From: Julien Olivain via buildroot <buildroot@buildroot.org>
To: Marcus Hoffmann <buildroot@bubu1.eu>
Cc: buildroot@buildroot.org,
Giulio Benetti <giulio.benetti@benettiengineering.com>
Subject: Re: [Buildroot] [PATCH] package/util-linux: security bump to 2.41.4
Date: Mon, 20 Apr 2026 19:23:18 +0200 [thread overview]
Message-ID: <9cd836be0bc0e28b30cc77a1ee4243a7@free.fr> (raw)
In-Reply-To: <20260420142814.753135-1-buildroot@bubu1.eu>
On 20/04/2026 16:28, Marcus Hoffmann via buildroot wrote:
> Security fixes:
>
> CVE-2026-27456 - mount(8) TOCTOU symlink attack via loop device.
> The SUID mount follows symlinks when resolving loop backing file
> paths. On systems where non-root users are permitted to mount loop
> devices (via 'user' option in fstab), this allows access to
> arbitrary files.
>
> CWE-190 - Integer overflow in libblkid parse_dos_extended().
> A crafted MBR disk image can cause uint32_t wraparound in EBR
> chain processing, causing reported partitions to not match the
> on-disk layout. Tools like udisks may then register a partition
> at logical sector 0.
>
> Full release notes:
> https://www.kernel.org/pub/linux/utils/util-linux/v2.41/v2.41.4-ReleaseNotes
>
> Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
next prev parent reply other threads:[~2026-04-20 17:23 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-20 14:28 [Buildroot] [PATCH] package/util-linux: security bump to 2.41.4 Marcus Hoffmann via buildroot
2026-04-20 17:23 ` Julien Olivain via buildroot [this message]
2026-05-04 14:48 ` Thomas Perale via buildroot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9cd836be0bc0e28b30cc77a1ee4243a7@free.fr \
--to=buildroot@buildroot.org \
--cc=buildroot@bubu1.eu \
--cc=giulio.benetti@benettiengineering.com \
--cc=ju.o@free.fr \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox