diff -pruN 3.3.0-2.1/NEWS.rst 3.3.1-1/NEWS.rst --- 3.3.0-2.1/NEWS.rst 2025-02-13 13:14:50.000000000 +0000 +++ 3.3.1-1/NEWS.rst 2025-06-18 07:12:41.000000000 +0000 @@ -1,3 +1,15 @@ +Libblockdev 3.3.1 +------------------ + +New bugfix release of libblockdev library fixing the LPE issue CVE-2025-6019. + +**Full list of changes** + +Thomas Blume (1): + +- Don't allow suid and dev set on fs resize + + Libblockdev 3.3.0 ------------------ diff -pruN 3.3.0-2.1/configure.ac 3.3.1-1/configure.ac --- 3.3.0-2.1/configure.ac 2025-02-13 13:14:50.000000000 +0000 +++ 3.3.1-1/configure.ac 2025-06-18 07:12:41.000000000 +0000 @@ -1,6 +1,6 @@ # configure.ac for libblockdev -AC_INIT([libblockdev], [3.3.0], [], [], [https://github.com/storaged-project/libblockdev]) +AC_INIT([libblockdev], [3.3.1], [], [], [https://github.com/storaged-project/libblockdev]) # Disable building static libraries. # This needs to be set before initializing automake diff -pruN 3.3.0-2.1/debian/changelog 3.3.1-1/debian/changelog --- 3.3.0-2.1/debian/changelog 2025-06-09 13:06:46.000000000 +0000 +++ 3.3.1-1/debian/changelog 2025-08-14 10:23:08.000000000 +0000 @@ -1,3 +1,11 @@ +libblockdev (3.3.1-1) unstable; urgency=medium + + * New upstream release + * Rebase patches + * Bump Standards-Version to 4.7.2 + + -- Michael Biebl Thu, 14 Aug 2025 12:23:08 +0200 + libblockdev (3.3.0-2.1) unstable; urgency=high * Non-maintainer upload by the Security Team. diff -pruN 3.3.0-2.1/debian/control 3.3.1-1/debian/control --- 3.3.0-2.1/debian/control 2025-06-09 13:04:43.000000000 +0000 +++ 3.3.1-1/debian/control 2025-08-14 10:23:08.000000000 +0000 @@ -34,7 +34,7 @@ Build-Depends: debhelper-compat (= 13), libatasmart-dev (>= 0.17), gtk-doc-tools, pylint:native , -Standards-Version: 4.7.0 +Standards-Version: 4.7.2 Rules-Requires-Root: no Vcs-Browser: https://salsa.debian.org/utopia-team/libblockdev Vcs-Git: https://salsa.debian.org/utopia-team/libblockdev.git diff -pruN 3.3.0-2.1/debian/patches/dont-allow-suid-and-dev-set-on-fs-resize.patch 3.3.1-1/debian/patches/dont-allow-suid-and-dev-set-on-fs-resize.patch --- 3.3.0-2.1/debian/patches/dont-allow-suid-and-dev-set-on-fs-resize.patch 2025-06-09 13:06:46.000000000 +0000 +++ 3.3.1-1/debian/patches/dont-allow-suid-and-dev-set-on-fs-resize.patch 1970-01-01 00:00:00.000000000 +0000 @@ -1,27 +0,0 @@ -From 8e072f794744bd17c57cceabb3884d3f0f6a1602 Mon Sep 17 00:00:00 2001 -From: Thomas Blume -Date: Fri, 16 May 2025 14:27:10 +0200 -Subject: [PATCH] dont allow suid and dev set on fs resize - ---- - src/plugins/fs/generic.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/src/plugins/fs/generic.c b/src/plugins/fs/generic.c -index 69333944..1a6dd960 100644 ---- a/src/plugins/fs/generic.c -+++ b/src/plugins/fs/generic.c -@@ -683,7 +683,9 @@ static gchar* fs_mount (const gchar *device, gchar *fstype, gboolean read_only, - "Failed to create temporary directory for mounting '%s'.", device); - return NULL; - } -- ret = bd_fs_mount (device, mountpoint, fstype, read_only ? "ro" : NULL, NULL, &l_error); -+ -+ ret = bd_fs_mount (device, mountpoint, fstype, read_only ? "nosuid,nodev,ro" : "nosuid,nodev", NULL, &l_error); -+ - if (!ret) { - g_propagate_prefixed_error (error, l_error, "Failed to mount '%s': ", device); - g_rmdir (mountpoint); --- -2.48.1 - diff -pruN 3.3.0-2.1/debian/patches/series 3.3.1-1/debian/patches/series --- 3.3.0-2.1/debian/patches/series 2025-06-09 13:06:46.000000000 +0000 +++ 3.3.1-1/debian/patches/series 2025-08-14 10:23:08.000000000 +0000 @@ -1,2 +1 @@ Skip-smartmontools-integration-test.patch -dont-allow-suid-and-dev-set-on-fs-resize.patch diff -pruN 3.3.0-2.1/dist/libblockdev.spec.in 3.3.1-1/dist/libblockdev.spec.in --- 3.3.0-2.1/dist/libblockdev.spec.in 2025-02-13 13:14:50.000000000 +0000 +++ 3.3.1-1/dist/libblockdev.spec.in 2025-06-18 07:12:41.000000000 +0000 @@ -85,7 +85,7 @@ %define configure_opts %{?python3_copts} %{?lvm_dbus_copts} %{?btrfs_copts} %{?crypto_copts} %{?dm_copts} %{?loop_copts} %{?lvm_copts} %{?lvm_dbus_copts} %{?mdraid_copts} %{?mpath_copts} %{?swap_copts} %{?part_copts} %{?fs_copts} %{?nvdimm_copts} %{?tools_copts} %{?gi_copts} %{?nvme_copts} %{?smart_copts} %{?smartmontools_copts} Name: libblockdev -Version: 3.3.0 +Version: 3.3.1 Release: 1%{?dist} Summary: A library for low-level manipulation with block devices License: LGPL-2.1-or-later @@ -958,6 +958,9 @@ find %{buildroot} -type f -name "*.la" | %files plugins-all %changelog +* Wed Jun 18 2025 Vojtech Trefny - 3.3.1-1 +- Don't allow suid and dev set on fs resize (Thomas.Blume) + * Thu Feb 13 2025 Vojtech Trefny - 3.3.0-1 - lvm: Fix check for BD_LVM_TECH_CONFIG availability in CLI plugin (vtrefny) - lvm: Require higher version of LVM for lvm.conf parsing (vtrefny) diff -pruN 3.3.0-2.1/src/plugins/fs/generic.c 3.3.1-1/src/plugins/fs/generic.c --- 3.3.0-2.1/src/plugins/fs/generic.c 2025-02-13 13:14:50.000000000 +0000 +++ 3.3.1-1/src/plugins/fs/generic.c 2025-06-18 07:12:41.000000000 +0000 @@ -683,7 +683,7 @@ static gchar* fs_mount (const gchar *dev "Failed to create temporary directory for mounting '%s'.", device); return NULL; } - ret = bd_fs_mount (device, mountpoint, fstype, read_only ? "ro" : NULL, NULL, &l_error); + ret = bd_fs_mount (device, mountpoint, fstype, read_only ? "nosuid,nodev,ro" : "nosuid,nodev", NULL, &l_error); if (!ret) { g_propagate_prefixed_error (error, l_error, "Failed to mount '%s': ", device); g_rmdir (mountpoint);