<html><body><div dir="auto">Source: libblockdev<br>Version: 3.5.0-2<br>Severity: important<br>Tags: security patch upstream<br><br>Hi,<br><br>CVE-2026-111581 (<a href="https://www.google.com/url?q=https://bugzilla.redhat.com/show_bug.cgi?id%3D2554104&source=gmail&ust=1793770567286000&sa=E">https://www.google.com/url?q=https://bugzilla.redhat.com/show_bug.cgi?id%3D2554104&source=gmail&ust=1793770567286000&sa=E</a>)<br>has no Debian bug yet; the tracker lists libblockdev <unfixed>.<br><br>bd_fs_vfat_set_label() and bd_fs_ntfs_set_label() run fatlabel and<br>ntfslabel with the caller's label as a bare positional argument. A label<br>that starts with "-" is therefore parsed as an option by those tools.<br>Red Hat notes this is reachable through udisks2's Filesystem.SetLabel()<br>for an active local session.<br><br>There is no upstream fix yet: no commit, PR or issue in<br>storaged-project/libblockdev as of 2026-11-03, and the last release is<br>3.5.0. A minimal fix is to end option parsing with "--". The patch below<br>is against 3.5.0-2. It changes only the argv layout: "--reset" stays<br>before "--", and the device and label follow it.<br><br>--- a/src/plugins/fs/vfat.c<br>+++ b/src/plugins/fs/vfat.c<br>@@ -288,7 +288,9 @@<br> * Tech category: %BD_FS_TECH_VFAT-%BD_FS_TECH_MODE_SET_LABEL<br> */<br> gboolean bd_fs_vfat_set_label (const gchar *device, const gchar *label, GError **error) {<br>- const gchar *args[4] = {"fatlabel", device, NULL, NULL};<br>+ /* "--" ends option parsing so that a label starting with "-" is not<br>+ * interpreted by fatlabel as an option (CVE-2026-111581) */<br>+ const gchar *args[5] = {"fatlabel", "--", device, NULL, NULL};<br> UtilDep dep = {"fatlabel", "4.2", "--version", "fatlabel\\s+([\\d\\.]+).+"};<br> gchar *label_up = NULL;<br> gboolean new_vfat = FALSE;<br>@@ -302,14 +304,17 @@<br> new_vfat = bd_utils_check_util_version (<a href="https://www.google.com/url?q=http://dep.name&source=gmail&ust=1793770567286000&sa=E">https://www.google.com/url?q=http://dep.name&source=gmail&ust=1793770567286000&sa=E</a>, dep.version,<br> dep.ver_arg, dep.ver_regexp,<br> NULL);<br>- if (new_vfat)<br>- args[2] = "--reset";<br>+ if (new_vfat) {<br>+ args[1] = "--reset";<br>+ args[2] = "--";<br>+ args[3] = device;<br>+ }<br> }<br> <br> /* forcefully convert the label uppercase in case no reset was requested */<br>- if (label && args[2] == NULL) {<br>+ if (label && args[3] == NULL) {<br> label_up = g_ascii_strup (label, -1);<br>- args[2] = label_up;<br>+ args[3] = label_up;<br> }<br> ret = bd_utils_exec_and_report_error (args, NULL, error);<br> g_free (label_up);<br>--- a/src/plugins/fs/ntfs.c<br>+++ b/src/plugins/fs/ntfs.c<br>@@ -223,7 +223,9 @@<br> * Tech category: %BD_FS_TECH_NTFS-%BD_FS_TECH_MODE_SET_LABEL<br> */<br> gboolean bd_fs_ntfs_set_label (const gchar *device, const gchar *label, GError **error) {<br>- const gchar *args[4] = {"ntfslabel", device, label, NULL};<br>+ /* "--" ends option parsing so that a label starting with "-" is not<br>+ * interpreted by ntfslabel as an option (CVE-2026-111581) */<br>+ const gchar *args[5] = {"ntfslabel", "--", device, label, NULL};<br> <br> if (!check_deps (&avail_deps, DEPS_NTFSLABEL_MASK, deps, DEPS_LAST, &deps_check_lock, error))<br> return FALSE;<br><br>Testing: I did not rebuild libblockdev; that needs more -dev packages<br>than I have here. Instead I ran the exact argv vectors that 3.5.0 builds<br>and the patched ones against the real tools from sid (dosfstools 4.2-1.2<br>and ntfs-3g 1:2026.9.28-2), on 16 MB image files. Each case started from<br>the label "RESETME":<br><br> case 3.5.0 argv patched argv<br> vfat "DATA" label DATA label DATA<br> vfat "-V" prints fatlabel version, label "-V"<br> label unchanged<br> vfat --reset label cleared label cleared<br> ntfs "DATA" label DATA label DATA<br> ntfs "-n" parsed as an option (prints the label "-n"<br> current label), label unchanged<br><br>So with "--", labels are always taken literally, and the normal and<br>--reset paths behave as before. Both tools use getopt, which honours<br>"--"; the same applies to older fatlabel without --reset, where the<br>layout is "fatlabel -- device label".<br><br>An alternative or additional hardening would be to reject a leading "-"<br>in bd_fs_vfat_check_label()/bd_fs_ntfs_check_label(). However, labels<br>such as "-DATA-" are legitimate, so "--" seems the better fix.<br><br>This should probably be forwarded upstream too; I haven't opened<br>anything there.<br><br>Thanks!<br></div></body></html>