UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n substrings.
Weakness
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Udisks | Freedesktop | 2.8.0 (including) | 2.8.0 (including) |
| Red Hat Enterprise Linux 7 | RedHat | udisks2-0:2.7.3-9.el7 | * |
| Udisks2 | Ubuntu | bionic | * |
| Udisks2 | Ubuntu | devel | * |
| Udisks2 | Ubuntu | esm-infra/bionic | * |