From 5716f444d418b9b11cfdaf32d1bf9b9ce3023d68 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Rohl=C3=ADnek?= Date: Mon, 6 Jul 2026 13:39:24 +0200 Subject: [PATCH] fix(storage/fatfs): record non-applicable runZero 2026 CVEs in SBOM Document the three runZero "Seven FatFs bugs" CVEs that require no source change in this component, so vulnerability scanners have their disposition: - CVE-2026-6684: GPT partition-scan loop DoS. Already fixed upstream in R0.16, where test_gpt_header() caps the partition-entry count at 128. - CVE-2026-6686: read of uninitialized clusters after f_lseek() past EOF. Longstanding, behavioral; not a memory-safety defect and zero-filling every extended cluster is prohibitively costly on flash. - CVE-2026-6688: long-filename overflow in downstream callers. Not exposed in ESP-IDF; vfs_fat.c uses bounded copies and fname is bounded by FF_MAX_LFN. Reference: https://www.runzero.com/blog/fatfs-bugs/ --- components/fatfs/sbom.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/components/fatfs/sbom.yml b/components/fatfs/sbom.yml index 0fee17ed5bd..6f99c066ad8 100644 --- a/components/fatfs/sbom.yml +++ b/components/fatfs/sbom.yml @@ -12,3 +12,9 @@ cve-exclude-list: reason: Unsigned-subtraction wrap in the dirty-cache refill check. Patched by requiring the cached sector to lie within the direct-I/O range in both f_write() and f_read(). - cve: CVE-2026-6687 reason: exFAT label-length overflow in f_getlabel(). Patched by clamping XDIR_NumLabel to the 11-unit exFAT label maximum. + - cve: CVE-2026-6684 + reason: GPT partition-scan loop DoS. Already fixed upstream in FatFs R0.16, where test_gpt_header() caps the partition-entry count at 128. + - cve: CVE-2026-6686 + reason: Read of uninitialized clusters after f_lseek() extends a file past EOF. Longstanding FatFs behavior; not a memory-safety defect and zero-filling every extended cluster is prohibitively costly on flash. Applications sharing media across trust boundaries must zero regions before exposing them. + - cve: CVE-2026-6688 + reason: Long-filename overflow in downstream callers copying FILINFO.fname. Not exposed in ESP-IDF; vfs_fat.c uses bounded snprintf/strlcpy and fname is bounded in-library by FF_MAX_LFN.