From 2d4875d6dcd0ba62cb1dfd91a86f43b788fd81c1 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Fri, 26 Jun 2026 11:57:19 +0200 Subject: [PATCH] package/util-linux: backport patch CVE-2025-14104 - CVE-2025-14104: A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login- utils utilities writing to the password database. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2025-14104 - https://github.com/util-linux/util-linux/commit/aaa9e718c88d6916b003da7ebcfe38a3c88df8e6 - https://github.com/util-linux/util-linux/commit/9a36d77012c4c771f8d51eba46b6e62c29bf572a Signed-off-by: Thomas Perale --- .../util-linux/0008-CVE-2025-14104-1.patch | 33 +++++++++++++++++++ .../util-linux/0009-CVE-2025-14104-2.patch | 28 ++++++++++++++++ package/util-linux/util-linux.mk | 4 +++ 3 files changed, 65 insertions(+) create mode 100644 package/util-linux/0008-CVE-2025-14104-1.patch create mode 100644 package/util-linux/0009-CVE-2025-14104-2.patch diff --git a/package/util-linux/0008-CVE-2025-14104-1.patch b/package/util-linux/0008-CVE-2025-14104-1.patch new file mode 100644 index 0000000000..e14a0458ad --- /dev/null +++ b/package/util-linux/0008-CVE-2025-14104-1.patch @@ -0,0 +1,33 @@ +From aaa9e718c88d6916b003da7ebcfe38a3c88df8e6 Mon Sep 17 00:00:00 2001 +From: Mohamed Maatallah +Date: Sat, 24 May 2025 03:16:09 +0100 +Subject: [PATCH] Update setpwnam.c + +Upstream: https://github.com/util-linux/util-linux/commit/aaa9e718c88d6916b003da7ebcfe38a3c88df8e6 +CVE: CVE-2025-14104 +Signed-off-by: Thomas Perale +--- + login-utils/setpwnam.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/login-utils/setpwnam.c b/login-utils/setpwnam.c +index 3e3c1abde50..95e470b5a34 100644 +--- a/login-utils/setpwnam.c ++++ b/login-utils/setpwnam.c +@@ -126,10 +126,12 @@ int setpwnam(struct passwd *pwd, const char *prefix) + } + + /* Is this the username we were sent to change? */ +- if (!found && linebuf[namelen] == ':' && +- !strncmp(linebuf, pwd->pw_name, namelen)) { +- /* Yes! So go forth in the name of the Lord and +- * change it! */ ++ if (!found && ++ strncmp(linebuf, pwd->pw_name, namelen) == 0 && ++ strlen(linebuf) > namelen && ++ linebuf[namelen] == ':') { ++ /* Yes! But this time let’s not walk past the end of the buffer ++ * in the name of the Lord, SUID, or anything else. */ + if (putpwent(pwd, fp) < 0) + goto fail; + found = 1; diff --git a/package/util-linux/0009-CVE-2025-14104-2.patch b/package/util-linux/0009-CVE-2025-14104-2.patch new file mode 100644 index 0000000000..16b66a23cc --- /dev/null +++ b/package/util-linux/0009-CVE-2025-14104-2.patch @@ -0,0 +1,28 @@ +From 9a36d77012c4c771f8d51eba46b6e62c29bf572a Mon Sep 17 00:00:00 2001 +From: Mohamed Maatallah +Date: Mon, 26 May 2025 10:06:02 +0100 +Subject: [PATCH] Update bufflen + +Update buflen + +Upstream: https://github.com/util-linux/util-linux/commit/9a36d77012c4c771f8d51eba46b6e62c29bf572a +CVE: CVE-2025-14104 +Signed-off-by: Thomas Perale +--- + login-utils/setpwnam.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/login-utils/setpwnam.c b/login-utils/setpwnam.c +index 95e470b5a34..7778e98f7cc 100644 +--- a/login-utils/setpwnam.c ++++ b/login-utils/setpwnam.c +@@ -99,7 +99,8 @@ int setpwnam(struct passwd *pwd, const char *prefix) + goto fail; + + namelen = strlen(pwd->pw_name); +- ++ if (namelen > buflen) ++ buflen += namelen; + linebuf = malloc(buflen); + if (!linebuf) + goto fail; diff --git a/package/util-linux/util-linux.mk b/package/util-linux/util-linux.mk index 64da9ab5d5..22c314ce82 100644 --- a/package/util-linux/util-linux.mk +++ b/package/util-linux/util-linux.mk @@ -39,6 +39,10 @@ UTIL_LINUX_AUTORECONF = YES # 0006-add-loopdev-fl-nofollow.patch UTIL_LINUX_IGNORE_CVES += CVE-2026-27456 +# 0008-CVE-2025-14104-1.patch +# 0009-CVE-2025-14104-2.patch +UTIL_LINUX_IGNORE_CVES += CVE-2025-14104 + UTIL_LINUX_INSTALL_STAGING = YES UTIL_LINUX_DEPENDENCIES = \ host-pkgconf \