From b734360dc913aa8c995d1a05e3ff220dc595211c Mon Sep 17 00:00:00 2001 From: Jonathan Wright Date: Wed, 18 Jun 2025 08:35:03 -0500 Subject: [PATCH] Fixes CVE-2025-6019 --- ...-allow-suid-and-dev-set-on-fs-resize.patch | 24 +++++++++++++++++++ SPECS/libblockdev.spec | 6 ++++- 2 files changed, 29 insertions(+), 1 deletion(-) create mode 100644 SOURCES/0006-dont-allow-suid-and-dev-set-on-fs-resize.patch diff --git a/SOURCES/0006-dont-allow-suid-and-dev-set-on-fs-resize.patch b/SOURCES/0006-dont-allow-suid-and-dev-set-on-fs-resize.patch new file mode 100644 index 0000000..dd82052 --- /dev/null +++ b/SOURCES/0006-dont-allow-suid-and-dev-set-on-fs-resize.patch @@ -0,0 +1,24 @@ +From 8e072f794744bd17c57cceabb3884d3f0f6a1602 Mon Sep 17 00:00:00 2001 +From: Thomas Blume +Date: Fri, 16 May 2025 14:27:10 +0200 +Subject: [PATCH] dont allow suid and dev set on fs resize + +[Salvatore Bonaccorso: Backport to 2.28, which does not contain 2b55f566d422 +("fs: Add support for NILFS2 filesystem") from 3.0 which generalized the +bd_fs_mount() call in preparation for other filesystems.] +--- + src/plugins/fs/generic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/src/plugins/fs/generic.c ++++ b/src/plugins/fs/generic.c +@@ -409,7 +409,7 @@ static gboolean xfs_resize_device (const + "before resizing it.", device); + return FALSE; + } +- ret = bd_fs_mount (device, mountpoint, "xfs", NULL, NULL, error); ++ ret = bd_fs_mount (device, mountpoint, "xfs", "nosuid,nodev", NULL, error); + if (!ret) { + g_prefix_error (error, "Failed to mount '%s' before resizing it: ", device); + return FALSE; + diff --git a/SPECS/libblockdev.spec b/SPECS/libblockdev.spec index 8143b0e..35bf77c 100644 --- a/SPECS/libblockdev.spec +++ b/SPECS/libblockdev.spec @@ -125,7 +125,7 @@ Name: libblockdev Version: 2.28 -Release: 6%{?dist} +Release: 6%{?dist}.alma.1 Summary: A library for low-level manipulation with block devices License: LGPLv2+ URL: https://github.com/storaged-project/libblockdev @@ -135,6 +135,7 @@ Patch1: 0002-tests-Fix-test_swapon_pagesize-on-systems-with-64k-p.patch Patch2: 0003-part-Fix-segfault-when-adding-a-partition-too-big-fo.patch Patch3: 0004-lvm-Add-a-function-to-activate-LVs-in-shared-mode.patch Patch4: 0005-lvm-Add-support-for-starting-and-stopping-VG-locking.patch +Patch5: 0006-dont-allow-suid-and-dev-set-on-fs-resize.patch BuildRequires: make BuildRequires: glib2-devel @@ -991,6 +992,9 @@ find %{buildroot} -type f -name "*.la" | xargs %{__rm} %files plugins-all %changelog +* Wed Jun 18 2025 Jonathan Wright - 2.28-10 - lvm: Add support for starting and stopping VG locking Resolves: RHEL-15923