Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:parted User: [email protected] Usertags: pu
[ Reason ] The update aims to fix 2 CVEs (#1148169) on parted, CVE-2026-89088 [1] and CVE-2026-89085 [2]. The commit fixing it has been cherry-picked from upstream [3] and applied cleanly, the code between trixie's version and upstream fix did not change, plus the patch adds asserts to avoid overflows instead of changing logic to avoid greater regressions risk as noted by upstream [4]: > I opted to fix things by using the existing PED_ASSERT system -- I > really do not want to change logic, especially in the filesystem code. > It's better to get these 'fixed' quickly and if someone wants to > improve logic later that's fine. [1] https://deb.freexian.com/extended-lts/tracker/CVE-2026-89088 [2] https://deb.freexian.com/extended-lts/tracker/CVE-2026-89085 [3] https://gitweb.git.savannah.gnu.org/gitweb/?p=parted.git;a=commit;h=73301c6915781c2eee66d0b1cc9d41a70bf901d6 [4] https://alioth-lists.debian.net/pipermail/parted-devel/2026-September/006032.html [ Impact ] Buffer overflows are possible on 32-bit arches. [ Tests ] I have uploaded to debusine to get regression testing of rdeps of parted, the results showed no regression [5]. Upstream provides a test case but I did not manage to get it to run properly (with or without the fix) after spending a few hours on it so I resort to debusine instead. [5] https://debusine.debian.net/debian/developers/work-request/1425201/#qa [ Risks ] The actual code changes are basically adding asserts to make sure overflows are not possible. It's pretty trivial and there is no logic change in code that could introduce regressions. [ Checklist ] [x] *all* changes are documented in the d/changelog NOTE: Debian maintainers use git-dpm to manage the packaging and it does change the tool-specific metadata file in debian/ though I left it out of changelog. [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] Add upstream commit which add PED_ASSERTS to check values that could cause overflows and also a testcase for it. [ Other info ] Since changes are minimal and low risk, I'll proceed with the upload to trixie-pu as suggested in dev-ref (5.5.1). Cheers, Charles
diff -Nru parted-3.6/debian/changelog parted-3.6/debian/changelog --- parted-3.6/debian/changelog 2025-02-23 14:39:45.000000000 -0300 +++ parted-3.6/debian/changelog 2026-09-30 23:09:27.000000000 -0300 @@ -1,3 +1,12 @@ +parted (3.6-5+deb13u1) trixie; urgency=medium + + * Team upload. + * debian/patches/: + - CVE-2026-89088.and.CVE-2026-89085.patch: cherry-pick from upstream to + fix CVE-2026-89088 and CVE-2026-89085. (Closes: 1148169) + + -- Carlos Henrique Lima Melara <[email protected]> Wed, 30 Sep 2026 23:09:27 -0300 + parted (3.6-5) unstable; urgency=medium * Apply X-Style: black. diff -Nru parted-3.6/debian/.git-dpm parted-3.6/debian/.git-dpm --- parted-3.6/debian/.git-dpm 2025-02-23 14:39:45.000000000 -0300 +++ parted-3.6/debian/.git-dpm 2026-09-30 23:09:27.000000000 -0300 @@ -1,6 +1,6 @@ # see git-dpm(1) from git-dpm package -7a96e9d182e544007185af62df87e0a47dc9029d -7a96e9d182e544007185af62df87e0a47dc9029d +9aa421e2ffd46e52f54acfcf7a14cbaade790652 +9aa421e2ffd46e52f54acfcf7a14cbaade790652 8b1dfdefd31c1304a98e9df675720db83bca3c08 8b1dfdefd31c1304a98e9df675720db83bca3c08 parted_3.6.orig.tar.xz diff -Nru parted-3.6/debian/patches/CVE-2026-89088.and.CVE-2026-89085.patch parted-3.6/debian/patches/CVE-2026-89088.and.CVE-2026-89085.patch --- parted-3.6/debian/patches/CVE-2026-89088.and.CVE-2026-89085.patch 1969-12-31 21:00:00.000000000 -0300 +++ parted-3.6/debian/patches/CVE-2026-89088.and.CVE-2026-89085.patch 2026-09-30 23:09:27.000000000 -0300 @@ -0,0 +1,228 @@ +From 9aa421e2ffd46e52f54acfcf7a14cbaade790652 Mon Sep 17 00:00:00 2001 +From: "Brian C. Lane" <[email protected]> +Date: Tue, 8 Sep 2026 09:13:00 -0700 +Subject: libparted: Catch FAT metadata triggered errors + +Bad metadata can trigger a buffer overflow in fat resize code. Trigger +an assert when the sector count is too large, or malloc is called with a +size of 0 + +Adds a new test that checks to make sure that the assert is triggered. +This includes a test for deep directory traversal which should be caught +by glibc and reported as 'buffer overflow detected'. + +This also includes a check on the flag_traverse_dir dir_name length to +prevent an overflow of the 4k buffer with deeply nested directories. +Also include a test for this assertion. + +WARNING: parted should be build with debug enabled (which is the +default) this enables a large number of PED_ASSERT checks which catch +various conditions like these. + +This fixes two CVE's: + - CVE-2026-89085 - heap buffer overflow in _init_fats / fat_table_read + - CVE-2026-89088 - heap buffer overflow in duplicate_legacy_root_dir + +Origin: upstream, https://gitweb.git.savannah.gnu.org/gitweb/?p=parted.git;a=commit;h=73301c6915781c2eee66d0b1cc9d41a70bf901d6 +Bug-Debian: https://bugs.debian.org/1148169 +Last-Update: 2026-09-30 + +Patch-Name: CVE-2026-89088.and.CVE-2026-89085.patch +--- + libparted/fs/r/fat/count.c | 1 + + libparted/fs/r/fat/resize.c | 2 + + libparted/libparted.c | 1 + + tests/Makefile.am | 1 + + tests/t3001-buffer.sh | 134 ++++++++++++++++++++++++++++++++++++ + 5 files changed, 139 insertions(+) + create mode 100755 tests/t3001-buffer.sh + +diff --git a/libparted/fs/r/fat/count.c b/libparted/fs/r/fat/count.c +index e23404b2..9c97bf42 100644 +--- a/libparted/fs/r/fat/count.c ++++ b/libparted/fs/r/fat/count.c +@@ -166,6 +166,7 @@ flag_traverse_dir (FatTraverseInfo* trav_info) { + PedSector size; + + PED_ASSERT (trav_info != NULL); ++ PED_ASSERT (strlen(trav_info->dir_name) < 4083); + + strcpy (file_name, trav_info->dir_name); + file_name_start = file_name + strlen (file_name); +diff --git a/libparted/fs/r/fat/resize.c b/libparted/fs/r/fat/resize.c +index 78dede43..a6cc3851 100644 +--- a/libparted/fs/r/fat/resize.c ++++ b/libparted/fs/r/fat/resize.c +@@ -86,6 +86,8 @@ duplicate_legacy_root_dir (FatOpContext* ctx) + + PED_ASSERT (old_fs_info->root_dir_sector_count + == new_fs_info->root_dir_sector_count); ++ PED_ASSERT (old_fs_info->root_dir_sector_count <= old_fs_info->buffer_sectors); ++ PED_ASSERT (new_fs_info->root_dir_sector_count <= new_fs_info->buffer_sectors); + + if (!ped_geometry_read (ctx->old_fs->geom, old_fs_info->buffer, + old_fs_info->root_dir_offset, +diff --git a/libparted/libparted.c b/libparted/libparted.c +index 88e7eea2..9a1d9297 100644 +--- a/libparted/libparted.c ++++ b/libparted/libparted.c +@@ -245,6 +245,7 @@ ped_malloc (size_t size) + { + void* mem; + ++ PED_ASSERT(size > 0); + mem = (void*) malloc (size); + if (!mem) { + ped_exception_throw (PED_EXCEPTION_FATAL, PED_EXCEPTION_CANCEL, +diff --git a/tests/Makefile.am b/tests/Makefile.am +index 3c1f929a..9e60aba0 100644 +--- a/tests/Makefile.am ++++ b/tests/Makefile.am +@@ -61,6 +61,7 @@ TESTS = \ + t2500-freebsd-ufs.sh \ + t2500-probe-corrupt-hfs.sh \ + t3000-resize-fs.sh \ ++ t3001-buffer.sh \ + t3200-resize-partition.sh \ + t3200-type-change.sh \ + t3210-gpt-type-change.sh \ +diff --git a/tests/t3001-buffer.sh b/tests/t3001-buffer.sh +new file mode 100755 +index 00000000..c016f5f7 +--- /dev/null ++++ b/tests/t3001-buffer.sh +@@ -0,0 +1,134 @@ ++#!/bin/sh ++# Test buffer overflow fix in libparted/fs/r/fat/fat.c ++ ++# Copyright (C) 2026 Free Software Foundation, Inc. ++ ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 3 of the License, or ++# (at your option) any later version. ++ ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++ ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see <http://www.gnu.org/licenses/>. ++ ++. "${srcdir=.}/init.sh"; path_prepend_ ../parted . ++require_root_ ++require_scsi_debug_module_ ++require_512_byte_sector_size_ ++ ++ ++FSTYPES="" ++ ++# Is mkfs.vfat available? ++mkfs.vfat 2>&1 | grep '^Usage:' && FSTYPES="fat32 fat16" ++ ++[ -n "$FSTYPES" ] || skip_ "mkfs.vfat is not installed" ++ ++ ++ss=$sector_size_ ++ ++start=63s ++default_end=546147s ++ new_end=530144s ++ ++# create memory-backed device. Must be > 256MB+8MB ++scsi_debug_setup_ dev_size_mb=267 > dev-name || ++ skip_ 'failed to create scsi_debug device' ++dev=$(cat dev-name) ++ ++fail=0 ++ ++parted -s $dev mklabel gpt > out 2>&1 || fail=1 ++# expect no output ++compare /dev/null out || fail=1 ++ ++# ensure that the disk is large enough ++dev_n_sectors=$(parted -s $dev u s p|sed -n '2s/.* \([0-9]*\)s$/\1/p') ++device_sectors_required=$(echo $default_end | sed 's/s$//') ++# Ensure that $dev is large enough for this test ++test $device_sectors_required -le $dev_n_sectors || fail=1 ++ ++# create mount point dir ++mount_point="`pwd`/mnt" ++mkdir "$mount_point" || fail=1 ++ ++# be sure to unmount upon interrupt, failure, etc. ++cleanup_fn_() { umount "${dev}1" > /dev/null 2>&1; } ++ ++for fs_type in $FSTYPES; do ++ echo "fs_type=$fs_type" ++ ++ # create an empty $fs_type partition, cylinder aligned, size > 256 MB ++ parted -a min -s $dev mkpart p1 $start $default_end > out 2>&1 || fail=1 ++ compare /dev/null out || fail=1 ++ ++ # print partition table ++ parted -m -s $dev u s p > out 2>&1 || fail=1 ++ ++ # wait for new partition device to appear ++ wait_for_dev_to_appear_ ${dev}1 ++ ++ case $fs_type in ++ fat16) mkfs_cmd='mkfs.vfat -F 16'; fsck='fsck.vfat -v';; ++ fat32) mkfs_cmd='mkfs.vfat -F 32'; fsck='fsck.vfat -v';; ++ *) error "internal error: unhandled fs type: $fs_type";; ++ esac ++ ++ # create the file system ++ $mkfs_cmd ${dev}1 || fail=1 ++ ++ # Set a very large dir_entries value ++ # This triggeres different failures in FAT16 and FAT32, see expected output below ++ printf '\xff\xff' | dd of=${dev}1 bs=1 seek=$((0x11)) conv=notrunc ++ ++ # NOTE: shrinking is the only type of resizing that works. ++ # resize that file system to be one cylinder (8MiB) smaller ++ # NOTE: A core dump is expected here, check output to determine if it is the correct failure ++ fs-resize ${dev}1 0 $new_end > out 2>&1 ++ ++ # Include full output for debugging ++ cat out ++ ++ # FAT16 exepcts an Assert in duplicate_legacy_root_dir ++ # FAT32 expects an Assert in ped_malloc ++ case $fs_type in ++ fat16) grep "Assertion.*duplicate_legacy_root_dir" out || fail=1;; ++ fat32) grep "Assertion.*ped_malloc" out || fail=1;; ++ esac ++ ++ # create a clean file system ++ $mkfs_cmd ${dev}1 || fail=1 ++ ++ # create 500 deep directory tree that overflows the 4096 byte tmp_buffer ++ # to catch core dump in libparted/fs/r/fat/count.c flag_traverse_dir() ++ mount "${dev}1" "$mount_point" || fail=1 ++ cat /dev/null > exp ++ ( cd "$mount_point"; for d in `seq 500`; do mkdir TESTDIRR.DIR; cd TESTDIRR.DIR; done ) > out ++ compare exp out || fail=1 # Ensure no errors creating directory tree ++ umount "${dev}1" || fail=1 ++ ++ # Make sure that buffer overflow is caught ++ fs-resize ${dev}1 0 $new_end > out 2>&1 ++ ++ # Include full output for debugging ++ cat out ++ ++ # Confirm that the large dir_name was caught ++ grep "Assertion.*strlen.*flag_traverse_dir" out || fail=1 ++ ++ # Remove the partition explicitly, so that mklabel doesn't evoke a warning. ++ parted -s $dev rm 1 || fail=1 ++ ++ # Create a clean partition table for the next iteration. ++ parted -s $dev mklabel gpt > out 2>&1 || fail=1 ++ # expect no output ++ compare /dev/null out || fail=1 ++ ++done ++ ++Exit $fail diff -Nru parted-3.6/debian/patches/series parted-3.6/debian/patches/series --- parted-3.6/debian/patches/series 2025-02-23 14:39:45.000000000 -0300 +++ parted-3.6/debian/patches/series 2026-09-30 23:09:27.000000000 -0300 @@ -12,3 +12,4 @@ probe-lvs-again.patch link-libuuid.patch gcc-15.patch +CVE-2026-89088.and.CVE-2026-89085.patch
