From 02db679c80b622b0e0311e628e08b76c0b2658fd Mon Sep 17 00:00:00 2001 From: Julian Stecklina Date: Fri, 4 Sep 2026 15:10:22 +0200 Subject: [PATCH] util-linux: 2.42.2 -> 2.42.3 Fixes: CVE-2026-76642 Fixes: CVE-2026-78410 Fixes: CVE-2026-78409 Fixes: CVE-2026-78408 Fixes: GHSA-4558-p62c-vv5v --- .../ut/util-linux/CVE-2026-78408.patch | 80 +++++++++++++++++++ .../ut/util-linux/libmount-build-fix.patch | 35 ++++++++ pkgs/by-name/ut/util-linux/package.nix | 12 ++- 3 files changed, 125 insertions(+), 2 deletions(-) create mode 100644 pkgs/by-name/ut/util-linux/CVE-2026-78408.patch create mode 100644 pkgs/by-name/ut/util-linux/libmount-build-fix.patch diff --git a/pkgs/by-name/ut/util-linux/CVE-2026-78408.patch b/pkgs/by-name/ut/util-linux/CVE-2026-78408.patch new file mode 100644 index 000000000000..f2a2d4a1b43e --- /dev/null +++ b/pkgs/by-name/ut/util-linux/CVE-2026-78408.patch @@ -0,0 +1,80 @@ +From 286dd3ff41526b582ef48830de239dffbaa61f90 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Thu, 3 Sep 2026 12:17:14 +0200 +Subject: [PATCH] nsenter: close cgroup.procs fd after join to prevent + authority leak [CVE-2026-78408] + +The --join-cgroup option opens the target's cgroup.procs while running +as root and writes nsenter's own PID to migrate itself. The descriptor +was left open across subsequent namespace transitions, credential drops +(setgroups/setgid/setuid) and execve(). + +The kernel performs cgroup migration permission checks using the +credentials captured at open time (file->f_cred). An open cgroup.procs +descriptor therefore carries the opener's migration authority regardless +of later privilege changes. A program executed inside the target +namespace inherits root's cgroup migration capability even when running +as an unprivileged user with no capabilities. + +Fix this by: + + - closing the temporary /proc/PID/cgroup fd after reading the path + - adding O_CLOEXEC to the cgroup.procs open as defense in depth + - closing cgroup_procs_fd immediately after the self-migration write + - initializing the temporary cgroup fd to -1 instead of 0 to avoid + accidentally closing stdin via open_target_fd() + +The descriptor has no legitimate use after the single migration write. + +Introduced-by: b40650b71a74 ("nsenter: add option -c to join the cgroup of target process") +References: b0cf1cf0d255 ("nsenter: close cgroup.procs fd after join to prevent authority leak") +Signed-off-by: Karel Zak +(cherry picked from commit afe067c979b9ba2cbe856f7c6411210120ea62aa) +--- + sys-utils/nsenter.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/sys-utils/nsenter.c b/sys-utils/nsenter.c +index 62ef366d430..f449c65d2b4 100644 +--- a/sys-utils/nsenter.c ++++ b/sys-utils/nsenter.c +@@ -466,7 +466,7 @@ static int get_ns_ino(const char *path, ino_t *ino) + static void open_cgroup_procs(void) + { + char *buf = NULL, *path = NULL, *p; +- int cgroup_fd = 0; ++ int cgroup_fd = -1; + char fdpath[PATH_MAX]; + + open_target_fd(&cgroup_fd, "cgroup", optarg); +@@ -474,6 +474,8 @@ static void open_cgroup_procs(void) + if (read_all_alloc(cgroup_fd, &buf) < 1) + err(EXIT_FAILURE, _("failed to get cgroup path")); + ++ close(cgroup_fd); ++ + p = strtok(buf, "\n"); + if (p) + path = strrchr(p, ':'); +@@ -483,7 +485,7 @@ static void open_cgroup_procs(void) + + snprintf(fdpath, sizeof(fdpath), _PATH_SYS_CGROUP "/%s/cgroup.procs", path); + +- if ((cgroup_procs_fd = open(fdpath, O_WRONLY | O_APPEND)) < 0) ++ if ((cgroup_procs_fd = open(fdpath, O_WRONLY | O_APPEND | O_CLOEXEC)) < 0) + err(EXIT_FAILURE, _("failed to open cgroup.procs")); + + free(buf); +@@ -923,8 +925,11 @@ int main(int argc, char *argv[]) + } + + // Join into the target cgroup +- if (cgroup_procs_fd >= 0) ++ if (cgroup_procs_fd >= 0) { + join_into_cgroup(); ++ close(cgroup_procs_fd); ++ cgroup_procs_fd = -1; ++ } + + if (uid_gid_fd >= 0) { + struct stat st; diff --git a/pkgs/by-name/ut/util-linux/libmount-build-fix.patch b/pkgs/by-name/ut/util-linux/libmount-build-fix.patch new file mode 100644 index 000000000000..36d6f968bc35 --- /dev/null +++ b/pkgs/by-name/ut/util-linux/libmount-build-fix.patch @@ -0,0 +1,35 @@ +From a323dddbcd1ed05a10e7e870b3e1a48b4ed44a43 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Wed, 2 Sep 2026 13:32:27 +0200 +Subject: [PATCH] libmount: add missing fileutils.h include to hook_idmap.c + +The hook_idmap.c uses RESOLVE_NO_SYMLINKS (added by commit fb8e26535) +but does not include fileutils.h, which provides the fallback #define +for this constant. + +On Fedora (glibc 2.40+), this is masked because glibc's + transitively includes , which +defines RESOLVE_NO_SYMLINKS. On Ubuntu (and other distros with older +glibc), does not pull in openat2.h, so the build fails: + + hook_idmap.c:335:33: error: 'RESOLVE_NO_SYMLINKS' undeclared + +Fixes: fb8e26535 ("libmount: pin source path with openat2() for restricted users") +Signed-off-by: Karel Zak +(cherry picked from commit 7e2e010874b10b3aabdc3c4c844c9ffc46a4a374) +--- + libmount/src/hook_idmap.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/libmount/src/hook_idmap.c b/libmount/src/hook_idmap.c +index 77494e29810..2c697b17154 100644 +--- a/libmount/src/hook_idmap.c ++++ b/libmount/src/hook_idmap.c +@@ -23,6 +23,7 @@ + + #include "strutils.h" + #include "all-io.h" ++#include "fileutils.h" + #include "namespace.h" + + #include "mountP.h" diff --git a/pkgs/by-name/ut/util-linux/package.nix b/pkgs/by-name/ut/util-linux/package.nix index 46c428876cac..56ada6d03da3 100644 --- a/pkgs/by-name/ut/util-linux/package.nix +++ b/pkgs/by-name/ut/util-linux/package.nix @@ -43,11 +43,11 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "util-linux" + lib.optionalString isMinimal "-minimal"; - version = "2.42.2"; + version = "2.42.3"; src = fetchurl { url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor finalAttrs.version}/util-linux-${finalAttrs.version}.tar.xz"; - hash = "sha256-A6BdOt+WAu8Sjy2gW4SzIFzmDDUeVzfANw90AAZ5zoo="; + hash = "sha256-Zqx8DnJSeOsrA54xBPLJERk0HZQbQbrHooXGlflAvVc="; }; # Note: fetchpatch/fetchpatch2 cause infinite recursion with util-linuxMinimal. @@ -57,6 +57,14 @@ stdenv.mkDerivation (finalAttrs: { # which isn't valid on NixOS (and a compatibility link on most other modern # distros anyway). ./rtcwake-search-PATH-for-shutdown.patch + + # Build fix. Can be removed in 2.42.4 (or newer). + # https://github.com/util-linux/util-linux/commit/a323dddbcd1ed05a10e7e870b3e1a48b4ed44a43 + ./libmount-build-fix.patch + + # Fixes incomplete security fix in 2.42.3: + # https://github.com/util-linux/util-linux/commit/286dd3ff41526b582ef48830de239dffbaa61f90 + ./CVE-2026-78408.patch ]; # We separate some of the utilities into their own outputs. This