 0001-Fix-CVE-2026-40226.patch
SYSTEMD_IGNORE_CVES += CVE-2026-34155
SYSTEMD_CONF_OPTS += \
-Dcreate-log-dirs=false \
-Ddbus=disabled \