opensvc/multipath-tools 0.15.1

multipath-tools 0.15.1

on GitHub

User-visible changes

• The preferredip=parameter for the iet prioritizer has been generalized.
  The new syntax is

  preferredip=<CIDR>:<Prio>[,<CIDR>:<Prio>,...]
  

  where CIDR is an IPv4 address block in CIDR format, e.g. 192.168.1.0/24,
  and <Prio> is the numeric priority to assign to IP addresses in this
  block. See the multipath.conf(5) man page for details. The syntax
  preferredip=<IP> is still supported with the same semantics as before.

Vulnerability fixes

• DoS on mulipathd socket by blocking IPC send operations
• DoS on multipathd socket by exhausting connections
• Heap Out-of-Bounds Read in Custom Format String Parser via Trailing %
• Heap out-of-bounds read in device-mapper-multipath ALUA RTPG parsing
• kpartx: Heap Out-of-Bounds Read in GPT Header Validation
• Path traversal in device-mapper-multipath failed_wwids management
  
• libmpathpersist PRIN READ FULL STATUS parser — unbounded descriptor rewrite causes root heap overflow

Bug fixes

• Fix a use-after-free error introduced by the fix for
  #152 in 0.15.0.
  Fixes openSUSE#24.

• When parsing the device-mapper table of a multipath device, the result for
  path arguments was not checked for NULL. This happens if the kernel
  returns an invalid table with missing path arguments. Fix it by adding
  a NULL check (commit ac9fe05).
  Fixes #155,
  #156.