From c94cd9a934f2c64d16d78656610ba5d2e88a1d69 Mon Sep 17 00:00:00 2001 From: Vojtech Trefny Date: Thu, 31 Aug 2017 15:33:07 +0200 Subject: [PATCH 1/5] New udisks upstream release 2.7.3 --- .gitignore | 1 + sources | 2 +- udisks2.spec | 6 +++++- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index a252eeb..a168a4b 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ /udisks-2.7.0.tar.bz2 /udisks-2.7.1.tar.bz2 /udisks-2.7.2.tar.bz2 +/udisks-2.7.3.tar.bz2 diff --git a/sources b/sources index d403470..3e15e98 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (udisks-2.7.2.tar.bz2) = cfaa234340e9f1dacc50bc455a834d53e27d6f42036951384e3603c374517b049db6e13ebbcf6767cc346d56860e3058a406102872a5c5cbbec9edb39c86c4a1 +SHA512 (udisks-2.7.3.tar.bz2) = 106174cbe717aca837028f93c50c1c93d528b66d94769dc36f0d35fc4071325658feb6020005f10691165a3908eda1aa830c3a4fd65d506f662f3c61331b1bae diff --git a/udisks2.spec b/udisks2.spec index 87fca2a..46a433f 100644 --- a/udisks2.spec +++ b/udisks2.spec @@ -14,7 +14,7 @@ Name: udisks2 Summary: Disk Manager -Version: 2.7.2 +Version: 2.7.3 Release: 1%{?dist} License: GPLv2+ Group: System Environment/Libraries @@ -277,6 +277,7 @@ udevadm trigger %dir %{_libdir}/udisks2 %dir %{_libdir}/udisks2/modules +%dir %{_libexecdir}/udisks2 %{_libexecdir}/udisks2/udisksd %{_bindir}/udisksctl @@ -342,6 +343,9 @@ udevadm trigger %endif %changelog +* Thu Aug 31 2017 Vojtech Trefny - 2.7.3-1 +- Version 2.7.3 + * Thu Aug 03 2017 Vojtech Trefny - 2.7.2-1 - Version 2.7.2 From f29bae8ad468d53a1582f3fbfc0e521959eae777 Mon Sep 17 00:00:00 2001 From: Vojtech Trefny Date: Wed, 1 Nov 2017 12:20:28 +0100 Subject: [PATCH 2/5] New udisks upstream release 2.7.4 --- .gitignore | 1 + sources | 2 +- udisks2.spec | 11 +++++++++-- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index a168a4b..68463bb 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,4 @@ /udisks-2.7.1.tar.bz2 /udisks-2.7.2.tar.bz2 /udisks-2.7.3.tar.bz2 +/udisks-2.7.4.tar.bz2 diff --git a/sources b/sources index 3e15e98..fb26d8d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (udisks-2.7.3.tar.bz2) = 106174cbe717aca837028f93c50c1c93d528b66d94769dc36f0d35fc4071325658feb6020005f10691165a3908eda1aa830c3a4fd65d506f662f3c61331b1bae +SHA512 (udisks-2.7.4.tar.bz2) = 4e8f1aa6e5fbcceb3c4aae0fa567b154b892b024cb0bd7273622445070088656ab7b15427533aefa53932ee29cfabd5b9d86bd5aef04e872093fbb1278c0997d diff --git a/udisks2.spec b/udisks2.spec index 46a433f..166ebd3 100644 --- a/udisks2.spec +++ b/udisks2.spec @@ -5,7 +5,7 @@ %global libatasmart_version 0.17 %global dbus_version 1.4.0 %global with_gtk_doc 1 -%global libblockdev_version 2.10 +%global libblockdev_version 2.14 %define is_fedora 0%{?rhel} == 0 %define is_git %(git show > /dev/null 2>&1 && echo 1 || echo 0) @@ -14,7 +14,7 @@ Name: udisks2 Summary: Disk Manager -Version: 2.7.3 +Version: 2.7.4 Release: 1%{?dist} License: GPLv2+ Group: System Environment/Libraries @@ -234,14 +234,17 @@ chrpath --delete %{buildroot}/%{_libexecdir}/udisks2/udisksd %post -n %{name} %systemd_post udisks2.service +%systemd_post clean-mount-point@.service udevadm control --reload udevadm trigger %preun -n %{name} %systemd_preun udisks2.service +%systemd_preun clean-mount-point@.service %postun -n %{name} %systemd_postun_with_restart udisks2.service +%systemd_postun clean-mount-point@.service %post -n lib%{name} -p /sbin/ldconfig @@ -271,6 +274,7 @@ udevadm trigger %{_sysconfdir}/dbus-1/system.d/org.freedesktop.UDisks2.conf %{_datadir}/bash-completion/completions/udisksctl %{_unitdir}/udisks2.service +%{_unitdir}/clean-mount-point@.service %{_udevrulesdir}/80-udisks2.rules %{_sbindir}/umount.udisks2 @@ -343,6 +347,9 @@ udevadm trigger %endif %changelog +* Wed Nov 01 2017 Vojtech Trefny - 2.7.4-1 +- Version 2.7.4 + * Thu Aug 31 2017 Vojtech Trefny - 2.7.3-1 - Version 2.7.3 From dc0cdcdc8f5edbe4648dc98128d42c07d1f33993 Mon Sep 17 00:00:00 2001 From: Vojtech Trefny Date: Mon, 4 Dec 2017 12:30:28 +0100 Subject: [PATCH 3/5] New udisks upstream release 2.7.5 --- .gitignore | 1 + sources | 2 +- udisks2.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 68463bb..20725fe 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ /udisks-2.7.2.tar.bz2 /udisks-2.7.3.tar.bz2 /udisks-2.7.4.tar.bz2 +/udisks-2.7.5.tar.bz2 diff --git a/sources b/sources index fb26d8d..613c11e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (udisks-2.7.4.tar.bz2) = 4e8f1aa6e5fbcceb3c4aae0fa567b154b892b024cb0bd7273622445070088656ab7b15427533aefa53932ee29cfabd5b9d86bd5aef04e872093fbb1278c0997d +SHA512 (udisks-2.7.5.tar.bz2) = 3af72b87acb8e540b229e58e2176ac87de831ef402f4825b6e9ee163a8d34e921a38909f45e685cd2a9931d08aaa22285ba2f6a811cb8265237201f0b5e36310 diff --git a/udisks2.spec b/udisks2.spec index 166ebd3..a74da76 100644 --- a/udisks2.spec +++ b/udisks2.spec @@ -14,7 +14,7 @@ Name: udisks2 Summary: Disk Manager -Version: 2.7.4 +Version: 2.7.5 Release: 1%{?dist} License: GPLv2+ Group: System Environment/Libraries @@ -347,6 +347,9 @@ udevadm trigger %endif %changelog +* Mon Dec 04 2017 Vojtech Trefny - 2.7.5-1 +- Version 2.7.5 + * Wed Nov 01 2017 Vojtech Trefny - 2.7.4-1 - Version 2.7.4 From 87f3a8f090aa0f21f62aa3b0ce51270509f9b5c3 Mon Sep 17 00:00:00 2001 From: Vojtech Trefny Date: Thu, 8 Feb 2018 15:40:10 +0100 Subject: [PATCH 4/5] New udisks upstream release 2.7.6 --- .gitignore | 1 + sources | 2 +- udisks2.spec | 5 ++++- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 20725fe..7e47219 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,4 @@ /udisks-2.7.3.tar.bz2 /udisks-2.7.4.tar.bz2 /udisks-2.7.5.tar.bz2 +/udisks-2.7.6.tar.bz2 diff --git a/sources b/sources index 613c11e..a1039d7 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (udisks-2.7.5.tar.bz2) = 3af72b87acb8e540b229e58e2176ac87de831ef402f4825b6e9ee163a8d34e921a38909f45e685cd2a9931d08aaa22285ba2f6a811cb8265237201f0b5e36310 +SHA512 (udisks-2.7.6.tar.bz2) = 29df238c6648700e8a18659ecb099baf4cdd811540856a5298439a88cffeee40ae8deb2fc312375913333dbe92fbc55131389f958a8b80efd5b2fdb5b3f11ec7 diff --git a/udisks2.spec b/udisks2.spec index a74da76..f1af4cd 100644 --- a/udisks2.spec +++ b/udisks2.spec @@ -14,7 +14,7 @@ Name: udisks2 Summary: Disk Manager -Version: 2.7.5 +Version: 2.7.6 Release: 1%{?dist} License: GPLv2+ Group: System Environment/Libraries @@ -40,6 +40,7 @@ BuildRequires: libblockdev-swap-devel >= %{libblockdev_version} BuildRequires: libblockdev-mdraid-devel >= %{libblockdev_version} BuildRequires: libblockdev-fs-devel >= %{libblockdev_version} BuildRequires: libblockdev-crypto-devel >= %{libblockdev_version} +BuildRequires: libmount-devel Requires: libblockdev >= %{libblockdev_version} Requires: libblockdev-part >= %{libblockdev_version} @@ -70,6 +71,8 @@ Requires: dosfstools Requires: gdisk # For ejecting removable disks Requires: eject +# For utab monitor +Requires: libmount Requires: lib%{name}%{?_isa} = %{version}-%{release} From 4a53f248c113e73bcd22cbd623eeb7347b93fc30 Mon Sep 17 00:00:00 2001 From: Vojtech Trefny Date: Wed, 26 Sep 2018 10:41:56 +0200 Subject: [PATCH 5/5] Fix string format vulnerability --- 0001-Fix-string-format-vulnerability.patch | 35 ++++++++++++++++++++++ udisks2.spec | 10 ++++++- 2 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 0001-Fix-string-format-vulnerability.patch diff --git a/0001-Fix-string-format-vulnerability.patch b/0001-Fix-string-format-vulnerability.patch new file mode 100644 index 0000000..3cda298 --- /dev/null +++ b/0001-Fix-string-format-vulnerability.patch @@ -0,0 +1,35 @@ +From 0ffc76e7fa0cb668d3d2daed13f233f3e6e5c624 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Kai=20L=C3=BCke?= +Date: Tue, 18 Sep 2018 13:12:14 +0200 +Subject: [PATCH] Fix string format vulnerability + +If the message in g_log_structured itself +contained format sequences like %d or %n they +were applied again, leading to leaked stack contents +and possibly memory corruption. It can be triggered +e.g. by a volume label containing format sequences. + +Print the message argument itself into a "%s" string +to avoid intepreting format sequences. + +https://github.com/storaged-project/udisks/issues/578 +--- + src/udiskslogging.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/udiskslogging.c b/src/udiskslogging.c +index ab49fcbf..47a3af23 100644 +--- a/src/udiskslogging.c ++++ b/src/udiskslogging.c +@@ -60,7 +60,7 @@ udisks_log (UDisksLogLevel level, + + #if GLIB_CHECK_VERSION(2, 50, 0) + g_log_structured ("udisks", (GLogLevelFlags) level, +- "MESSAGE", message, "THREAD_ID", "%d", (gint) syscall (SYS_gettid), ++ "MESSAGE", "%s", message, "THREAD_ID", "%d", (gint) syscall (SYS_gettid), + "CODE_FUNC", function, "CODE_FILE", location); + #else + g_log ("udisks", level, "[%d]: %s [%s, %s()]", (gint) syscall (SYS_gettid), message, location, function); +-- +2.17.1 + diff --git a/udisks2.spec b/udisks2.spec index f1af4cd..10d6596 100644 --- a/udisks2.spec +++ b/udisks2.spec @@ -15,11 +15,12 @@ Name: udisks2 Summary: Disk Manager Version: 2.7.6 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ Group: System Environment/Libraries URL: https://github.com/storaged-project/udisks Source0: https://github.com/storaged-project/udisks/releases/download/udisks-%{version}/udisks-%{version}.tar.bz2 +Patch0: 0001-Fix-string-format-vulnerability.patch BuildRequires: glib2-devel >= %{glib2_version} BuildRequires: gobject-introspection-devel >= %{gobject_introspection_version} @@ -203,6 +204,7 @@ This package contains module for ZRAM configuration. %prep %setup -q -n udisks-%{version} +%patch0 -p1 %build autoreconf -ivf @@ -350,6 +352,12 @@ udevadm trigger %endif %changelog +* Wed Sep 26 2018 Vojtech Trefny - 2.7.6-2 +- Fix string format vulnerability + +* Thu Feb 08 2018 Vojtech Trefny - 2.7.6-1 +- Version 2.7.6 + * Mon Dec 04 2017 Vojtech Trefny - 2.7.5-1 - Version 2.7.5