CVE-2016-5011

What it actually does

The parse_dos_extended function in libblkid fails to validate the offset of an extended partition boot record in an MSDOS partition table, allowing unbounded memory allocation that leads to denial of service.

Why it matters to the business

Systems may become unresponsive or require reboot when a crafted storage device is attached, interrupting operations that rely on disk enumeration or mounting utilities.

How an attack unfolds

An attacker with physical access prepares a storage device containing an MSDOS partition table that places an extended partition boot record at offset zero. When the device is connected, any process using libblkid to inspect partitions triggers the vulnerable parsing path and exhausts available memory.

How to fix it

Upgrade affected Chainguard packages to the versions that resolve the parsing issue: restic-fips to 0.16.5-r2 and restic-fips-compat-fips to 0.16.5-r2. Rebuild and redeploy any container images that pull in the vulnerable libblkid dependency.

How to confirm the fix worked

Confirm package versions match or exceed the fixed releases, then exercise partition inspection on a test device containing both valid and malformed MSDOS tables while monitoring memory usage and process stability.

Typical attack path

1. Craft an MSDOS partition table with an extended partition boot record located at offset zero
2. Attach the malicious storage device to the target system
3. Trigger partition table parsing through disk utilities or automatic mount operations
4. Observe memory consumption leading to service degradation or crash

How to detect it

Review system logs for sudden spikes in memory usage by processes that call libblkid (such as mount, lsblk, or udev workers) coinciding with attachment of external storage; correlate with physical access events when available.

What your security team should do

• Apply the listed package upgrades in all build pipelines and runtime environments
• Restrict physical access to systems that perform automatic storage device discovery
• Include libblkid parsing tests in CI to prevent regression of input validation fixes