Security fixes in libfuse-3.18.3
libfuse 3.18.3 disables fuse_session_custom_io() by default to stop non-kernel peers from forging FUSE requests libfuse parses unvalidated.
libfuse 3.18.3 ships security fixes announced by Sam James on the oss-security mailing list. The fuse_session_custom_io() function is now disabled unless libfuse is built with -Denable-custom-io=true, returning -ENOTSUP otherwise. The reason is that a custom io peer might not be a kernel and can forge requests that libfuse parses without validation. The hello_ll_uds example is now built only with that option, and enabling it triggers a warning at configure time.
- fuse_session_custom_io() disabled by default; requires -Denable-custom-io=true at build time
- Non-kernel custom io peers can forge FUSE requests parsed without validation
- hello_ll_uds example built only with the custom-io option, with configure-time warning
- Released as libfuse 3.18.3 security fixes
Posted by Sam James on Sep 08 From https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.3 """ Security Fixes fuse_session_custom_io() is disabled unless libfuse is built with -Denable-custom-io=true, and returns -ENOTSUP otherwise. The hello_ll_uds example is built only with that option, and enabling it warns at configure time. Reason is a custom io peer might not be a kernel and can forge requests that libfuse parses without...
This source does not provide full text. Read it at seclists.org.