[parted-devel] [PATCH 0/5] Fixes for 2 CVEs and a few other bugs

[Brian C. Lane]

These have been assigned 2 CVE numbers:

- CVE-2026-89085 - heap buffer overflow in _init_fats / fat_table_read
- CVE-2026-89088 - heap buffer overflow in duplicate_legacy_root_dir

These bugs were found by a scan of parted 3.7 by AISLE in partnership
with Red Hat. I received 38 reports of potential vulnerabilities and
triaged it down to 2 somewhat serious CVE issues -- they are buffer
overflows driven by FAT filesystem corruption that might allow data from
the filesystem to be written outside the allocated buffer.

I opted to fix things by using the existing PED_ASSERT system -- I
really do not want to change logic, especially in the filesystem code.
It's better to get these 'fixed' quickly and if someone wants to improve
logic later that's fine.

Most of the things found don't rise to the level of CVE, or even things
I want to fix at the moment (eg. divide by zero errors). They're just
bugs and can be addressed separately. I included a couple of those fixes
here that I felt were obvious enough not to need tests.

A word about AI -- these reports were AI generated, but I examined each
of them in detail to decide if it was a CVE or just a bug. The quality
of the report was decent, I think due to them using -fsanitize=address
to catch problems, it described the problem areas, and how they were
reached. gcc has some pretty good reporting these days and the
reproducers that it reported said they used:

CFLAGS="-O1 -g -fsanitize=address -fno-omit-frame-pointer" ./configure

In the past I've also used valgrind which produced similar results, as
well as the default gcc build settings complaining about various things.

I did not, and will not, use the AI generated fixes. Everything was
written by me, and I have no plans to accept/allow AI generated code in
parted.


!!!WARNING!!!

When building parted for production you should leave debug build mode
enabled (this is the default when you run ./configure with no options).
This enables all the PED_ASSERT checks which keep us safe(er) and which
report unexpected errors.

You should also not be running parted with unexpected inputs, especially
as root. These are likely not the only bugs that can be triggered by
invalid metadata.


Brian C. Lane (5):
  libparted: Catch FAT metadata triggered errors
  resize: Make sure 32bit build cannot overflow frag_count
  resize: Make sure hfsc_new_cachetable cannot overflow on 32bit
  fdasd: Make sure data set name is positive
  parted: Fix partition number allocation in do_print

 libparted/fs/r/fat/context.c |   2 +
 libparted/fs/r/fat/count.c   |   1 +
 libparted/fs/r/fat/resize.c  |   2 +
 libparted/fs/r/hfs/cache.c   |   2 +
 libparted/labels/fdasd.c     |   5 +-
 libparted/libparted.c        |   1 +
 parted/parted.c              |   2 +-
 tests/Makefile.am            |   1 +
 tests/t3001-buffer.sh        | 134 +++++++++++++++++++++++++++++++++++
 9 files changed, 148 insertions(+), 2 deletions(-)
 create mode 100755 tests/t3001-buffer.sh

-- 
2.55.0