diff --git a/files/security/cve-2018-17336.patch b/files/security/cve-2018-17336.patch new file mode 100644 index 0000000..25ac696 --- /dev/null +++ b/files/security/cve-2018-17336.patch @@ -0,0 +1,32 @@ +From e369a9b4b08e9373c814c05328b366c938284eb5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Kai=20L=C3=BCke?= +Date: Tue, 18 Sep 2018 13:12:14 +0200 +Subject: [PATCH] Fix string format vulnerability + +If the message in g_log_structured itself +contained format sequences like %d or %n they +were applied again, leading to leaked stack contents +and possibly memory corruption. It can be triggered +e.g. by a volume label containing format sequences. + +Print the message argument itself into a "%s" string +to avoid intepreting format sequences. + +https://github.com/storaged-project/udisks/issues/578 +--- + src/udiskslogging.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/udiskslogging.c b/src/udiskslogging.c +index ab49fcbf..47a3af23 100644 +--- a/src/udiskslogging.c ++++ b/src/udiskslogging.c +@@ -60,7 +60,7 @@ udisks_log (UDisksLogLevel level, + + #if GLIB_CHECK_VERSION(2, 50, 0) + g_log_structured ("udisks", (GLogLevelFlags) level, +- "MESSAGE", message, "THREAD_ID", "%d", (gint) syscall (SYS_gettid), ++ "MESSAGE", "%s", message, "THREAD_ID", "%d", (gint) syscall (SYS_gettid), + "CODE_FUNC", function, "CODE_FILE", location); + #else + g_log ("udisks", level, "[%d]: %s [%s, %s()]", (gint) syscall (SYS_gettid), message, location, function); diff --git a/package.yml b/package.yml index a478557..690bcb7 100644 --- a/package.yml +++ b/package.yml @@ -1,42 +1,43 @@ name : udisks version : 2.7.6 -release : 17 +release : 18 source : - https://github.com/storaged-project/udisks/releases/download/udisks-2.7.6/udisks-2.7.6.tar.bz2 : 512da29063de1cd4ecbfd9182d4faea0aff40835eaac69bc9f08e20ec56d16fe -license : GPL-2.0 +license : GPL-2.0-or-later component : desktop.core summary : Daemon, tools and libraries to access disks and storage devices description: | The UDisks package provides a daemon, tools and libraries to access and manipulate disks and storage devices. builddeps : - pkgconfig(blockdev) - pkgconfig(devmapper) - pkgconfig(libatasmart) - acl-devel - attr-devel rundeps : - cryptsetup - gptfdisk - mdadm setup : | + %patch -p1 < $pkgfiles/security/cve-2018-17336.patch %configure --disable-static \ --enable-introspection \ --with-udevdir=%libdir%/udev \ --with-modprobedir=%libdir%/modprobe.d \ --disable-man \ --enable-lvm2 \ --enable-lvmcache build : | %make install : | %make_install # support keyfile backend in udisks install -D -m 00644 $pkgfiles/udisks2.keyrules $installdir/usr/share/polkit-1/rules.d/udisks2.keyrules # Do not ship /var/lib in package rm -rfv $installdir/var install -D -m 00644 $pkgfiles/udisks2.tmpfiles $installdir/%libdir%/tmpfiles.d/udisks2.conf check : | %make check diff --git a/pspec_x86_64.xml b/pspec_x86_64.xml index 4605d86..9df554f 100644 --- a/pspec_x86_64.xml +++ b/pspec_x86_64.xml @@ -1,77 +1,289 @@ udisks - Pierre-Yves - pyu@riseup.net + Peter O'Connor + peter@solus-project.com - GPL-2.0 + GPL-2.0-or-later desktop.core Daemon, tools and libraries to access disks and storage devices The UDisks package provides a daemon, tools and libraries to access and manipulate disks and storage devices. https://solus-project.com/sources/README.Solus udisks Daemon, tools and libraries to access disks and storage devices The UDisks package provides a daemon, tools and libraries to access and manipulate disks and storage devices. desktop.core /etc/dbus-1/system.d/org.freedesktop.UDisks2.conf /etc/udisks2/udisks2.conf - /usr/bin + /usr/bin/udisksctl /usr/lib/systemd/system/clean-mount-point@.service /usr/lib/systemd/system/udisks2.service /usr/lib64/girepository-1.0/UDisks-2.0.typelib - /usr/lib64/lib*.so.* + /usr/lib64/libudisks2.so.0 + /usr/lib64/libudisks2.so.0.0.0 /usr/lib64/tmpfiles.d/udisks2.conf /usr/lib64/udev/rules.d/80-udisks2.rules /usr/lib64/udisks/udisks2/udisksd /usr/lib64/udisks2/modules/libudisks2_lvm2.so - /usr/sbin + /usr/sbin/umount.udisks2 /usr/share/bash-completion/completions/udisksctl /usr/share/dbus-1/system-services/org.freedesktop.UDisks2.service /usr/share/gir-1.0/UDisks-2.0.gir - /usr/share/locale + /usr/share/locale/ar/LC_MESSAGES/udisks2.mo + /usr/share/locale/as/LC_MESSAGES/udisks2.mo + /usr/share/locale/az/LC_MESSAGES/udisks2.mo + /usr/share/locale/bg/LC_MESSAGES/udisks2.mo + /usr/share/locale/bn_IN/LC_MESSAGES/udisks2.mo + /usr/share/locale/ca/LC_MESSAGES/udisks2.mo + /usr/share/locale/ca@valencia/LC_MESSAGES/udisks2.mo + /usr/share/locale/cs/LC_MESSAGES/udisks2.mo + /usr/share/locale/cy/LC_MESSAGES/udisks2.mo + /usr/share/locale/da/LC_MESSAGES/udisks2.mo + /usr/share/locale/de/LC_MESSAGES/udisks2.mo + /usr/share/locale/el/LC_MESSAGES/udisks2.mo + /usr/share/locale/en_GB/LC_MESSAGES/udisks2.mo + /usr/share/locale/eo/LC_MESSAGES/udisks2.mo + /usr/share/locale/es/LC_MESSAGES/udisks2.mo + /usr/share/locale/et/LC_MESSAGES/udisks2.mo + /usr/share/locale/eu/LC_MESSAGES/udisks2.mo + /usr/share/locale/fa/LC_MESSAGES/udisks2.mo + /usr/share/locale/fi/LC_MESSAGES/udisks2.mo + /usr/share/locale/fo/LC_MESSAGES/udisks2.mo + /usr/share/locale/fr/LC_MESSAGES/udisks2.mo + /usr/share/locale/ga/LC_MESSAGES/udisks2.mo + /usr/share/locale/gl/LC_MESSAGES/udisks2.mo + /usr/share/locale/gu/LC_MESSAGES/udisks2.mo + /usr/share/locale/he/LC_MESSAGES/udisks2.mo + /usr/share/locale/hi/LC_MESSAGES/udisks2.mo + /usr/share/locale/hr/LC_MESSAGES/udisks2.mo + /usr/share/locale/hu/LC_MESSAGES/udisks2.mo + /usr/share/locale/ia/LC_MESSAGES/udisks2.mo + /usr/share/locale/id/LC_MESSAGES/udisks2.mo + /usr/share/locale/it/LC_MESSAGES/udisks2.mo + /usr/share/locale/ja/LC_MESSAGES/udisks2.mo + /usr/share/locale/ka/LC_MESSAGES/udisks2.mo + /usr/share/locale/kk/LC_MESSAGES/udisks2.mo + /usr/share/locale/kn/LC_MESSAGES/udisks2.mo + /usr/share/locale/ko/LC_MESSAGES/udisks2.mo + /usr/share/locale/lt/LC_MESSAGES/udisks2.mo + /usr/share/locale/lv/LC_MESSAGES/udisks2.mo + /usr/share/locale/ml/LC_MESSAGES/udisks2.mo + /usr/share/locale/mr/LC_MESSAGES/udisks2.mo + /usr/share/locale/ms/LC_MESSAGES/udisks2.mo + /usr/share/locale/nb/LC_MESSAGES/udisks2.mo + /usr/share/locale/nl/LC_MESSAGES/udisks2.mo + /usr/share/locale/nn/LC_MESSAGES/udisks2.mo + /usr/share/locale/oc/LC_MESSAGES/udisks2.mo + /usr/share/locale/or/LC_MESSAGES/udisks2.mo + /usr/share/locale/pa/LC_MESSAGES/udisks2.mo + /usr/share/locale/pl/LC_MESSAGES/udisks2.mo + /usr/share/locale/pt/LC_MESSAGES/udisks2.mo + /usr/share/locale/pt_BR/LC_MESSAGES/udisks2.mo + /usr/share/locale/ro/LC_MESSAGES/udisks2.mo + /usr/share/locale/ru/LC_MESSAGES/udisks2.mo + /usr/share/locale/sk/LC_MESSAGES/udisks2.mo + /usr/share/locale/sl/LC_MESSAGES/udisks2.mo + /usr/share/locale/sq/LC_MESSAGES/udisks2.mo + /usr/share/locale/sr/LC_MESSAGES/udisks2.mo + /usr/share/locale/sr@latin/LC_MESSAGES/udisks2.mo + /usr/share/locale/sv/LC_MESSAGES/udisks2.mo + /usr/share/locale/ta/LC_MESSAGES/udisks2.mo + /usr/share/locale/te/LC_MESSAGES/udisks2.mo + /usr/share/locale/th/LC_MESSAGES/udisks2.mo + /usr/share/locale/tr/LC_MESSAGES/udisks2.mo + /usr/share/locale/uk/LC_MESSAGES/udisks2.mo + /usr/share/locale/vi/LC_MESSAGES/udisks2.mo + /usr/share/locale/wa/LC_MESSAGES/udisks2.mo + /usr/share/locale/zh_CN/LC_MESSAGES/udisks2.mo + /usr/share/locale/zh_HK/LC_MESSAGES/udisks2.mo + /usr/share/locale/zh_TW/LC_MESSAGES/udisks2.mo /usr/share/polkit-1/actions/org.freedesktop.UDisks2.lvm2.policy /usr/share/polkit-1/actions/org.freedesktop.UDisks2.policy /usr/share/polkit-1/rules.d/udisks2.keyrules udisks-devel Development files for udisks The UDisks package provides a daemon, tools and libraries to access and manipulate disks and storage devices. programming.devel - udisks + udisks - /usr/include/ - /usr/lib64/lib*.so - /usr/lib64/pkgconfig/*.pc + /usr/include/udisks2/udisks/udisks-generated.h + /usr/include/udisks2/udisks/udisks.h + /usr/include/udisks2/udisks/udisksclient.h + /usr/include/udisks2/udisks/udisksenums.h + /usr/include/udisks2/udisks/udisksenumtypes.h + /usr/include/udisks2/udisks/udiskserror.h + /usr/include/udisks2/udisks/udisksmoduleiface.h + /usr/include/udisks2/udisks/udisksmoduleifacetypes.h + /usr/include/udisks2/udisks/udisksmoduleobject.h + /usr/include/udisks2/udisks/udisksobjectinfo.h + /usr/include/udisks2/udisks/udiskstypes.h + /usr/include/udisks2/udisks/udisksversion.h + /usr/lib64/libudisks2.so + /usr/lib64/pkgconfig/udisks2.pc udisks-docs Documentation for udisks The UDisks package provides a daemon, tools and libraries to access and manipulate disks and storage devices. programming.docs - /usr/share/gtk-doc/html/ + /usr/share/gtk-doc/html/udisks2/UDisksBaseJob.html + /usr/share/gtk-doc/html/udisks2/UDisksBlock.html + /usr/share/gtk-doc/html/udisks2/UDisksBlockBcache.html + /usr/share/gtk-doc/html/udisks2/UDisksBlockZRAM.html + /usr/share/gtk-doc/html/udisks2/UDisksClient.html + /usr/share/gtk-doc/html/udisks2/UDisksCrypttabMonitor.html + /usr/share/gtk-doc/html/udisks2/UDisksDaemon.html + /usr/share/gtk-doc/html/udisks2/UDisksDrive.html + /usr/share/gtk-doc/html/udisks2/UDisksDriveAta.html + /usr/share/gtk-doc/html/udisks2/UDisksEncrypted.html + /usr/share/gtk-doc/html/udisks2/UDisksFilesystem.html + /usr/share/gtk-doc/html/udisks2/UDisksFilesystemBTRFS.html + /usr/share/gtk-doc/html/udisks2/UDisksFstabMonitor.html + /usr/share/gtk-doc/html/udisks2/UDisksISCSISession.html + /usr/share/gtk-doc/html/udisks2/UDisksJob.html + /usr/share/gtk-doc/html/udisks2/UDisksLinuxBlock.html + /usr/share/gtk-doc/html/udisks2/UDisksLinuxBlockObject.html + /usr/share/gtk-doc/html/udisks2/UDisksLinuxDevice.html + /usr/share/gtk-doc/html/udisks2/UDisksLinuxDrive.html + /usr/share/gtk-doc/html/udisks2/UDisksLinuxDriveAta.html + /usr/share/gtk-doc/html/udisks2/UDisksLinuxDriveObject.html + /usr/share/gtk-doc/html/udisks2/UDisksLinuxEncrypted.html + /usr/share/gtk-doc/html/udisks2/UDisksLinuxFilesystem.html + /usr/share/gtk-doc/html/udisks2/UDisksLinuxLoop.html + /usr/share/gtk-doc/html/udisks2/UDisksLinuxMDRaid.html + /usr/share/gtk-doc/html/udisks2/UDisksLinuxMDRaidObject.html + /usr/share/gtk-doc/html/udisks2/UDisksLinuxManager.html + /usr/share/gtk-doc/html/udisks2/UDisksLinuxPartition.html + /usr/share/gtk-doc/html/udisks2/UDisksLinuxPartitionTable.html + /usr/share/gtk-doc/html/udisks2/UDisksLinuxProvider.html + /usr/share/gtk-doc/html/udisks2/UDisksLinuxSwapspace.html + /usr/share/gtk-doc/html/udisks2/UDisksLoop.html + /usr/share/gtk-doc/html/udisks2/UDisksMDRaid.html + /usr/share/gtk-doc/html/udisks2/UDisksManager.html + /usr/share/gtk-doc/html/udisks2/UDisksManagerBTRFS.html + /usr/share/gtk-doc/html/udisks2/UDisksManagerBcache.html + /usr/share/gtk-doc/html/udisks2/UDisksManagerISCSIInitiator.html + /usr/share/gtk-doc/html/udisks2/UDisksManagerLVM2.html + /usr/share/gtk-doc/html/udisks2/UDisksManagerZRAM.html + /usr/share/gtk-doc/html/udisks2/UDisksMountMonitor.html + /usr/share/gtk-doc/html/udisks2/UDisksObject.html + /usr/share/gtk-doc/html/udisks2/UDisksObjectInfo.html + /usr/share/gtk-doc/html/udisks2/UDisksObjectManagerClient.html + /usr/share/gtk-doc/html/udisks2/UDisksPartition.html + /usr/share/gtk-doc/html/udisks2/UDisksPartitionTable.html + /usr/share/gtk-doc/html/udisks2/UDisksProvider.html + /usr/share/gtk-doc/html/udisks2/UDisksSimpleJob.html + /usr/share/gtk-doc/html/udisks2/UDisksSpawnedJob.html + /usr/share/gtk-doc/html/udisks2/UDisksState.html + /usr/share/gtk-doc/html/udisks2/UDisksSwapspace.html + /usr/share/gtk-doc/html/udisks2/UDisksThreadedJob.html + /usr/share/gtk-doc/html/udisks2/annotation-glossary.html + /usr/share/gtk-doc/html/udisks2/api-index.html + /usr/share/gtk-doc/html/udisks2/ch02.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Block.Bcache.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Block.LVM2.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Block.ZRAM.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Block.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Drive.Ata.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Drive.LSM.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Drive.LsmLocal.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Drive.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Encrypted.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Filesystem.BTRFS.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Filesystem.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.ISCSI.Session.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Job.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.LogicalVolume.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Loop.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.MDRaid.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Manager.BTRFS.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Manager.Bcache.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Manager.ISCSI.Initiator.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Manager.LSM.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Manager.LVM2.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Manager.ZRAM.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Manager.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Partition.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.PartitionTable.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.PhysicalVolume.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.Swapspace.html + /usr/share/gtk-doc/html/udisks2/gdbus-org.freedesktop.UDisks2.VolumeGroup.html + /usr/share/gtk-doc/html/udisks2/gio-hierarchy.html + /usr/share/gtk-doc/html/udisks2/home.png + /usr/share/gtk-doc/html/udisks2/index.html + /usr/share/gtk-doc/html/udisks2/left-insensitive.png + /usr/share/gtk-doc/html/udisks2/left.png + /usr/share/gtk-doc/html/udisks2/overview.html + /usr/share/gtk-doc/html/udisks2/ref-daemon-block-devices.html + /usr/share/gtk-doc/html/udisks2/ref-daemon-core.html + /usr/share/gtk-doc/html/udisks2/ref-daemon-drives.html + /usr/share/gtk-doc/html/udisks2/ref-daemon-jobs.html + /usr/share/gtk-doc/html/udisks2/ref-daemon-linux-types.html + /usr/share/gtk-doc/html/udisks2/ref-daemon-mdraid.html + /usr/share/gtk-doc/html/udisks2/ref-daemon-monitoring.html + /usr/share/gtk-doc/html/udisks2/ref-daemon.html + /usr/share/gtk-doc/html/udisks2/ref-dbus-block-devices.html + /usr/share/gtk-doc/html/udisks2/ref-dbus-drives.html + /usr/share/gtk-doc/html/udisks2/ref-dbus-jobs.html + /usr/share/gtk-doc/html/udisks2/ref-dbus-manager-well-known-object.html + /usr/share/gtk-doc/html/udisks2/ref-dbus-md-raid.html + /usr/share/gtk-doc/html/udisks2/ref-dbus-overview.html + /usr/share/gtk-doc/html/udisks2/ref-dbus-udisks2-well-known-object.html + /usr/share/gtk-doc/html/udisks2/ref-dbus.html + /usr/share/gtk-doc/html/udisks2/ref-iscsi-session.html + /usr/share/gtk-doc/html/udisks2/ref-library-generated.html + /usr/share/gtk-doc/html/udisks2/ref-library.html + /usr/share/gtk-doc/html/udisks2/right-insensitive.png + /usr/share/gtk-doc/html/udisks2/right.png + /usr/share/gtk-doc/html/udisks2/style.css + /usr/share/gtk-doc/html/udisks2/udiskd.8.html + /usr/share/gtk-doc/html/udisks2/udisks-polkit-actions.html + /usr/share/gtk-doc/html/udisks2/udisks-std-options.html + /usr/share/gtk-doc/html/udisks2/udisks.8.html + /usr/share/gtk-doc/html/udisks2/udisks2-ATA-commands.html + /usr/share/gtk-doc/html/udisks2/udisks2-Logging.html + /usr/share/gtk-doc/html/udisks2/udisks2-UDisksBlockLVM2.html + /usr/share/gtk-doc/html/udisks2/udisks2-UDisksDriveLSM.html + /usr/share/gtk-doc/html/udisks2/udisks2-UDisksDriveLsmLocal.html + /usr/share/gtk-doc/html/udisks2/udisks2-UDisksError.html + /usr/share/gtk-doc/html/udisks2/udisks2-UDisksLogicalVolume.html + /usr/share/gtk-doc/html/udisks2/udisks2-UDisksManagerLSM.html + /usr/share/gtk-doc/html/udisks2/udisks2-UDisksModuleManager.html + /usr/share/gtk-doc/html/udisks2/udisks2-UDisksPhysicalVolume.html + /usr/share/gtk-doc/html/udisks2/udisks2-UDisksUtabMonitor.html + /usr/share/gtk-doc/html/udisks2/udisks2-UDisksVolumeGroup.html + /usr/share/gtk-doc/html/udisks2/udisks2-Utilities.html + /usr/share/gtk-doc/html/udisks2/udisks2.conf.5.html + /usr/share/gtk-doc/html/udisks2/udisks2.devhelp2 + /usr/share/gtk-doc/html/udisks2/udisks2_lsm.conf.5.html + /usr/share/gtk-doc/html/udisks2/udisksctl.1.html + /usr/share/gtk-doc/html/udisks2/umount.udisks2.8.html + /usr/share/gtk-doc/html/udisks2/up-insensitive.png + /usr/share/gtk-doc/html/udisks2/up.png - - 2018-02-20 + + 2018-09-26 2.7.6 Packaging update - Pierre-Yves - pyu@riseup.net + Peter O'Connor + peter@solus-project.com \ No newline at end of file