REDHAT-BUG-2494101: Use After Free
A heap use-after-free vulnerability was found in libblkid's nested partition probing code in util-linux. The probebsdpt() function in libblkid/src/partitions/bsd.c caches a blkidpartition parent pointer into the partlist's heap-allocated parts[] array, then loops calling blkidpartlistaddpartition(), which may reallocarray() the same array. After reallocation, the stale parent pointer is dereferenced via blkidpartitiongetstart() — an 8-byte heap use-after-free read. The same dangling-pointer pattern exists in the minix, solarisx86, and unixware nested probers.
A crafted 2 MiB DOS/MBR disk image with three BSD-typed primaries (each holding >=16 slices) plus an md-raid 0.90 superblock triggers the issue via stock blkid -p. libblkid runs as root via udev/udisks on every block-device hot-plug event.
Upstream fix: https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
util-linux/libblkidto a version that resolves this vulnerability.Patch c0186f14fbdb02f64c8e0ba701ce727ea764ff4c - Compensating control
Reduce exposure by limiting blkid/libblkid execution on hot-plug block-device events (e.g., restrict udev/udisks-triggered probing to trusted devices or disable/limit udev rules that invoke util-linux libblkid for untrusted removable media).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2494101?
The severity of REDHAT-BUG-2494101 is classified as medium (4).
What type of vulnerability is described in REDHAT-BUG-2494101?
REDHAT-BUG-2494101 describes a heap use-after-free vulnerability in libblkid's nested partition probing code.
How do I fix REDHAT-BUG-2494101?
To fix REDHAT-BUG-2494101, you need to update the util-linux package to the latest version that addresses this vulnerability.
Which software is affected by REDHAT-BUG-2494101?
The software affected by REDHAT-BUG-2494101 is util-linux and its libblkid library.
What functions are involved in the vulnerability described in REDHAT-BUG-2494101?
The probe_bsd_pt() function in libblkid/src/partitions/bsd.c is involved in the vulnerability described in REDHAT-BUG-2494101.