CVE-2021-37600

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.

The util-linux package contains a random collection of files that implements some low-level basic linux utilities.

Security Fix(es):

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file.(CVE-2021-37600)

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments. (CVE-2021-37600)

Unauthorized unmount of FUSE filesystems belonging to users with similar uid. (CVE-2021-3995)

Unauthorized unmount of filesystems in libmount (CVE-2021-3996)

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Additional bug fixes included by updating to version 2.36.2. See release notes for details.

This update for util-linux fixes the following issues:

Update to version 2.33.2 to provide seamless update from SLE12 SP5 to SLE15 SP2:

• CVE-2021-37600: Fixed an integer overflow which could lead to a buffer overflow in get_sem_elements() in sys-utils/ipcutils.c (bsc#1188921).
• agetty: Fix 8-bit processing in get_logname() (bsc#1125886).
• mount: Fix 'mount' output for net file systems (bsc#1122417).
• ipcs: Avoid overflows (bsc#1178236)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for util-linux fixes the following issues:

• CVE-2021-37600: Fixed an integer overflow which could lead to a buffer overflow in get_sem_elements() in sys-utils/ipcutils.c. (bsc#1188921)

This update for util-linux fixes the following issues:

• CVE-2021-37600: Fixed an integer overflow which could lead to buffer overflow in get_sem_elements. (bsc#1188921)
• Prevent outdated pam files (bsc#1082293, bsc#1081947#c68).
• Do not trim read-only volumes (bsc#1106214).
• libmount: To prevent incorrect behavior, recognize more pseudofs and netfs (bsc#1122417).
• raw.service: Add RemainAfterExit=yes (bsc#1135534).
• agetty: Reload issue only if it is really needed (bsc#1085196)
• agetty: Return previous response of agetty for special characters (bsc#1085196, bsc#1125886)
• blockdev: Do not fail --report on kpartx-style partitions on multipath. (bsc#1168235)
• nologin: Add support for -c to prevent error from su -c. (bsc#1151708)
• Avoid triggering autofs in lookup_umount_fs_by_statfs. (bsc#1168389)
• libblkid: Do not trigger CDROM autoclose. (bsc#1084671)
• Avoid sulogin failing on not existing or not functional console devices. (bsc#1175514)
• Build with libudev support to support non-root users. (bsc#1169006)
• lscpu: avoid segfault on PowerPC systems with valid hardware configurations. (bsc#1175623, bsc#1178554, bsc#1178825)
• Fix for warning on mounts to CIFS with mount. (SG#57988, bsc#1174942)

This update for util-linux fixes the following issues:

• CVE-2021-37600: Fixed an integer overflow which could lead to a buffer overflow in get_sem_elements() in sys-utils/ipcutils.c. (bsc#1188921)

This update for util-linux fixes the following issues:

• CVE-2021-37600: Fixed an integer overflow which could lead to a buffer overflow in get_sem_elements() in sys-utils/ipcutils.c. (bsc#1188921)

This update for util-linux fixes the following issues:

Update to version 2.33.2 to provide seamless update from SLE12 SP5 to SLE15 SP2:

• CVE-2021-37600: Fixed an integer overflow which could lead to a buffer overflow in get_sem_elements() in sys-utils/ipcutils.c (bsc#1188921).
• agetty: Fix 8-bit processing in get_logname() (bsc#1125886).
• mount: Fix 'mount' output for net file systems (bsc#1122417).
• ipcs: Avoid overflows (bsc#1178236)

This update for util-linux fixes the following issues:

• Improve throughput and reduce clock sequence increments for high load situation with time based version 1 uuids. (bsc#1194642)
• Prevent root owning of /var/lib/libuuid/clock.txt. (bsc#1194642)
• Warn if uuidd lock state is not usable. (bsc#1194642)
• Fix 'su -s' bash completion. (bsc#1172427)
• CVE-2021-37600: Fixed an integer overflow which could lead to buffer overflow in get_sem_elements. (bsc#1188921)
• Load /etc/default/su (bsc#1116347).
• Prevent outdated pam files (bsc#1082293, bsc#1081947#c68).
• Do not trim read-only volumes (bsc#1106214).
• libmount: To prevent incorrect behavior, recognize more pseudofs and netfs (bsc#1122417).
• agetty: Reload issue only if it is really needed (bsc#1085196)
• agetty: Return previous response of agetty for special characters (bsc#1085196, bsc#1125886)
• blockdev: Do not fail --report on kpartx-style partitions on multipath. (bsc#1168235)
• nologin: Add support for -c to prevent error from su -c. (bsc#1151708)
• Avoid triggering autofs in lookup_umount_fs_by_statfs. (bsc#1168389)
• libblkid: Do not trigger CDROM autoclose. (bsc#1084671)
• Avoid sulogin failing on not existing or not functional console devices. (bsc#1175514)
• Build with libudev support to support non-root users. (bsc#1169006)
• lscpu: avoid segfault on PowerPC systems with valid hardware configurations. (bsc#1175623, bsc#1178554, bsc#1178825)
• Fix for warning on mounts to CIFS with mount. (bsc#1174942)

This update for util-linux fixes the following issues:

• Improve throughput and reduce clock sequence increments for high load situation with time based version 1 uuids. (bsc#1194642)
• Prevent root owning of /var/lib/libuuid/clock.txt. (bsc#1194642)
• Warn if uuidd lock state is not usable. (bsc#1194642)
• Fix 'su -s' bash completion. (bsc#1172427)
• CVE-2021-37600: Fixed an integer overflow which could lead to buffer overflow in get_sem_elements. (bsc#1188921)
• Prevent outdated pam files (bsc#1082293, bsc#1081947#c68).
• Do not trim read-only volumes (bsc#1106214).
• libmount: To prevent incorrect behavior, recognize more pseudofs and netfs (bsc#1122417).
• raw.service: Add RemainAfterExit=yes (bsc#1135534).
• agetty: Reload issue only if it is really needed (bsc#1085196)
• agetty: Return previous response of agetty for special characters (bsc#1085196, bsc#1125886)
• blockdev: Do not fail --report on kpartx-style partitions on multipath. (bsc#1168235)
• nologin: Add support for -c to prevent error from su -c. (bsc#1151708)
• Avoid triggering autofs in lookup_umount_fs_by_statfs. (bsc#1168389)
• libblkid: Do not trigger CDROM autoclose. (bsc#1084671)
• Avoid sulogin failing on not existing or not functional console devices. (bsc#1175514)
• Build with libudev support to support non-root users. (bsc#1169006)
• lscpu: avoid segfault on PowerPC systems with valid hardware configurations. (bsc#1175623, bsc#1178554, bsc#1178825)
• Fix warning on mounts to CIFS with mount –a. (bsc#1174942)

This update for util-linux fixes the following issues:

• Improve throughput and reduce clock sequence increments for high load situation with time based version 1 uuids. (bsc#1194642)
• Prevent root owning of /var/lib/libuuid/clock.txt. (bsc#1194642)
• Warn if uuidd lock state is not usable. (bsc#1194642)
• Fix 'su -s' bash completion. (bsc#1172427)
• CVE-2021-37600: Fixed an integer overflow which could lead to buffer overflow in get_sem_elements. (bsc#1188921)
• blockdev: Do not fail --report on kpartx-style partitions on multipath. (bsc#1168235)
• nologin: Add support for -c to prevent error from su -c. (bsc#1151708)
• Avoid triggering autofs in lookup_umount_fs_by_statfs. (bsc#1168389)
• Avoid segfault on PowerPC systems with valid hardware configurations. (bsc#1175623, bsc#1178554, bsc#1178825)
• Do not trigger CDROM autoclose. (bsc#1084671)
• Avoid sulogin failing on not existing or not functional console devices. (bsc#1175514)
• Build with libudev support to support non-root users. (bsc#1169006)
• Fix warning on mounts to CIFS with mount -a. (SG#57988, bsc#1174942)