[ GLSA 202107-15 ] blktrace

[GLSA]

Gentoo Linux Security Advisory

Title: blktrace: Buffer overflow (GLSA 202107-15)
Severity: normal
Exploitable: local, remote
Date: 2021-07-08
Bug(s): #655146
ID: 202107-15

Synopsis

A buffer overflow in blktrace might allow arbitrary code execution.

Background

blktrace shows detailed information about what is happening on a block
device IO queue.


Affected Packages

Package: sys-block/blktrace
Vulnerable: < 1.2.0_p20210419122502
Unaffected: >= 1.2.0_p20210419122502
Architectures: All supported architectures


Description

A crafted file could cause a buffer overflow in the ‘dev_map_read’
function because the device and devno arrays are too small.


Impact

A remote attacker could entice a user to open a specially crafted file
using blktrace, possibly resulting in execution of arbitrary code with
the privileges of the process or a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All blktrace users should upgrade to the latest version: