[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#991621: marked as done (unblock: util-linux/2.36.1-8)

Your message dated Fri, 30 Jul 2021 06:52:14 +0000
with message-id <E1m9MNS-00013n-RO@respighi.debian.org>
and subject line unblock util-linux
has caused the Debian Bug report #991621,
regarding unblock: util-linux/2.36.1-8
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
991621: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991621
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Package: release.debian.org
Severity: normal
User: release.debian.org@packages.debian.org
Usertags: unblock

Please unblock package util-linux

[ Reason ]
Fix for security bug CVE-2021-37600, reported as Debian bug #991619

[ Impact ]
Security issue remains open. From an util-linux perspective, I think
this is a local (=non-remote) issue.

[ Tests ]
util-linux build-time tests cover ipcs and lsipc, which are the two
affected commands.

[ Risks ]
The security bug is in a shared static .c file, used by the ipcs and
lsipc commands. I hope that ipc shmem/queue/semaphore users do not shell
out to ipcs/lsipc, and instead use some library. If this is true, only
"inspection" use cases of local admins would possibly break.


[ Checklist ]
  [x] all changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in testing

[ Other info ]
util-linux builds udebs. debian-boot@ is x-cc'ed.

unblock util-linux/2.36.1-8


diff -Nru util-linux-2.36.1/debian/changelog util-linux-2.36.1/debian/changelog
--- util-linux-2.36.1/debian/changelog	2021-02-07 14:38:19.000000000 +0000
+++ util-linux-2.36.1/debian/changelog	2021-07-28 19:09:07.000000000 +0000
@@ -1,3 +1,9 @@
+util-linux (2.36.1-8) unstable; urgency=medium
+
+  * Apply upstream patch for CVE-2021-37600 (Closes: #991619)
+
+ -- Chris Hofstaedtler <zeha@debian.org>  Wed, 28 Jul 2021 19:09:07 +0000
+
 util-linux (2.36.1-7) unstable; urgency=medium
 
   * libmount: allow --read-only for not-root users.
diff -Nru util-linux-2.36.1/debian/patches/series util-linux-2.36.1/debian/patches/series
--- util-linux-2.36.1/debian/patches/series	2021-02-07 14:38:19.000000000 +0000
+++ util-linux-2.36.1/debian/patches/series	2021-07-28 19:09:07.000000000 +0000
@@ -6,3 +6,4 @@
 debian/verbose-tests.patch
 upstream/libmount-do-not-canonicalize-ZFS-source-dataset.patch
 upstream/libmount-allow-read-only-for-not-root-users.patch
+upstream/CVE-2021-37600-sys-utils-ipcutils-be-careful-when-call-calloc.patch
diff -Nru util-linux-2.36.1/debian/patches/upstream/CVE-2021-37600-sys-utils-ipcutils-be-careful-when-call-calloc.patch util-linux-2.36.1/debian/patches/upstream/CVE-2021-37600-sys-utils-ipcutils-be-careful-when-call-calloc.patch
--- util-linux-2.36.1/debian/patches/upstream/CVE-2021-37600-sys-utils-ipcutils-be-careful-when-call-calloc.patch	1970-01-01 00:00:00.000000000 +0000
+++ util-linux-2.36.1/debian/patches/upstream/CVE-2021-37600-sys-utils-ipcutils-be-careful-when-call-calloc.patch	2021-07-28 19:09:07.000000000 +0000
@@ -0,0 +1,23 @@
+From: Karel Zak <kzak@redhat.com>
+Date: Tue, 27 Jul 2021 11:58:31 +0200
+Subject: sys-utils/ipcutils: be careful when call calloc() for uint64 nmembs
+
+Fix: https://github.com/karelzak/util-linux/issues/1395
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ sys-utils/ipcutils.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sys-utils/ipcutils.c b/sys-utils/ipcutils.c
+index 674b612..f2b04dd 100644
+--- a/sys-utils/ipcutils.c
++++ b/sys-utils/ipcutils.c
+@@ -218,7 +218,7 @@ static void get_sem_elements(struct sem_data *p)
+ {
+ 	size_t i;
+ 
+-	if (!p || !p->sem_nsems || p->sem_perm.id < 0)
++	if (!p || !p->sem_nsems || p->sem_nsems > SIZE_MAX || p->sem_perm.id < 0)
+ 		return;
+ 
+ 	p->elements = xcalloc(p->sem_nsems, sizeof(struct sem_elem));

--- End Message ---
--- Begin Message --- 
Unblocked.

--- End Message ---
Reply to: