Security fixes in libfuse-3.18.3
libfuse 3.18.3 disables fuse_session_custom_io() by default to stop non-kernel peers from forging FUSE requests libfuse parses unvalidated.
libfuse 3.18.3 ships security fixes announced by Sam James on the oss-security mailing list. The fuse_session_custom_io() function is now disabled unless libfuse is built with -Denable-custom-io=true, returning -ENOTSUP otherwise. The reason is that a custom io peer might not be a kernel and can forge requests that libfuse parses without validation. The hello_ll_uds example is now built only with that option, and enabling it triggers a warning at configure time.
- fuse_session_custom_io() disabled by default; requires -Denable-custom-io=true at build time
- Non-kernel custom io peers can forge FUSE requests parsed without validation
- hello_ll_uds example built only with the custom-io option, with configure-time warning
- Released as libfuse 3.18.3 security fixes
- Vendors
- libfuse
- Products
- libfuse
- Organizations
- oss-security
From the original article
Posted by Sam James on Sep 08 From https://github. com/libfuse/libfuse/releases/tag/fuse-3. 18.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.