diff options
author | Saravanan <saravanan.kadambathursubramaniyam@windriver.com> | 2025-09-30 14:51:41 +0530 |
---|---|---|
committer | Khem Raj <raj.khem@gmail.com> | 2025-09-30 09:01:05 -0700 |
commit | 09fcc28cd0e7671ee92241d40a0a77f586c9fd82 (patch) | |
tree | 51969fdc0febcab28ef02a7b85c6e113b790177b | |
parent | bbe5a69b693f8c3e58e1f2c2b108668d1f390890 (diff) | |
download | meta-openembedded-09fcc28cd0e7671ee92241d40a0a77f586c9fd82.tar.gz |
udisks2: upgrade 2.10.1 -> 2.10.2
This patch addresses below CVE's:
CVE-2025-6019
CVE-2025-8067
Changelog:
https://github.com/storaged-project/udisks/releases
Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
-rw-r--r-- | meta-oe/recipes-support/udisks/udisks2/CVE-2025-6019.patch | 51 | ||||
-rw-r--r-- | meta-oe/recipes-support/udisks/udisks2_2.10.2.bb (renamed from meta-oe/recipes-support/udisks/udisks2_2.10.1.bb) | 3 |
2 files changed, 1 insertions, 53 deletions
diff --git a/meta-oe/recipes-support/udisks/udisks2/CVE-2025-6019.patch b/meta-oe/recipes-support/udisks/udisks2/CVE-2025-6019.patch deleted file mode 100644 index 2e94c8497f..0000000000 --- a/meta-oe/recipes-support/udisks/udisks2/CVE-2025-6019.patch +++ /dev/null | |||
@@ -1,51 +0,0 @@ | |||
1 | From d0d04a381036b79df91616552706d515639bb762 Mon Sep 17 00:00:00 2001 | ||
2 | From: Tomas Bzatek <tbzatek@redhat.com> | ||
3 | Date: Wed, 4 Jun 2025 15:26:46 +0200 | ||
4 | Subject: [PATCH] udiskslinuxfilesystemhelpers: Mount private mounts with | ||
5 | 'nodev,nosuid' | ||
6 | |||
7 | The private mount done in take_filesystem_ownership() should always | ||
8 | default to 'nodev,nosuid' for security and 'errors=remount-ro' for | ||
9 | selected filesystem types to handle an corrupted filesystem. This is | ||
10 | consistent with mount options calculation for regular mounts. | ||
11 | |||
12 | CVE: CVE-2025-6019 | ||
13 | Upstream-Status: Backport [ https://github.com/storaged-project/udisks/commit/5e7277debea926370e587408517560afe87d28c9 ] | ||
14 | |||
15 | Signed-off-by: Changqing Li <changqing.li@windriver.com> | ||
16 | --- | ||
17 | src/udiskslinuxfilesystemhelpers.c | 10 +++++++++- | ||
18 | 1 file changed, 9 insertions(+), 1 deletion(-) | ||
19 | |||
20 | diff --git a/src/udiskslinuxfilesystemhelpers.c b/src/udiskslinuxfilesystemhelpers.c | ||
21 | index 7c5fc037..9eb7742c 100644 | ||
22 | --- a/src/udiskslinuxfilesystemhelpers.c | ||
23 | +++ b/src/udiskslinuxfilesystemhelpers.c | ||
24 | @@ -123,6 +123,7 @@ take_filesystem_ownership (const gchar *device, | ||
25 | |||
26 | { | ||
27 | gchar *mountpoint = NULL; | ||
28 | + const gchar *mount_opts; | ||
29 | GError *local_error = NULL; | ||
30 | gboolean unmount = FALSE; | ||
31 | gboolean success = TRUE; | ||
32 | @@ -151,8 +152,15 @@ take_filesystem_ownership (const gchar *device, | ||
33 | goto out; | ||
34 | } | ||
35 | |||
36 | + mount_opts = "nodev,nosuid"; | ||
37 | + if (g_strcmp0 (fstype, "ext2") == 0 || | ||
38 | + g_strcmp0 (fstype, "ext3") == 0 || | ||
39 | + g_strcmp0 (fstype, "ext4") == 0 || | ||
40 | + g_strcmp0 (fstype, "jfs") == 0) | ||
41 | + mount_opts = "nodev,nosuid,errors=remount-ro"; | ||
42 | + | ||
43 | /* TODO: mount to a private mount namespace */ | ||
44 | - if (!bd_fs_mount (device, mountpoint, fstype, NULL, NULL, &local_error)) | ||
45 | + if (!bd_fs_mount (device, mountpoint, fstype, mount_opts, NULL, &local_error)) | ||
46 | { | ||
47 | g_set_error (error, UDISKS_ERROR, UDISKS_ERROR_FAILED, | ||
48 | "Cannot mount %s at %s: %s", | ||
49 | -- | ||
50 | 2.34.1 | ||
51 | |||
diff --git a/meta-oe/recipes-support/udisks/udisks2_2.10.1.bb b/meta-oe/recipes-support/udisks/udisks2_2.10.2.bb index cc0c19ec8e..081b315b9b 100644 --- a/meta-oe/recipes-support/udisks/udisks2_2.10.1.bb +++ b/meta-oe/recipes-support/udisks/udisks2_2.10.2.bb | |||
@@ -20,9 +20,8 @@ RDEPENDS:${PN} = "acl" | |||
20 | SRC_URI = " \ | 20 | SRC_URI = " \ |
21 | git://github.com/storaged-project/udisks.git;branch=2.10.x-branch;protocol=https \ | 21 | git://github.com/storaged-project/udisks.git;branch=2.10.x-branch;protocol=https \ |
22 | file://0001-Makefile.am-Dont-include-buildpath.patch \ | 22 | file://0001-Makefile.am-Dont-include-buildpath.patch \ |
23 | file://CVE-2025-6019.patch \ | ||
24 | " | 23 | " |
25 | SRCREV = "18c9faf089e306ad6f3f51f5cb887a6b9aa08350" | 24 | SRCREV = "bc623acf9e7488dc105e4b00069d57e303e2616b" |
26 | 25 | ||
27 | CVE_PRODUCT = "udisks" | 26 | CVE_PRODUCT = "udisks" |
28 | 27 | ||