mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-06-14 05:49:57 +00:00
Changqing Li
e73af91ee3
CVE-2025-6019: A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system. Refer: https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
43 lines
2.3 KiB
BlitzBasic
43 lines
2.3 KiB
BlitzBasic
DESCRIPTION = "libblockdev is a C library supporting GObject introspection for manipulation of \
|
|
block devices. It has a plugin-based architecture where each technology (like \
|
|
LVM, Btrfs, MD RAID, Swap,...) is implemented in a separate plugin, possibly \
|
|
with multiple implementations (e.g. using LVM CLI or the new LVM DBus API)."
|
|
HOMEPAGE = "http://rhinstaller.github.io/libblockdev/"
|
|
LICENSE = "LGPL-2.0-or-later"
|
|
SECTION = "devel/lib"
|
|
|
|
LIC_FILES_CHKSUM = "file://LICENSE;md5=c07cb499d259452f324bb90c3067d85c"
|
|
|
|
inherit autotools gobject-introspection pkgconfig
|
|
|
|
SRC_URI = "git://github.com/storaged-project/libblockdev;branch=2.x-branch;protocol=https \
|
|
file://0001-lvm-Do-not-include-duplicate-entries-in-bd_lvm_lvs-o.patch \
|
|
file://CVE-2025-6019.patch \
|
|
"
|
|
SRCREV = "47ff12242c89e36a33259d18b7068b26c3bb1c64"
|
|
S = "${WORKDIR}/git"
|
|
|
|
FILES:${PN} += "${libdir}/python2.7/dist-packages ${libdir}/python3.*/site-packages"
|
|
|
|
PACKAGECONFIG ??= "python3 lvm dm kmod parted fs escrow btrfs crypto mdraid kbd mpath nvdimm"
|
|
PACKAGECONFIG[python3] = "--with-python3, --without-python3,,python3"
|
|
PACKAGECONFIG[python2] = "--with-python2, --without-python2,,python"
|
|
PACKAGECONFIG[lvm] = "--with-lvm, --without-lvm, multipath-tools, lvm2"
|
|
PACKAGECONFIG[lvm-dbus] = "--with-lvm_dbus, --without-lvm_dbus, multipath-tools, lvm2"
|
|
PACKAGECONFIG[dm] = "--with-dm, --without-dm, multipath-tools, lvm2"
|
|
PACKAGECONFIG[dmraid] = "--with-dmraid, --without-dmraid"
|
|
PACKAGECONFIG[kmod] = "--with-kbd, --without-kbd, kmod"
|
|
PACKAGECONFIG[parted] = "--with-part, --without-part, parted"
|
|
PACKAGECONFIG[fs] = "--with-fs, --without-fs, util-linux"
|
|
PACKAGECONFIG[doc] = "--with-gtk-doc, --without-gtk-doc, gtk-doc-native"
|
|
PACKAGECONFIG[nvdimm] = "--with-nvdimm, --without-nvdimm, ndctl util-linux"
|
|
PACKAGECONFIG[vdo] = "--with-vdo, --without-vdo"
|
|
PACKAGECONFIG[escrow] = "--with-escrow, --without-escrow, nss volume-key"
|
|
PACKAGECONFIG[btrfs] = "--with-btrfs,--without-btrfs,libbytesize btrfs-tools"
|
|
PACKAGECONFIG[crypto] = "--with-crypto,--without-crypto,cryptsetup nss volume-key"
|
|
PACKAGECONFIG[mdraid] = "--with-mdraid,--without-mdraid,libbytesize"
|
|
PACKAGECONFIG[kbd] = "--with-kbd,--without-kbd,libbytesize"
|
|
PACKAGECONFIG[mpath] = "--with-mpath,--without-mpath, multipath-tools, lvm2"
|
|
|
|
export GIR_EXTRA_LIBS_PATH="${B}/src/utils/.libs"
|