Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libblockdev for openSUSE:Factory checked in at 2026-11-06 19:34:08 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libblockdev (Old) and /work/SRC/openSUSE:Factory/.libblockdev.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libblockdev" Fri Nov 6 19:34:08 2026 rev:31 rq:1395135 version:3.5.0 Changes: -------- --- /work/SRC/openSUSE:Factory/libblockdev/libblockdev.changes 2026-04-29 19:17:56.677329303 +0200 +++ /work/SRC/openSUSE:Factory/.libblockdev.new.3759290/libblockdev.changes 2026-11-06 19:37:27.026635222 +0100 @@ -1,0 +2,7 @@ +Thu Nov 5 09:00:07 UTC 2026 - Petr Gajdos <[email protected]> + +- Add libblockdev-CVE-2026-111581.patch: + CVE-2026-111581: argument injection in NTFS/VFAT label-setting helpers via + udisks2 SetLabel() D-Bus method (bsc#1286323) + +------------------------------------------------------------------- New: ---- libblockdev-CVE-2026-111581.patch ----------(New B)---------- New: - Add libblockdev-CVE-2026-111581.patch: CVE-2026-111581: argument injection in NTFS/VFAT label-setting helpers via ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libblockdev.spec ++++++ --- /var/tmp/diff_new_pack.yxi1Zl/_old 2026-11-06 19:37:28.266687092 +0100 +++ /var/tmp/diff_new_pack.yxi1Zl/_new 2026-11-06 19:37:28.271687301 +0100 @@ -51,6 +51,8 @@ URL: https://github.com/storaged-project/libblockdev Source0: %{url}/releases/download/%{version}/libblockdev-%{version}.tar.gz Source1: %{url}/raw/%{version}/NEWS.rst +# CVE-2026-111581: argument injection in NTFS/VFAT label-setting helpers via udisks2 SetLabel() D-Bus method [bsc#1286323] +Patch0: libblockdev-CVE-2026-111581.patch ############################################################################### # M A I N P A C K A G E ++++++ libblockdev-CVE-2026-111581.patch ++++++ >From 4ef6b2b4798a46566fe8815eaabd163205be20bd Mon Sep 17 00:00:00 2001 From: Vojtech Trefny <[email protected]> Date: Tue, 3 Nov 2026 15:39:58 +0100 Subject: [PATCH 1/2] fs: Reject NTFS labels starting with a dash Fixes CVE-2026-111581. --- src/plugins/fs/ntfs.c | 16 ++++++++++++++++ tests/fs_tests/ntfs_test.py | 11 +++++++++++ 2 files changed, 27 insertions(+) diff --git a/src/plugins/fs/ntfs.c b/src/plugins/fs/ntfs.c index f9898b6d0..baa265620 100644 --- a/src/plugins/fs/ntfs.c +++ b/src/plugins/fs/ntfs.c @@ -228,6 +228,9 @@ gboolean bd_fs_ntfs_set_label (const gchar *device, const gchar *label, GError * if (!check_deps (&avail_deps, DEPS_NTFSLABEL_MASK, deps, DEPS_LAST, &deps_check_lock, error)) return FALSE; + if (!bd_fs_ntfs_check_label (label, error)) + return FALSE; + return bd_utils_exec_and_report_error (args, NULL, error); } @@ -242,6 +245,19 @@ gboolean bd_fs_ntfs_set_label (const gchar *device, const gchar *label, GError * * Tech category: always available */ gboolean bd_fs_ntfs_check_label (const gchar *label, GError **error) { + if (!label) { + g_set_error_literal (error, BD_FS_ERROR, BD_FS_ERROR_LABEL_INVALID, + "Label cannot be NULL."); + return FALSE; + } + + /* ntfslabel does not reliably support '--' to terminate option parsing. */ + if (label[0] == '-') { + g_set_error_literal (error, BD_FS_ERROR, BD_FS_ERROR_LABEL_INVALID, + "Label for NTFS filesystem cannot start with '-'."); + return FALSE; + } + if (strlen (label) > 128) { g_set_error_literal (error, BD_FS_ERROR, BD_FS_ERROR_LABEL_INVALID, "Label for NTFS filesystem must be at most 128 characters long."); >From bf990ef6d720b4a0d3cb22c572f473fc5dc7f83c Mon Sep 17 00:00:00 2001 From: Vojtech Trefny <[email protected]> Date: Tue, 3 Nov 2026 16:07:59 +0100 Subject: [PATCH 2/2] fs: Prevent VFAT labels from being interpreted as options Fixes CVE-2026-111581. This also requires dosfstools >= 4.2 for setting label from now because the "--" option doesn't work with older versions. 4.2 was released in 2021 and is now available in all major distributions including Debian 11 (oldoldstable) and CentOS/RHEL 9 so it's not a problem. --- src/plugins/fs/vfat.c | 31 +++++++++++-------------------- tests/fs_tests/vfat_test.py | 9 +++++++++ 2 files changed, 20 insertions(+), 20 deletions(-) diff --git a/src/plugins/fs/vfat.c b/src/plugins/fs/vfat.c index dd15e7920..8e318ff2d 100644 --- a/src/plugins/fs/vfat.c +++ b/src/plugins/fs/vfat.c @@ -51,7 +51,7 @@ void _fs_vfat_reset_avail_deps (void) { static const UtilDep deps[DEPS_LAST] = { {"mkfs.vfat", NULL, NULL, NULL}, - {"fatlabel", NULL, NULL, NULL}, + {"fatlabel", "4.2", "--version", "fatlabel\\s+([\\d\\.]+).+"}, {"fsck.vfat", NULL, NULL, NULL}, {"vfat-resize", NULL, NULL, NULL}, {"fatlabel", "4.2", "--version", "fatlabel\\s+([\\d\\.]+).+"}, @@ -288,33 +288,24 @@ gboolean bd_fs_vfat_repair (const gchar *device, const BDExtraArg **extra, GErro * Tech category: %BD_FS_TECH_VFAT-%BD_FS_TECH_MODE_SET_LABEL */ gboolean bd_fs_vfat_set_label (const gchar *device, const gchar *label, GError **error) { - const gchar *args[4] = {"fatlabel", device, NULL, NULL}; - UtilDep dep = {"fatlabel", "4.2", "--version", "fatlabel\\s+([\\d\\.]+).+"}; - gchar *label_up = NULL; - gboolean new_vfat = FALSE; - gboolean ret; + const gchar *args[5] = {"fatlabel", "--", device, label, NULL}; + g_autofree gchar *label_up = NULL; if (!check_deps (&avail_deps, DEPS_FATLABEL_MASK, deps, DEPS_LAST, &deps_check_lock, error)) return FALSE; if (!label || g_strcmp0 (label, "") == 0) { - /* fatlabel >= 4.2 refuses to set empty label */ - new_vfat = bd_utils_check_util_version (dep.name, dep.version, - dep.ver_arg, dep.ver_regexp, - NULL); - if (new_vfat) - args[2] = "--reset"; - } - - /* forcefully convert the label uppercase in case no reset was requested */ - if (label && args[2] == NULL) { + /* fatlabel >= 4.2 refuses to set an empty label, use --reset instead */ + args[1] = "--reset"; + args[2] = "--"; + args[3] = device; + } else { + /* forcefully convert a non-empty label uppercase */ label_up = g_ascii_strup (label, -1); - args[2] = label_up; + args[3] = label_up; } - ret = bd_utils_exec_and_report_error (args, NULL, error); - g_free (label_up); - return ret; + return bd_utils_exec_and_report_error (args, NULL, error); } /**
