Re: [BLFS Trac] #23714: udisks2-2.11.2

#23714: udisks2-2.11.2
-------------------------+-------------------------------
 Reporter:  Bruce Dubbs  |       Owner:  SecurityAdvisory
     Type:  enhancement  |      Status:  new
 Priority:  elevated     |   Milestone:  98-Security
Component:  BOOK         |     Version:  git
 Severity:  high         |  Resolution:
 Keywords:               |
-------------------------+-------------------------------
Changes (by Joe Locash):

 * milestone:  13.1 => 98-Security
 * owner:  Joe Locash => SecurityAdvisory
 * priority:  normal => elevated
 * severity:  normal => high
 * status:  assigned => new

Comment:

 {{{
 ---------------------------
 udisks 2.11.2
 ---------------------------

 The udisks project provides a daemon, tools and libraries to access
 and manipulate disks, storage devices and technologies.

 This is a bugfix release with a security fix, several crash and memory
 leak fixes, and mount options update.

 Security fix:
  - CVE-2026-7867: An unprivileged D-Bus caller could use the 'as-user'
    Filesystem.Mount() option combined with fstab entries containing 'user'
    or 'users' mount options to mount on behalf of another user without
    polkit authorization.

 Changes since 2.11.1:

 Tomas Bzatek (21):
       udiskslinuxnvmenamespace: Report cancellation as error in format job
       udiskslinuxprovider: Fix memory leak on spurious uevents
       udiskslinuxprovider: Initialize GError pointer in sleep signal
 handler
       udisksdaemonutil: Fix missing NULL terminator in resolve_links()
       udiskslinuxdriveata: Add missing D-Bus method completion for
 SecurityEraseUnit
       udiskslinuxfilesystem: Fix missing goto after mount state check in
 handle_resize
       udiskslinuxfilesystem: Fix missing goto after mount state check in
 handle_repair
       udiskslinuxfilesystem: Fix missing goto after mount state check in
 handle_check
       udiskslinuxfilesystem: Fix mounted check in filesystem update
       udiskslinuxmountoptions: Fix integer overflow in UID/GID option
 parsing
       udiskslinuxmountoptions: Fix static buffer and hardcoded limit in
 is_uid_in_gid
       doap: Update storaged.org https link
       udisksmodulemanager: Fix broken module error check
       lvm2: Fix NULL dereference in VG create uevent trigger loop
       mount options: Sync exfat allowed options with the latest kernel
       udiskslinuxfilesystem: Separate real caller identity from as-user
 target
       udiskslinuxfilesystem: Rework fstab mount authorization for as-user
       udiskslinuxfilesystem: Log real caller uid for as-user mounts
       udisksdaemonutil: Pass as-user target to polkit details
       tests: Add security tests for as-user mount authorization
       tests: Trigger controller rescan after namespace re-attach in
 test_ns_detach

 Vojtech Trefny (1):
       tests: Temporarily skip NTFS3 configurable mount options test
 }}}
 Fixed at [sha:aa46fc63ac]. Leaving open for SA.
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23714#comment:2>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page