42
30
Security fixes in libfuse-3.18.3
libfuse 3.18.3 disables fuse_session_custom_io() by default to stop non-kernel peers from forging FUSE requests libfuse parses unvalidated.
libfuse 3.18.3 ships security fixes announced by Sam James on the oss-security mailing list. The fuse_session_custom_io() function is now disabled unless libfuse is built with -Denable-custom-io=true, returning -ENOTSUP otherwise. The reason is that a custom io peer might not be a kernel and can forge requests that libfuse parses without validation. The hello_ll_uds example is now built only with that option, and enabling it triggers a warning at configure time.
30
60
30
30
30
47
47
47
30
30
55
30
30
60
30
30
30
30
42
55
55
55
60
55
55
55
30
55
30
30
55
55
60
30
55
55
55
55