Star1
4
Code
Code
Issues
Pull Requests2
Discussion
Wiki
Analysis
Star1
4
Open
[sync] PR-76: Fix CVE-2026-89085 and CVE-2026-89088 #79
openeuler-ci-botAdd on Sep 24
[sync] PR-76: Fix CVE-2026-89085 and CVE-2026-89088 #79
Open
openeuler-ci-botAdd on Sep 24
Merged fromsync-pr76-openEuler-24.03-LTS-SP4-to-openEuler-26.09-DevStationintoopenEuler-26.09-DevStation
Total: 2 files changed+236-1
Abackport-CVE-2026-89085-CVE-2026-89088.patch+229-0
@@ -0,0 +1,229 @@
1+From 73301c6915781c2eee66d0b1cc9d41a70bf901d6 Mon Sep 17 00:00:00 2001
2+From: "Brian C. Lane" <bcl@redhat.com>
3+Date: Tue, 8 Sep 2026 09:13:00 -0700
4+Subject: [PATCH] libparted: Catch FAT metadata triggered errors
5+ 
6+Bad metadata can trigger a buffer overflow in fat resize code. Trigger
7+an assert when the sector count is too large, or malloc is called with a
8+size of 0
9+ 
10+Adds a new test that checks to make sure that the assert is triggered.
11+This includes a test for deep directory traversal which should be caught
12+by glibc and reported as 'buffer overflow detected'.
13+ 
14+This also includes a check on the flag_traverse_dir dir_name length to
15+prevent an overflow of the 4k buffer with deeply nested directories.
16+Also include a test for this assertion.
17+ 
18+WARNING: parted should be build with debug enabled (which is the
19+default) this enables a large number of PED_ASSERT checks which catch
20+various conditions like these.
21+ 
22+This fixes two CVE's:
23+ - CVE-2026-89085 - heap buffer overflow in _init_fats / fat_table_read
24+ - CVE-2026-89088 - heap buffer overflow in duplicate_legacy_root_dir
25+ 
26+Reference:https://src.fedoraproject.org/rpms/parted/blob/06583e26e5ce4ce5fa941f042b4ba1fd4c62b40d/f/0013-libparted-Catch-FAT-metadata-triggered-errors.patch
27+Conflict:tests/Makefile.am adapt patch Context
28+ 
29+---
30+ libparted/fs/r/fat/count.c | 1 +
31+ libparted/fs/r/fat/resize.c | 2 +
32+ libparted/libparted.c | 1 +
33+ tests/Makefile.am | 1 +
34+ tests/t3001-buffer.sh | 134 ++++++++++++++++++++++++++++++++++++
35+ 5 files changed, 139 insertions(+)
36+ create mode 100755 tests/t3001-buffer.sh
37+ 
38+diff --git a/libparted/fs/r/fat/count.c b/libparted/fs/r/fat/count.c
39+index 45d9006..296b676 100644
40+--- a/libparted/fs/r/fat/count.c
41++++ b/libparted/fs/r/fat/count.c
42+@@ -166,6 +166,7 @@ flag_traverse_dir (FatTraverseInfo* trav_info) {
43+ PedSector size;
44+
45+ PED_ASSERT (trav_info != NULL);
46++ PED_ASSERT (strlen(trav_info->dir_name) < 4083);
47+
48+ strcpy (file_name, trav_info->dir_name);
49+ file_name_start = file_name + strlen (file_name);
50+diff --git a/libparted/fs/r/fat/resize.c b/libparted/fs/r/fat/resize.c
51+index bec45d7..d5f8758 100644
52+--- a/libparted/fs/r/fat/resize.c
53++++ b/libparted/fs/r/fat/resize.c
54+@@ -86,6 +86,8 @@ duplicate_legacy_root_dir (FatOpContext* ctx)
55+
56+ PED_ASSERT (old_fs_info->root_dir_sector_count
57+ == new_fs_info->root_dir_sector_count);
58++ PED_ASSERT (old_fs_info->root_dir_sector_count <= old_fs_info->buffer_sectors);
59++ PED_ASSERT (new_fs_info->root_dir_sector_count <= new_fs_info->buffer_sectors);
60+
61+ if (!ped_geometry_read (ctx->old_fs->geom, old_fs_info->buffer,
62+ old_fs_info->root_dir_offset,
63+diff --git a/libparted/libparted.c b/libparted/libparted.c
64+index b180528..95d8697 100644
65+--- a/libparted/libparted.c
66++++ b/libparted/libparted.c
67+@@ -245,6 +245,7 @@ ped_malloc (size_t size)
68+ {
69+ void* mem;
70+
71++ PED_ASSERT(size > 0);
72+ mem = (void*) malloc (size);
73+ if (!mem) {
74+ ped_exception_throw (PED_EXCEPTION_FATAL, PED_EXCEPTION_CANCEL,
75+diff --git a/tests/Makefile.am b/tests/Makefile.am
76+index dae1d56..e6bc912 100644
77+--- a/tests/Makefile.am
78++++ b/tests/Makefile.am
79+@@ -60,6 +60,7 @@ TESTS = \
80+ t2410-dos-udf-partition-type.sh \
81+ t2500-probe-corrupt-hfs.sh \
82+ t3000-resize-fs.sh \
83++ t3001-buffer.sh \
84+ t3200-resize-partition.sh \
85+ t3200-type-change.sh \
86+ t3210-gpt-type-change.sh \
87+diff --git a/tests/t3001-buffer.sh b/tests/t3001-buffer.sh
88+new file mode 100755
89+index 0000000..c016f5f
90+--- /dev/null
91++++ b/tests/t3001-buffer.sh
92+@@ -0,0 +1,134 @@
93++#!/bin/sh
94++# Test buffer overflow fix in libparted/fs/r/fat/fat.c
95++
96++# Copyright (C) 2026 Free Software Foundation, Inc.
97++
98++# This program is free software; you can redistribute it and/or modify
99++# it under the terms of the GNU General Public License as published by
100++# the Free Software Foundation; either version 3 of the License, or
101++# (at your option) any later version.
102++
103++# This program is distributed in the hope that it will be useful,
104++# but WITHOUT ANY WARRANTY; without even the implied warranty of
105++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
106++# GNU General Public License for more details.
107++
108++# You should have received a copy of the GNU General Public License
109++# along with this program. If not, see <http://www.gnu.org/licenses/>.
110++
111++. "${srcdir=.}/init.sh"; path_prepend_ ../parted .
112++require_root_
113++require_scsi_debug_module_
114++require_512_byte_sector_size_
115++
116++
117++FSTYPES=""
118++
119++# Is mkfs.vfat available?
120++mkfs.vfat 2>&1 | grep '^Usage:' && FSTYPES="fat32 fat16"
121++
122++[ -n "$FSTYPES" ] || skip_ "mkfs.vfat is not installed"
123++
124++
125++ss=$sector_size_
126++
127++start=63s
128++default_end=546147s
129++ new_end=530144s
130++
131++# create memory-backed device. Must be > 256MB+8MB
132++scsi_debug_setup_ dev_size_mb=267 > dev-name ||
133++ skip_ 'failed to create scsi_debug device'
134++dev=$(cat dev-name)
135++
136++fail=0
137++
138++parted -s $dev mklabel gpt > out 2>&1 || fail=1
139++# expect no output
140++compare /dev/null out || fail=1
141++
142++# ensure that the disk is large enough
143++dev_n_sectors=$(parted -s $dev u s p|sed -n '2s/.* \([0-9]*\)s$/\1/p')
144++device_sectors_required=$(echo $default_end | sed 's/s$//')
145++# Ensure that $dev is large enough for this test
146++test $device_sectors_required -le $dev_n_sectors || fail=1
147++
148++# create mount point dir
149++mount_point="`pwd`/mnt"
150++mkdir "$mount_point" || fail=1
151++
152++# be sure to unmount upon interrupt, failure, etc.
153++cleanup_fn_() { umount "${dev}1" > /dev/null 2>&1; }
154++
155++for fs_type in $FSTYPES; do
156++ echo "fs_type=$fs_type"
157++
158++ # create an empty $fs_type partition, cylinder aligned, size > 256 MB
159++ parted -a min -s $dev mkpart p1 $start $default_end > out 2>&1 || fail=1
160++ compare /dev/null out || fail=1
161++
162++ # print partition table
163++ parted -m -s $dev u s p > out 2>&1 || fail=1
164++
165++ # wait for new partition device to appear
166++ wait_for_dev_to_appear_ ${dev}1
167++
168++ case $fs_type in
169++ fat16) mkfs_cmd='mkfs.vfat -F 16'; fsck='fsck.vfat -v';;
170++ fat32) mkfs_cmd='mkfs.vfat -F 32'; fsck='fsck.vfat -v';;
171++ *) error "internal error: unhandled fs type: $fs_type";;
172++ esac
173++
174++ # create the file system
175++ $mkfs_cmd ${dev}1 || fail=1
176++
177++ # Set a very large dir_entries value
178++ # This triggeres different failures in FAT16 and FAT32, see expected output below
179++ printf '\xff\xff' | dd of=${dev}1 bs=1 seek=$((0x11)) conv=notrunc
180++
181++ # NOTE: shrinking is the only type of resizing that works.
182++ # resize that file system to be one cylinder (8MiB) smaller
183++ # NOTE: A core dump is expected here, check output to determine if it is the correct failure
184++ fs-resize ${dev}1 0 $new_end > out 2>&1
185++
186++ # Include full output for debugging
187++ cat out
188++
189++ # FAT16 exepcts an Assert in duplicate_legacy_root_dir
190++ # FAT32 expects an Assert in ped_malloc
191++ case $fs_type in
192++ fat16) grep "Assertion.*duplicate_legacy_root_dir" out || fail=1;;
193++ fat32) grep "Assertion.*ped_malloc" out || fail=1;;
194++ esac
195++
196++ # create a clean file system
197++ $mkfs_cmd ${dev}1 || fail=1
198++
199++ # create 500 deep directory tree that overflows the 4096 byte tmp_buffer
200++ # to catch core dump in libparted/fs/r/fat/count.c flag_traverse_dir()
201++ mount "${dev}1" "$mount_point" || fail=1
202++ cat /dev/null > exp
203++ ( cd "$mount_point"; for d in `seq 500`; do mkdir TESTDIRR.DIR; cd TESTDIRR.DIR; done ) > out
204++ compare exp out || fail=1 # Ensure no errors creating directory tree
205++ umount "${dev}1" || fail=1
206++
207++ # Make sure that buffer overflow is caught
208++ fs-resize ${dev}1 0 $new_end > out 2>&1
209++
210++ # Include full output for debugging
211++ cat out
212++
213++ # Confirm that the large dir_name was caught
214++ grep "Assertion.*strlen.*flag_traverse_dir" out || fail=1
215++
216++ # Remove the partition explicitly, so that mklabel doesn't evoke a warning.
217++ parted -s $dev rm 1 || fail=1
218++
219++ # Create a clean partition table for the next iteration.
220++ parted -s $dev mklabel gpt > out 2>&1 || fail=1
221++ # expect no output
222++ compare /dev/null out || fail=1
223++
224++done
225++
226++Exit $fail
227+--
228+2.33.0
229+ 
Mparted.spec+7-1
@@ -14,7 +14,7 @@
14Summary: The GNU disk partition manipulation program14Summary: The GNU disk partition manipulation program
15Name: parted15Name: parted
16Version: 3.616Version: 3.6
17-Release: 317+Release: 4
18URL: https://www.gnu.org/software/parted/18URL: https://www.gnu.org/software/parted/
19Source0: ftp://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.xz19Source0: ftp://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.xz
20License: GPLv3+20License: GPLv3+
@@ -32,6 +32,7 @@ Patch5: 0005-fat_op_context_new-free-ctx-remap-and-goto-correct-l.patch
32Patch6: 0006-hfsplus_cache_from_extent-fix-memleak.patch32Patch6: 0006-hfsplus_cache_from_extent-fix-memleak.patch
33Patch7: 0007-fat_clobber-set-boot_sector-NULL-and-free-boot_secto.patch33Patch7: 0007-fat_clobber-set-boot_sector-NULL-and-free-boot_secto.patch
34 34 
35+Patch6000: backport-CVE-2026-89085-CVE-2026-89088.patch
35Patch9000: 9000-parted-remove-patch-which-modifid-cyl-size.patch36Patch9000: 9000-parted-remove-patch-which-modifid-cyl-size.patch
36 37 
37%description38%description
@@ -117,6 +118,11 @@ fi
117%{_libdir}/pkgconfig/libparted*.pc118%{_libdir}/pkgconfig/libparted*.pc
118 119 
119%changelog120%changelog
121+* Tue Sep 22 2026 Acccll <mail1521@163.com> - 3.6-4
122+- This fixes two CVE's:
123+- CVE-2026-89085 - heap buffer overflow in _init_fats / fat_table_read
124+- CVE-2026-89088 - heap buffer overflow in duplicate_legacy_root_dir
125+ 
120* Fri Jul 25 2025 lvyy <lyunmail@163.com> - 3.6-3126* Fri Jul 25 2025 lvyy <lyunmail@163.com> - 3.6-3
121- delete the ineffective needsrootforbuild configuration127- delete the ineffective needsrootforbuild configuration
122 128