From patchwork Sun Sep 13 17:12:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10219 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4hjZcG1g0nz3xTX for ; Sun, 13 Sep 2026 17:13:18 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hjZcF6tZsz6ys for ; Sun, 13 Sep 2026 17:13:17 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hjZbl4M9sz37dx for ; Sun, 13 Sep 2026 17:12:51 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hjZbg3yJMz37HQ for ; Sun, 13 Sep 2026 17:12:47 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hjZbb6FsHz6kr; Sun, 13 Sep 2026 17:12:43 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1789319564; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jNPfU3YS4Nf3VwsVEi/VGfEWIHILihkPv3ZJVfIAn4M=; b=khAWcAo+4uvb4pPgkiLPLepLjBeaiehNHG70PO/bnVSWSahPLbTyIen9LRhBWtFUuWgMqf w/2G/wHSGGyh8CCg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1789319564; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jNPfU3YS4Nf3VwsVEi/VGfEWIHILihkPv3ZJVfIAn4M=; b=RGX7EekiR2k9zYEP/8Qzjd2660sjIJdxZTWNOiUQlbjmrAENZBPRfTLek9P/t3oXovrDym txe4l5jKXopbYMYsDw6Jmk4GW0mmIc9pO6TElCMz7tx0mt8YRTNio1LSzPLOTb3RuAQ3Ky SDO2q45E0OxYY0dDts2mn2Nfhb2Kfc9H2FlAgxB7QPS4PZMH1097Ogf3orM79X/rMg7ssX 7SBf2fDUnwcG9ThLA52/7BEhLyyo/1vjn4JzbABiOyYxBOPDqGft3DFTninFl3aCB9HVQp hLS9en7OKeA87OcbvcsSdn5mxXuxgsIS6ueKIQ7RwT2lz+gUsTTggXeRsrRcvQ== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] util-linux: Update to version 2.42.3 Date: Sun, 13 Sep 2026 19:12:28 +0200 Message-ID: <20260913171230.3920551-29-adolf.belka@ipfire.org> In-Reply-To: <20260913171230.3920551-1-adolf.belka@ipfire.org> References: <20260913171230.3920551-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 2.42 to 2.42.3 - No change in any rootfiles - 5 CVE fixes in 2.42.3 - Changelog 2.42.3 Security fixes: CVE-2026-53613 - mount(8) TOCTOU race on target path. The SUID mount does not pin the mount target directory, allowing a race between path resolution and the actual mount syscall. A local attacker can swap an ancestor directory component between these steps to redirect a mount to an arbitrary location. Reported-by: Xinyao Hu CVE-2026-53612 - mount(8) TOCTOU race on post-mount owner/mode change. The X-mount.owner, X-mount.group, and X-mount.mode options use path-based lchown()/chmod() after mounting. An attacker can swap the target between mount and the ownership/mode change to gain control of arbitrary files. Reported-by: Xinyao Hu CVE-2026-53614 - mount(8) SUID bypass via LIBMOUNT_FORCE_MOUNT2. The environment variable LIBMOUNT_FORCE_MOUNT2 is not filtered via safe_getenv() in SUID context. A local attacker can force the legacy mount(2) code path, which uses a two-step bind+remount or propagation sequence with a window where security flags (nosuid, noexec, ...) are not yet applied. Reported-by: Xinyao Hu CVE-2026-27456 - mount(8) TOCTOU symlink attack via loop device (follow-up). The v2.42.1 fix used O_NOFOLLOW which only rejects symlinks at the last path component. This update uses openat2(RESOLVE_NO_SYMLINKS) to reject symlinks at any component of the backing file path. CVE-2026-13595 - libblkid: use-after-free in nested partition probing. The partitions list stores partitions in a contiguous array grown by reallocarray(). When the array is reallocated, all existing blkid_partition pointers become dangling. Reported-by: Thai Duong Backward incompatible changes: The security fixes above harden the SUID mount(8) against TOCTOU attacks. As a side effect, the following features are restricted for non-root users: X-mount.subdir= Restricted to Linux >= 6.15 for non-root users. The old-kernel implementation uses namespace unsharing and string-based move_mount() which is unsafe (TOCTOU). The safe detached subdir open is available only on Linux >= 6.15. X-mount.nocanonicalize Ignored for non-root users. Paths must always be canonicalized in restricted mode to ensure safe target resolution before fd pinning. LIBMOUNT_FORCE_MOUNT2= Ignored in SUID context (filtered via safe_getenv()). Additionally, multi-step mount(2) sequences (bind+remount and propagation changes) are refused for non-root users in the legacy mount path because the two-step approach has a window where security flags (nosuid, noexec, ...) are not yet applied. The new mount API (fsopen/fsconfig/fsmount) handles this atomically and is not affected. Changes: asciidoctor: - fix encoding error for non-ASCII translations (by Karel Zak) docs: - setpriv improve EXAMPLES section (by Karel Zak) fdisk-list: - fix memory leak when partition returns empty string (by Leefancy) - fix memory leak in partition listing (by Leefancy) fsck.minix: - bound namelen guessed in get_dirsize (by aizu-m) hexdump: - fix buffer overflow in color_cond() (by Karel Zak) include/mountutils.h: - fix LSMT_ROOT definition (by Shubham Chakraborty) lib: - (pidutils.c) allow zero and negative numbers for PIDs (by Christian Goeschel Ndjomouo) libblkid: - fix use-after-free in nested partition probing (by Karel Zak) libfdisk: - fix use of on-disk sizeof_partition_entry in GPT (by Karel Zak) lib/fileutils: - add ul_open_no_symlinks() (by Karel Zak) libmount: - add mount ID verification and man page TOCTOU note (by Karel Zak) - use fd_target in hook_idmap for move_mount() (by Karel Zak) - restrict X-mount.subdir for non-root to Linux >= 6.15 (by Karel Zak) - use fd-based fchownat/chmod in hook_owner (by Karel Zak) - ignore X-mount.nocanonicalize for restricted users (by Karel Zak) - add fd_target to context for TOCTOU prevention (by Karel Zak) - fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy mount path (by Karel Zak) - detect fanotify queue overflow in monitor (by Karel Zak) - fix subvolid buffer overflow in get_btrfs_fs_root (by aizu-m) loopdev: - use openat2(RESOLVE_NO_SYMLINKS) for backing file (by Karel Zak) lscpu: - free cputype ISA string (by Zephyr Li) lslogins: - bound lastlog2 tty/host copy to destination size (by aizu-m) nsenter: - Fix invalid fd check in enter_namespaces (by Vladimir Riabchun) pam_lastlog2: - fix libpam linking in autotools build (by Karel Zak) readprofile: - replace popen() with fork/exec for .gz map files (by Karel Zak) tests: - (hexdump) use arrays for OPTS and ADDRFMT (by Karel Zak) - mkswap file-existing subtest add explicit page size (by Karel Zak) 2.42.1 getty: - Always call chdir after chroot (by Tobias Stoeckmann) autotools: - Fix setpriv build with econf (by Tobias Stoeckmann) bits: - use getline() to avoid stdin input truncation (by WanBingjiang) - prevent unsigned integer underflow and long-lived loop (by Christian Goeschel Ndjomouo) build: - (copyfilerange) include syscall header check for fallback (by Christian Goeschel Ndjomouo) - Fix --disable-copyfilerange (by Tobias Stoeckmann) build-sys: - drop libcommon_shells from binaries that only need ul_default_shell (by Karel Zak) cfdisk: - fix memory leak of original_layout table (by Karel Zak) chrt: - Fix confusing error messages when priority argument is required (by Rong Zhang) - Only show current scheduling policy when pid is given (by Rong Zhang) - pass correct integer types to printf (by Thomas Weißschuh) - (man) explain which kernel config options are needed for SCHED_EXT (by Christian Goeschel Ndjomouo) ci: - use GCC 15 (by Thomas Weißschuh) - run 'make checkusage' only for autotools build (by Thomas Weißschuh) CI: - replace ntp with ntpsec (by Karel Zak) column: - fix missing out-of-bounds check in table reordering (by Christian Goeschel Ndjomouo) copyfilerange: - (man) fix swapped offsets in command example (by Štěpán Němec) dmesg: - fix out-of-bounds read when parsing malformed kmsg file (by WanBingjiang) docs: - clarify wipefs --force description for partition-table signatures (by AndyLau-SOC) eject: - tolerate ILLEGAL REQUEST on ALLOW_MEDIUM_REMOVAL (by Alessandro Ratti) fallocate: - (man) mention supported file systems for --insert-range (by Christian Goeschel Ndjomouo) fdisk: - fix trailing whitespace in user reply from readline completion (by Leonid Znamenok) fincore: - (tests) fix tmpfs detection for out-of-tree builds (by Leonid Znamenok) flock: - re-enable the initial shell selection logic (by Christian Goeschel Ndjomouo) fsck.minix(man): - Fix asciidoctor table (by Tobias Stoeckmann) hardlink: - avoid format string error for dev_t (by Thomas Weißschuh) include: - (fileutils.h) add fallback for the copy_file_range syscall (by Christian Goeschel Ndjomouo) ipcutils: - use memset explicitly to fill bpf_attr with zero (by Masatake YAMATO) irqtop: - add vw_printw() fallback for slang builds (by Karel Zak) irqtop/lsirq: - Handle EOF in get_irqinfo (by Tobias Stoeckmann) last: - fix phantom detection for unset loginuid and X11 sessions (by Karel Zak) lib: - split ul_default_shell() from shells.c into default_shell.c (by Karel Zak) - (cpuset.c) dont calculate allocation size for 0 ncpus (by Christian Goeschel Ndjomouo) libblkid: - Fix typo in probe_zfs (by Tobias Stoeckmann) - Fix type access in zfs_extract_guid_name (by Tobias Stoeckmann) - Fix debug OOB read in zfs_process_value (by Tobias Stoeckmann) - Fix parse_dev debug output (by Tobias Stoeckmann) - Ignore secondary LUKS2 header in blkid_do_safeprobe() (by silentcreek) - reiserfs add block size validation for reiser4 (by Karel Zak) - erofs validate blkszbits before checksum calculation (by Karel Zak) - exfs avoid 32-bit overflow in rextsize validation (by Karel Zak) - solaris use 64-bit for partition offset calculations (by Karel Zak) - bsd use 64-bit for partition offset calculations (by Karel Zak) - mac use 64-bit for partition offset calculations (by Karel Zak) - dos use 64-bit for partition offset calculations (by Karel Zak) - udf avoid 32-bit overflow in offset calculations (by Karel Zak) - vfat avoid 32-bit overflow in offset calculations (by Karel Zak) - ubi fix probe return values (by Karel Zak) - f2fs tighten log_blocksize validation (by Karel Zak) - nilfs fix byte order and block size validation (by Karel Zak) - gpt fix wiper offset to use sector size (by Karel Zak) - udf cap descriptor sequence iteration count (by Karel Zak) - bcache add missing NULL check (by Karel Zak) - bsd read enough data to cover disklabel struct (by Karel Zak) - befs improve bounds checking in B+ tree search (by Karel Zak) - ntfs improve integer overflow checks (by Karel Zak) - introduce sysfs_devno_is_dm_hidden() for pre-open check (by Zdenek Kabelac) libcommon: - move pidfd-utils.c to Linux-only sources (by Karel Zak) liblastlog2: - (tests) avoid log spam (by Thomas Weißschuh) - wait on busy SQLite connections (by WanBingjiang) libmount: - return btrfs rootfs from get_btrfs_fs_root() (by Karel Zak) - use match_source for mountinfo comparison (by Karel Zak) lib/pidutils, lib/pidfd-utils: - use _() instead of N_() in err() calls (by Karel Zak) lib/pwdutils: - fix compiler warning [-Werror=maybe-uninitialized] (by Karel Zak) libsmartcols: - drop superfluous call yo yylex_init() (by Thomas Weißschuh) - (tests) fix failure reporting in filter test (by Thomas Weißschuh) - (tests) fix filter test name (by Thomas Weißschuh) - Ignore -Wsign-compare in filter-scanner.l (by Thomas Weißschuh) libuser: - fix misleading error message (by Christian Goeschel Ndjomouo) login: - Clean up PAM resources on error path (by Tobias Stoeckmann) login-utils/auth: - Drop pam_setcred (by Tobias Stoeckmann) lsblk(man): - Add COLORS section (by Tobias Stoeckmann) lsclocks: - add missing newline character in option description (by Christian Goeschel Ndjomouo) lscpu(man): - Move options into correct section (by Tobias Stoeckmann) lsfd: - use memset explicitly to fill bpf_attr with zero (by Masatake YAMATO) meson: - check slang headers only when slang library is found (by Karel Zak) - rename logindefs_c to lib_common_logindefs (by Karel Zak) - split shells.c out of lib_common into lib_common_shells (by Karel Zak) - respect build-dmesg for test_dmesg (by Thomas Weißschuh) - test for statx::stx_mnt_id in sys/stat.h (by Thomas Weißschuh) mkfs.cramfs: - Consider -i only once (by Tobias Stoeckmann) - Add -p padding only once (by Tobias Stoeckmann) - Improve file size check (by Tobias Stoeckmann) mkswap: - Fix --file chmod(2) check when file exists (by Johannes Wüller) more: - align MORE_SHELL_LINES semantics with less(1) (by Karel Zak, Christian Goeschel Ndjomouo) newgrp: - Correctly handle getline error (by Tobias Stoeckmann) nsenter: - Fix AT_HANDLE_FID on musl (by Aleksi Hannula) pidfd-utils: - Fix pidfd_get_inode declaration (by Tobias Stoeckmann) po: - merge changes (by Karel Zak) - update ro.po (from translationproject.org) (by Remus-Gabriel Chelu) - update pt.po (from translationproject.org) (by Pedro Albuquerque) - update pl.po (from translationproject.org) (by Jakub Bogusz) - update ja.po (from translationproject.org) (by YOSHIDA Hideki) - update et.po (from translationproject.org) (by Toomas Soome) - update cs.po (from translationproject.org) (by Petr Písař) po-man: - merge changes (by Karel Zak) - update ro.po (from translationproject.org) (by Remus-Gabriel Chelu) po-man/po4a: - Add missing manual pages (by Tobias Stoeckmann) readprofile: - (man) clarify not designed for privilege-elevation use (by Karel Zak) script: - fix "--" separator when used as option argument (by Karel Zak) - fix command and command_norm memory leaks (by Karel Zak) - fix backward compatibility for options after non-option args (by Karel Zak) scriptreplay(man): - Add right arrow documentation (by koraynilay) strutils: - fix printf formats (by Thomas Weißschuh) su: - Clean up PAM resources on all error paths (by Tobias Stoeckmann) - fix grammar on man page (by Christian Goeschel Ndjomouo) su-common: - revert "su pass arguments after to shell" (by Christian Goeschel Ndjomouo) terminal-colors.d: - (man) re-apply improvements lost in merge (by Benno Schulenberg) tests: - (lsfd/mkfds-udp*) make UDPLite related test cases skippable (by Masatake YAMATO) - (lsfd/option-inet{,-udp}) make UDPLite related test case skippable (by Masatake YAMATO) - (lsfd) add a function checking the availability of UDPLite socket (by Masatake YAMATO) - (lsfd::mkfds-udp) fix confusion between UDP and UDPLite (by Masatake YAMATO) - (test_mkfds) use memset explicitly to fill bpf_attr with zero (by Masatake YAMATO) - (ipcs/limits) skip when /proc/sys/kernel is read-only (by Karel Zak) - (bits) add --width tests for invalid values (by Christian Goeschel Ndjomouo) - add btrfs RAID is-mounted test for libmount (by Karel Zak) tests/functions.sh: - consider '+' for metadata in kernel version parsing (by Christian Goeschel Ndjomouo) tools: - (compare-buildsys) suppress common lines in diff output (by Karel Zak) tools/git-tp-sync: - update po4a.cfg language list on sync (by Karel Zak) write: - cleanup indentation and whitespace (by Karel Zak) - use mem2strcpy() for utmp strings (by Karel Zak) - always use utmp as fallback (by Karel Zak) write, mesg: - add S_ISCHR() check for terminal device paths (by Karel Zak) Misc: - Remove obsolete comment since 2015 (by Julien Nabet) - Link against libcommon_logindefs.la and libcommon_shells.la (by Stanislav Brabec) - Fix build with libeconf (by Stanislav Brabec) - [po-man] Add missing languages to po4a.cfg (by Mario Blättermann) Signed-off-by: Adolf Belka --- lfs/util-linux | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/util-linux b/lfs/util-linux index cf551f9c2..6b1ac6f67 100644 --- a/lfs/util-linux +++ b/lfs/util-linux @@ -24,7 +24,7 @@ include Config -VER = 2.42 +VER = 2.42.3 # https://www.kernel.org/pub/linux/utils/util-linux/ THISAPP = util-linux-$(VER) @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 531b79bbec272cf1007c55ff4042b5e1b14bcc0dc098e54e4b76ea2e70c785fc763f96686ad8cea5ea9c0f7190794f4d828b7742e3aa18a0c3ef506d34e9d465 +$(DL_FILE)_BLAKE2 = fcb9fb7f522cabebb4813c78d56115d4516371922f9a4c8e2036d3622ed427d6c0897bca7a60b2176297ff08b6a4f28b85d09509462d3aac4cd73b863402eed6 install : $(TARGET)