Skip to content

Update util-linux from 2.33 to 2.37.3 #2571

Merged
merged 3 commits into from
Feb 18, 2022

Conversation

pmenzel
Copy link
Collaborator

@pmenzel pmenzel commented Jan 25, 2022

No description provided.

The directory does not contain the patch version.

    [BEE] fetching https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.37.3/util-linux-2.37.3.tar.xz
    --2022-01-25 09:16:07--  https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.37.3/util-linux-2.37.3.tar.xz
    Resolving mirrors.edge.kernel.org... 147.75.101.1, 2604:1380:2001:3900::1
    Connecting to mirrors.edge.kernel.org|147.75.101.1|:443... connected.
    HTTP request sent, awaiting response... 404 Not Found
    2022-01-25 09:16:08 ERROR 404: Not Found.

So only use the major and minor version.
1.  https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.34/v2.34-ReleaseNotes
2.  https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.35/v2.35-ReleaseNotes
3.  https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.36/v2.36-ReleaseNotes
4.  https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37-ReleaseNotes

From [util-linux 2.37.3 Release Notes][1]:

> This release fixes two security mount(8) and umount(8) issues:
>
> CVE-2021-3996
>     Improper UID check in libmount allows an unprivileged user to unmount FUSE
>     filesystems of users with similar UID.
>
> CVE-2021-3995
>     This issue is related to parsing the /proc/self/mountinfo file allows an
>     unprivileged user to unmount other user's filesystems that are either
>     world-writable themselves or mounted in a world-writable directory.

[1]: https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v2.37/v2.37.3-ReleaseNotes
Copy link
Collaborator

@wwwutz wwwutz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use beehive URLs. Workflow should be:

  1. SRCURL pointing to ${PKVERSION}
  2. let bee download the source
  3. md5repo.sh the downloaded file
  4. add SRCURL from md5repo.sh to be0
  5. comment out variable SRCURL
  6. rerun .be0

@pmenzel pmenzel requested a review from wwwutz February 17, 2022 16:49
@pmenzel pmenzel merged commit 28d2793 into master Feb 18, 2022
Sign in to join this conversation on GitHub.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants