From 88d74fe2c982b0025d38f8bc21d330bcf83cf16e Mon Sep 17 00:00:00 2001 From: Jonathan Wright Date: Wed, 18 Jun 2025 08:44:13 -0500 Subject: [PATCH] Fix CVE-2025-6019 --- ...-allow-suid-and-dev-set-on-fs-resize.patch | 24 +++++++++++++++++++ SPECS/libblockdev.spec | 6 ++++- 2 files changed, 29 insertions(+), 1 deletion(-) create mode 100644 SOURCES/0016-dont-allow-suid-and-dev-set-on-fs-resize.patch diff --git a/SOURCES/0016-dont-allow-suid-and-dev-set-on-fs-resize.patch b/SOURCES/0016-dont-allow-suid-and-dev-set-on-fs-resize.patch new file mode 100644 index 0000000..dd82052 --- /dev/null +++ b/SOURCES/0016-dont-allow-suid-and-dev-set-on-fs-resize.patch @@ -0,0 +1,24 @@ +From 8e072f794744bd17c57cceabb3884d3f0f6a1602 Mon Sep 17 00:00:00 2001 +From: Thomas Blume +Date: Fri, 16 May 2025 14:27:10 +0200 +Subject: [PATCH] dont allow suid and dev set on fs resize + +[Salvatore Bonaccorso: Backport to 2.28, which does not contain 2b55f566d422 +("fs: Add support for NILFS2 filesystem") from 3.0 which generalized the +bd_fs_mount() call in preparation for other filesystems.] +--- + src/plugins/fs/generic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/src/plugins/fs/generic.c ++++ b/src/plugins/fs/generic.c +@@ -409,7 +409,7 @@ static gboolean xfs_resize_device (const + "before resizing it.", device); + return FALSE; + } +- ret = bd_fs_mount (device, mountpoint, "xfs", NULL, NULL, error); ++ ret = bd_fs_mount (device, mountpoint, "xfs", "nosuid,nodev", NULL, error); + if (!ret) { + g_prefix_error (error, "Failed to mount '%s' before resizing it: ", device); + return FALSE; + diff --git a/SPECS/libblockdev.spec b/SPECS/libblockdev.spec index 86605ee..b1c270f 100644 --- a/SPECS/libblockdev.spec +++ b/SPECS/libblockdev.spec @@ -129,7 +129,7 @@ Name: libblockdev Version: 2.28 -Release: 13%{?dist} +Release: 13%{?dist}.alma.1 Summary: A library for low-level manipulation with block devices License: LGPLv2+ URL: https://github.com/storaged-project/libblockdev @@ -150,6 +150,7 @@ Patch12: 0012-lvm-Add-support-for-starting-and-stopping-VG-locking.patch Patch13: 0013-tests-Remove_unreliable_nvme_attribute_checks.patch Patch14: 0014-nvme-Add-bd_nvme_is_tech_avail-to-the-API-file.patch Patch15: 0015-crypto-Add-a-function-to-set-persistent-flags-for-LU.patch +Patch16: 0016-dont-allow-suid-and-dev-set-on-fs-resize.patch BuildRequires: make BuildRequires: glib2-devel @@ -1048,6 +1049,9 @@ find %{buildroot} -type f -name "*.la" | xargs %{__rm} %files plugins-all %changelog +* Wed Jun 18 2025 Jonathan Wright - 2.28-13.alma.1 +- Fix CVE-2025-6019 don't allow suid and dev set on fs resize + * Tue Mar 11 2025 Vojtech Trefny - 2.28-13 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82886