[ GLSA 202105-03 ] GPT fdisk

[GLSA]

Gentoo Linux Security Advisory

Title: GPT fdisk: Integer underflow (GLSA 202105-03)
Severity: normal
Exploitable: local
Date: 2021-05-26
Bug(s): #768762
ID: 202105-03

Synopsis

An integer underflow in sgdisk from GPT fdisk package might allow
local attacker(s) to escalate privileges.


Background

GPT fdisk (consisting of the gdisk, cgdisk, sgdisk, and fixparts
programs) is a set of text-mode partitioning tools for Linux, FreeBSD,
Mac OS X, and Windows.


Affected Packages

Package: sys-apps/gptfdisk
Vulnerable: < 1.0.6
Unaffected: >= 1.0.6
Architectures: All supported architectures


Description

It was discovered that ReadLogicalParts() function in basicmbr.cc was
missing a bounds check.


Impact

A local attacker could entice a user to insert a malicious formatted
block device (USB stick or SD card for example), that, when processed
with sgdisk, possibly resulting in local escalation of privileges or a
Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All GPT fdisk users should upgrade to the latest version: