🛡️ SUSE-SU-2025:20304-1 — util-linux (CVE-2024-28085)

Security update for util-linux

This update for util-linux fixes the following issues:

• Updated to version 2.40.4:
• agetty: Prevent cursor escape (bsc#1194818)
• chcpu(8): Document CPU deconfiguring behavior
• fdisk: SGI fixes
• hardlink: fix memory corruption
• hardlink.1 directory|file is mandatory
• lib/env: fix env_list_setenv() for strings without '='
• libblkid:

(exfat) validate fields used by prober

(gpt) use blkid_probe_verify_csum() for partition array

checksum

add FSLASTBLOCK for swaparea

bitlocker fix version on big-endian systems

• libfdisk: make sure libblkid uses the same sector size
• libmount:

extract common error handling function

propagate first error of multiple filesystem types

• logger: correctly format tv_usec
• lscpu: Skip aarch64 decode path for rest of the architectures

(bsc#1229476)

• lsns: ignore ESRCH errors reported when accessing files under

/proc

• mkswap: set selinux label also when creating file
• more: make sure we have data on stderr
• nsenter: support empty environ
• umount, losetup: Document loop destroy behavior

(bsc#1159034).

• uuidd: fix /var/lib/libuuid mode uuidd-tmpfiles.conf

fix /var/lib/libuuid mode uuidd-tmpfiles.conf

• Refresh util-linux.keyring. Key validity was extended.
• Update to version 2.40.2:
• cfdisk: fix possible integer overflow
• libmount: improving robustness in reading kernel messages,

add pidfs to pseudo fs list

• lscpu: New Arm Cortex part numbers

fix hang of lscpu -e (bsc#1225598)

• lsfd: Refactor the pidfd logic, support pidfs
• mkswap.8.adoc: update note regarding swapfile creation
• setpgid: make -f work
• Enable kernel mountfd API, as it should be already stable

(PED-9752).

• Move autoreconf back to %build.
• Add devel dependencies.
• Remove util-linux-rpmlintrc. It is no more needed with multibuild.
• uncomment "autoreconf --install" to use the new version of automake
• disable libmagic in more(1) for binary detection (bsc#1225197)
• add support for pidfs in kernel 6.9 (bsc#1224285)
• Update to version 2.40.1:
• more: clean processes not cleaned up after failed SSH session

using up 100% CPU (bsc#1220117)

• CVE-2024-28085: Fixed improper neutralization of escape sequences in wall (bsc#1221831)
• chcpu: document limitations of -g (bsc#1218609)
• lscpu: even more Arm part numbers (bsc#1223605)