From 0ac3b6c3a6112fb50bb90c3e7d8567c1790c5017 Mon Sep 17 00:00:00 2001 From: Wang_M <815543835@qq.com> Date: Wed, 3 Sep 2025 07:07:01 +0000 Subject: [PATCH] fix CVE-2025-8067 (cherry picked from commit 43a99451619d4c50630a11f6aba5746a065c96ed) --- 0006-CVE-2025-8067.patch | 28 ++++++++++++++++++++++++++++ udisks2.spec | 6 +++++- 2 files changed, 33 insertions(+), 1 deletion(-) create mode 100644 0006-CVE-2025-8067.patch diff --git a/0006-CVE-2025-8067.patch b/0006-CVE-2025-8067.patch new file mode 100644 index 0000000..9cb1361 --- /dev/null +++ b/0006-CVE-2025-8067.patch @@ -0,0 +1,28 @@ +From 9ed2186f668c76aeb472de170d62b499d85a1915 Mon Sep 17 00:00:00 2001 +From: Marc Deslauriers +Date: Tue, 15 Jul 2025 13:34:08 -0400 +Subject: [PATCH] udiskslinuxmanager: Add lower bounds check to fd_index + +Make sure fd_index isn't negative as this can lead to an OOB read +resulting in a crash, or to exposing internal file descriptors. + +Reported by Michael Imfeld (born0monday). + +(cherry picked from commit 280b127124332c6436bc8273ef677f218b435593) +--- + src/udiskslinuxmanager.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/udiskslinuxmanager.c b/src/udiskslinuxmanager.c +index 491edb92b..317d7ce6a 100644 +--- a/src/udiskslinuxmanager.c ++++ b/src/udiskslinuxmanager.c +@@ -381,7 +381,7 @@ handle_loop_setup (UDisksManager *object, + goto out; + + fd_num = g_variant_get_handle (fd_index); +- if (fd_list == NULL || fd_num >= g_unix_fd_list_get_length (fd_list)) ++ if (fd_list == NULL || fd_num < 0 || fd_num >= g_unix_fd_list_get_length (fd_list)) + { + g_dbus_method_invocation_return_error (invocation, + UDISKS_ERROR, diff --git a/udisks2.spec b/udisks2.spec index 681055e..06df5fb 100644 --- a/udisks2.spec +++ b/udisks2.spec @@ -58,7 +58,7 @@ Name: udisks2 Summary: Disk Manager Version: 2.9.4 -Release: 8 +Release: 9 License: GPL-2.0+ and LGPL-2.0+ Group: System Environment/Libraries URL: https://github.com/storaged-project/udisks @@ -68,6 +68,7 @@ Patch2: 0002-udisksctl-Guard-object-lookup.patch Patch3: 0003-udiskslinuxmanager-use-dbus-interface-after-free.patch Patch4: 0004-fix-CVE-2025-6019-udiskslinuxfilesystemhelpers-mount-with-nosuid-nodev.patch Patch5: 0005-udisksctl-fix-segfault.patch +Patch6: 0006-CVE-2025-8067.patch BuildRequires: glib2-devel >= %{glib2_version} BuildRequires: gobject-introspection-devel >= %{gobject_introspection_version} @@ -440,6 +441,9 @@ udevadm trigger %endif %changelog +* Wed Sep 03 2025 wangmian - 2.9.4-9 +- fix cve-2025-8067 + * Fri Jul 11 2025 cenhuilin - 2.9.4-8 - udisksctl: fix segfault -- Gitee