diff --git a/debian/changelog b/debian/changelog index 56282a8..a94fb3e 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,21 @@ +util-linux (2.40.4-3deepin12) unstable; urgency=medium + + * fix(cve): CVE-2026-13595 + + -- deepin-ci-robot Tue, 21 Jul 2026 08:42:31 +0800 + +util-linux (2.40.4-3deepin11) unstable; urgency=medium + + * fix(cve): CVE-2026-3184 + + -- deepin-ci-robot Tue, 21 Jul 2026 08:37:21 +0800 + +util-linux (2.40.4-3deepin10) unstable; urgency=medium + + * fix(cve): CVE-2026-27456 + + -- deepin-ci-robot Fri, 17 Jul 2026 16:47:34 +0800 + util-linux (2.40.4-3deepin9) unstable; urgency=medium * fix CVE-2025-14104 diff --git a/debian/patches/CVE-2026-13595.patch b/debian/patches/CVE-2026-13595.patch new file mode 100644 index 0000000..ae280a8 --- /dev/null +++ b/debian/patches/CVE-2026-13595.patch @@ -0,0 +1,124 @@ +Description: CVE-2026-13595 - 安全修复 +Author: Karel Zak +Origin: https://github.com/util-linux/util-linux/commit/60ca8616ac1a223bfb5a713047a37136dd9481ef +Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-13595 +Last-Update: 2026-05-07 +--- + +diff --git a/libblkid/src/partitions/partitions.c b/libblkid/src/partitions/partitions.c +index e096cf8..506786c 100644 +--- a/libblkid/src/partitions/partitions.c ++++ b/libblkid/src/partitions/partitions.c +@@ -197,7 +197,7 @@ struct blkid_struct_partlist { + + int nparts; /* number of partitions */ + int nparts_max; /* max.number of partitions */ +- blkid_partition parts; /* array of partitions */ ++ blkid_partition *parts; /* array of pointers to partitions */ + + struct list_head l_tabs; /* list of partition tables */ + }; +@@ -356,13 +356,16 @@ static void reset_partlist(blkid_partlist ls) + free_parttables(ls); + + if (ls->next_partno) { +- /* already initialized - reset */ +- int tmp_nparts = ls->nparts_max; +- blkid_partition tmp_parts = ls->parts; ++ /* already initialized - free individually allocated partitions */ ++ int i, tmp_nparts_max = ls->nparts_max; ++ blkid_partition *tmp_parts = ls->parts; ++ ++ for (i = 0; i < ls->nparts; i++) ++ free(ls->parts[i]); + + memset(ls, 0, sizeof(struct blkid_struct_partlist)); + +- ls->nparts_max = tmp_nparts; ++ ls->nparts_max = tmp_nparts_max; + ls->parts = tmp_parts; + } + +@@ -397,6 +400,7 @@ static void partitions_free_data(blkid_probe pr __attribute__((__unused__)), + void *data) + { + blkid_partlist ls = (blkid_partlist) data; ++ int i; + + if (!ls) + return; +@@ -404,6 +408,8 @@ static void partitions_free_data(blkid_probe pr __attribute__((__unused__)), + free_parttables(ls); + + /* deallocate partitions and partlist */ ++ for (i = 0; i < ls->nparts; i++) ++ free(ls->parts[i]); + free(ls->parts); + free(ls); + } +@@ -437,15 +443,17 @@ static blkid_partition new_partition(blkid_partlist ls, blkid_parttable tab) + * generic Linux machine -- let start with 32 partitions. + */ + void *tmp = reallocarray(ls->parts, ls->nparts_max + 32, +- sizeof(struct blkid_struct_partition)); ++ sizeof(blkid_partition)); + if (!tmp) + return NULL; + ls->parts = tmp; + ls->nparts_max += 32; + } + +- par = &ls->parts[ls->nparts++]; +- memset(par, 0, sizeof(struct blkid_struct_partition)); ++ par = calloc(1, sizeof(struct blkid_struct_partition)); ++ if (!par) ++ return NULL; ++ ls->parts[ls->nparts++] = par; + + ref_parttable(tab); + par->tab = tab; +@@ -850,7 +858,7 @@ int blkid_probe_is_covered_by_pt(blkid_probe pr, + + /* check if the partition table fits into the device */ + for (i = 0; i < nparts; i++) { +- blkid_partition par = &ls->parts[i]; ++ blkid_partition par = ls->parts[i]; + + if (par->start + par->size > (pr->size >> 9)) { + DBG(LOWPROBE, ul_debug("partition #%d overflows " +@@ -862,7 +870,7 @@ int blkid_probe_is_covered_by_pt(blkid_probe pr, + + /* check if the requested area is covered by PT */ + for (i = 0; i < nparts; i++) { +- blkid_partition par = &ls->parts[i]; ++ blkid_partition par = ls->parts[i]; + + if (start >= par->start && end <= par->start + par->size) { + rc = 1; +@@ -961,7 +969,7 @@ blkid_partition blkid_partlist_get_partition(blkid_partlist ls, int n) + if (n < 0 || n >= ls->nparts) + return NULL; + +- return &ls->parts[n]; ++ return ls->parts[n]; + } + + blkid_partition blkid_partlist_get_partition_by_start(blkid_partlist ls, uint64_t start) +@@ -1073,7 +1081,7 @@ blkid_partition blkid_partlist_devno_to_partition(blkid_partlist ls, dev_t devno + * and an entry in partition table. + */ + for (i = 0; i < ls->nparts; i++) { +- blkid_partition par = &ls->parts[i]; ++ blkid_partition par = ls->parts[i]; + + if (partno != blkid_partition_get_partno(par)) + continue; +@@ -1089,7 +1097,7 @@ blkid_partition blkid_partlist_devno_to_partition(blkid_partlist ls, dev_t devno + DBG(LOWPROBE, ul_debug("searching by offset/size")); + + for (i = 0; i < ls->nparts; i++) { +- blkid_partition par = &ls->parts[i]; ++ blkid_partition par = ls->parts[i]; + + if ((uint64_t)blkid_partition_get_start(par) == start && + (uint64_t)blkid_partition_get_size(par) == size) diff --git a/debian/patches/CVE-2026-27456.patch b/debian/patches/CVE-2026-27456.patch new file mode 100644 index 0000000..42c2686 --- /dev/null +++ b/debian/patches/CVE-2026-27456.patch @@ -0,0 +1,60 @@ +Description: CVE-2026-27456 - 安全修复 +Author: Karel Zak +Origin: https://github.com/util-linux/util-linux/commit/79164668a412b71fcb1495c7d299cc5e9741fa30 +Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-27456 +Last-Update: 2026-02-19 +--- + +diff --git a/include/loopdev.h b/include/loopdev.h +index d10bf7f..0f85dd2 100644 +--- a/include/loopdev.h ++++ b/include/loopdev.h +@@ -139,7 +139,8 @@ enum { + LOOPDEV_FL_NOIOCTL = (1 << 6), + LOOPDEV_FL_DEVSUBDIR = (1 << 7), + LOOPDEV_FL_CONTROL = (1 << 8), /* system with /dev/loop-control */ +- LOOPDEV_FL_SIZELIMIT = (1 << 9) ++ LOOPDEV_FL_SIZELIMIT = (1 << 9), ++ LOOPDEV_FL_NOFOLLOW = (1 << 10) /* O_NOFOLLOW, don't follow symlinks */ + }; + + /* +diff --git a/lib/loopdev.c b/lib/loopdev.c +index c72fb2c..28fb489 100644 +--- a/lib/loopdev.c ++++ b/lib/loopdev.c +@@ -1267,7 +1267,10 @@ int loopcxt_set_backing_file(struct loopdev_cxt *lc, const char *filename) + if (!lc) + return -EINVAL; + +- lc->filename = canonicalize_path(filename); ++ if (lc->flags & LOOPDEV_FL_NOFOLLOW) ++ lc->filename = strdup(filename); ++ else ++ lc->filename = canonicalize_path(filename); + if (!lc->filename) + return -errno; + +@@ -1408,6 +1411,8 @@ int loopcxt_setup_device(struct loopdev_cxt *lc) + + if (lc->config.info.lo_flags & LO_FLAGS_DIRECT_IO) + flags |= O_DIRECT; ++ if (lc->flags & LOOPDEV_FL_NOFOLLOW) ++ flags |= O_NOFOLLOW; + + if ((file_fd = open(lc->filename, mode | flags)) < 0) { + if (mode != O_RDONLY && (errno == EROFS || errno == EACCES)) +diff --git a/libmount/src/hook_loopdev.c b/libmount/src/hook_loopdev.c +index 597b933..4df1915 100644 +--- a/libmount/src/hook_loopdev.c ++++ b/libmount/src/hook_loopdev.c +@@ -272,7 +272,8 @@ static int setup_loopdev(struct libmnt_context *cxt, + } + + DBG(LOOP, ul_debugobj(cxt, "not found; create a new loop device")); +- rc = loopcxt_init(&lc, 0); ++ rc = loopcxt_init(&lc, ++ mnt_context_is_restricted(cxt) ? LOOPDEV_FL_NOFOLLOW : 0); + if (rc) + goto done_no_deinit; + if (mnt_opt_has_value(loopopt)) { diff --git a/debian/patches/CVE-2026-3184.patch b/debian/patches/CVE-2026-3184.patch new file mode 100644 index 0000000..485323f --- /dev/null +++ b/debian/patches/CVE-2026-3184.patch @@ -0,0 +1,37 @@ +Description: CVE-2026-3184 - 安全修复 +Author: Karel Zak +Origin: https://github.com/util-linux/util-linux/commit/8b29aeb081e297e48c4c1ac53d88ae07e1331984 +Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-3184 +Last-Update: Thu Feb 19 12:20:28 2026 +0100 +--- + +diff --git a/login-utils/login.c b/login-utils/login.c +index 35e3cc3..23186c2 100644 +--- a/login-utils/login.c ++++ b/login-utils/login.c +@@ -128,6 +128,7 @@ struct login_context { + char *thishost; /* this machine */ + char *thisdomain; /* this machine's domain */ + char *hostname; /* remote machine */ ++ char *cmd_hostname; /* remote machine as specified on command line */ + char hostaddress[16]; /* remote address */ + + pid_t pid; +@@ -900,7 +901,7 @@ static pam_handle_t *init_loginpam(struct login_context *cxt) + + /* hostname & tty are either set to NULL or their correct values, + * depending on how much we know. */ +- rc = pam_set_item(pamh, PAM_RHOST, cxt->hostname); ++ rc = pam_set_item(pamh, PAM_RHOST, cxt->cmd_hostname); + if (is_pam_failure(rc)) + loginpam_err(pamh, rc); + +@@ -1235,6 +1236,8 @@ static void init_remote_info(struct login_context *cxt, char *remotehost) + + get_thishost(cxt, &domain); + ++ cxt->cmd_hostname = xstrdup(remotehost); ++ + if (domain && (p = strchr(remotehost, '.')) && + strcasecmp(p + 1, domain) == 0) + *p = '\0'; diff --git a/debian/patches/series b/debian/patches/series index c5382d8..e9dc657 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -30,3 +30,6 @@ uniontech-fix-arm-lscpu-modename.patch CVE-2025-14104-1.patch CVE-2025-14104-2.patch +CVE-2026-27456.patch +CVE-2026-3184.patch +CVE-2026-13595.patch