mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-09 07:51:59 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/util-linux: backport patch CVE-2025-14104

Browse Source 
- CVE-2025-14104:
    A flaw was found in util-linux. This vulnerability allows a heap
    buffer overread when processing 256-byte usernames, specifically
    within the `setpwnam()` function, affecting SUID (Set User ID) login-
    utils utilities writing to the password database.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2025-14104
  - aaa9e718c8
  - 9a36d77012

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Thomas Perale
2026-06-26 11:57:19 +02:00
parent 0a9d437c60
commit 2d4875d6dc
3 changed files with 65 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
package/util-linux/0008-CVE-2025-14104-1.patch Normal file
View File

@@ -0,0 +1,33 @@
From aaa9e718c88d6916b003da7ebcfe38a3c88df8e6 Mon Sep 17 00:00:00 2001
From: Mohamed Maatallah <hotelsmaatallahrecemail@gmail.com>
Date: Sat, 24 May 2025 03:16:09 +0100
Subject: [PATCH] Update setpwnam.c
Upstream: https://github.com/util-linux/util-linux/commit/aaa9e718c88d6916b003da7ebcfe38a3c88df8e6
CVE: CVE-2025-14104
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
login-utils/setpwnam.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/login-utils/setpwnam.c b/login-utils/setpwnam.c
index 3e3c1abde50..95e470b5a34 100644
--- a/login-utils/setpwnam.c
+++ b/login-utils/setpwnam.c
@@ -126,10 +126,12 @@ int setpwnam(struct passwd *pwd, const char *prefix)
}
/* Is this the username we were sent to change? */
- if (!found && linebuf[namelen] == ':' &&
- !strncmp(linebuf, pwd->pw_name, namelen)) {
- /* Yes! So go forth in the name of the Lord and
- * change it! */
+ if (!found &&
+ strncmp(linebuf, pwd->pw_name, namelen) == 0 &&
+ strlen(linebuf) > namelen &&
+ linebuf[namelen] == ':') {
+ /* Yes! But this time let’s not walk past the end of the buffer
+ * in the name of the Lord, SUID, or anything else. */
if (putpwent(pwd, fp) < 0)
goto fail;
found = 1;

28
package/util-linux/0009-CVE-2025-14104-2.patch Normal file
View File

@@ -0,0 +1,28 @@
From 9a36d77012c4c771f8d51eba46b6e62c29bf572a Mon Sep 17 00:00:00 2001
From: Mohamed Maatallah <hotelsmaatallahrecemail@gmail.com>
Date: Mon, 26 May 2025 10:06:02 +0100
Subject: [PATCH] Update bufflen
Update buflen
Upstream: https://github.com/util-linux/util-linux/commit/9a36d77012c4c771f8d51eba46b6e62c29bf572a
CVE: CVE-2025-14104
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
login-utils/setpwnam.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/login-utils/setpwnam.c b/login-utils/setpwnam.c
index 95e470b5a34..7778e98f7cc 100644
--- a/login-utils/setpwnam.c
+++ b/login-utils/setpwnam.c
@@ -99,7 +99,8 @@ int setpwnam(struct passwd *pwd, const char *prefix)
goto fail;
namelen = strlen(pwd->pw_name);
-
+ if (namelen > buflen)
+ buflen += namelen;
linebuf = malloc(buflen);
if (!linebuf)
goto fail;

4
package/util-linux/util-linux.mk
View File

@@ -39,6 +39,10 @@ UTIL_LINUX_AUTORECONF = YES
# 0006-add-loopdev-fl-nofollow.patch
UTIL_LINUX_IGNORE_CVES += CVE-2026-27456
# 0008-CVE-2025-14104-1.patch
# 0009-CVE-2025-14104-2.patch
UTIL_LINUX_IGNORE_CVES += CVE-2025-14104
UTIL_LINUX_INSTALL_STAGING = YES
UTIL_LINUX_DEPENDENCIES = \
host-pkgconf \