March 2018 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1083846] New: VUL-0: CVE-2018-0491: tor: use-after-free in KIST scheduler remote relay DoS
by bugzilla_noreply＠novell.com 06 Mar '18

06 Mar '18

http://bugzilla.opensuse.org/show_bug.cgi?id=1083846 Bug ID: 1083846 Summary: VUL-0: CVE-2018-0491: tor: use-after-free in KIST scheduler remote relay DoS Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/201159/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: astieger(a)suse.com Reporter: astieger(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- >From https://lists.torproject.org/pipermail/tor-announce/2018-March/000152.html TROVE-2018-002 affects relays running all 0.3.2.x, versions, as well as 0.3.3.1-alpha. (Because we have found that it can be remotely triggered, we are backporting it and upgrading its severity.) It is a use-after-free bug in the KIST scheduler code, which an attacker can use to cause a relay to crash. Use-after-free bugs can sometimes be turned into worse attacks: we strongly recommend that all relays running 0.3.2.x (or 0.3.3.1-alpha) should upgrade to one of the versions released today. This issue does not affect other versions, and does not affect clients. Relays running 0.3.2.x SHOULD upgrade to one of the versions released today, for the fix to TROVE-2018-002. o Major bugfixes (scheduler, KIST, denial-of-service, backport from 0.3.3.2-alpha): - Avoid adding the same channel twice in the KIST scheduler pending list, which could lead to remote denial-of-service use-after-free attacks against relays. Fixes bug 24700; bugfix on 0.3.2.1-alpha. References: https://trac.torproject.org/projects/tor/ticket/24700 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-0491 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1070872] Raspberry Pi 3 SD Card errors
by bugzilla_noreply＠novell.com 06 Mar '18

06 Mar '18

http://bugzilla.suse.com/show_bug.cgi?id=1070872 http://bugzilla.suse.com/show_bug.cgi?id=1070872#c11 --- Comment #11 from Michal Suchanek <msuchanek(a)suse.com> --- Created attachment 762873 --> http://bugzilla.suse.com/attachment.cgi?id=762873&action=edit workaround that prevents immediate system crash -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1070872] Raspberry Pi 3 SD Card errors
by bugzilla_noreply＠novell.com 06 Mar '18

06 Mar '18

http://bugzilla.suse.com/show_bug.cgi?id=1070872 http://bugzilla.suse.com/show_bug.cgi?id=1070872#c10 --- Comment #10 from Michal Suchanek <msuchanek(a)suse.com> --- The upstream discussion is inconclusive. The maintainers want a reliable reproducer but with each kernel version the frequency at which the bug is triggered varies wildly. With the 4.16-rc3 it is very infrequent again. Do we want the workaround patch? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1081431] qemu: NMI watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [modprobe:238]
by bugzilla_noreply＠novell.com 06 Mar '18

06 Mar '18

http://bugzilla.suse.com/show_bug.cgi?id=1081431 http://bugzilla.suse.com/show_bug.cgi?id=1081431#c7 --- Comment #7 from Matwey Kornilov <matwey.kornilov(a)gmail.com> --- (In reply to Takashi Iwai from comment #6) > Adding Joerg to Cc. > > This might be the same cause we've been seeing in some bug reports with the > nested KVM. Long story in short for the reference. I've spent a lot of time to dig out the root for the issue. Finally, I've accidentally found that 4.16-rc3 host kernel has the issue fixed. From the user space point of view, the way to trigger the issue is to use KVM_IOEVENTFD with len set to 0 (it is valid setting). When len is set to non-zero value - everything works as expected. When it is set to zero, then qemu is receiving notification storm from eventfd, and the guest execution is frozen (only interruptions/timers are executed). -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1081431] qemu: NMI watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [modprobe:238]
by bugzilla_noreply＠novell.com 06 Mar '18

06 Mar '18

http://bugzilla.suse.com/show_bug.cgi?id=1081431 http://bugzilla.suse.com/show_bug.cgi?id=1081431#c6 Takashi Iwai <tiwai(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jroedel(a)suse.com, | |tiwai(a)suse.com --- Comment #6 from Takashi Iwai <tiwai(a)suse.com> --- Adding Joerg to Cc. This might be the same cause we've been seeing in some bug reports with the nested KVM. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1083831] NetworkManager nfs displatcher script broken
by bugzilla_noreply＠novell.com 06 Mar '18

06 Mar '18

http://bugzilla.suse.com/show_bug.cgi?id=1083831 http://bugzilla.suse.com/show_bug.cgi?id=1083831#c3 --- Comment #3 from Swamp Workflow Management <swamp(a)suse.de> --- This is an autogenerated message for OBS integration: This bug (1083831) was mentioned in https://build.opensuse.org/request/show/583664 Factory / NetworkManager -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1079672] NetworkManager does not automatically connect to WLAN anymore
by bugzilla_noreply＠novell.com 06 Mar '18

06 Mar '18

http://bugzilla.suse.com/show_bug.cgi?id=1079672 http://bugzilla.suse.com/show_bug.cgi?id=1079672#c37 --- Comment #37 from Swamp Workflow Management <swamp(a)suse.de> --- This is an autogenerated message for OBS integration: This bug (1079672) was mentioned in https://build.opensuse.org/request/show/583664 Factory / NetworkManager -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1083939] Libreoffice Writer stalled, X server restarted
by bugzilla_noreply＠novell.com 06 Mar '18

06 Mar '18

http://bugzilla.suse.com/show_bug.cgi?id=1083939 http://bugzilla.suse.com/show_bug.cgi?id=1083939#c8 --- Comment #8 from Thomas Schmid <thomi.schmid(a)swissonline.ch> --- Well I don't know if it is reproducable: I have not seen it again, but have not uswd LO Writer yet either. We'll see.. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1079330] /usr/sbin/grub2-check-default error since last update to 20180202
by bugzilla_noreply＠novell.com 06 Mar '18

06 Mar '18

http://bugzilla.suse.com/show_bug.cgi?id=1079330 http://bugzilla.suse.com/show_bug.cgi?id=1079330#c5 --- Comment #5 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-RU-2018:0613-1: An update that has three recommended fixes can now be installed. Category: recommended (low) Bug References: 1065349,1071239,1079330 CVE References: Sources used: SUSE Linux Enterprise Server 12-SP3 (src): grub2-2.02-4.14.1 SUSE Linux Enterprise Desktop 12-SP3 (src): grub2-2.02-4.14.1 SUSE CaaS Platform ALL (src): grub2-2.02-4.14.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1084081] New: Latest fluidsynth update breaks compilation of KDE Minuet
by bugzilla_noreply＠novell.com 06 Mar '18

06 Mar '18

http://bugzilla.opensuse.org/show_bug.cgi?id=1084081 Bug ID: 1084081 Summary: Latest fluidsynth update breaks compilation of KDE Minuet Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: lbeltrame(a)kde.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The reason lies in the pkg-config file shipped by fluidsynth (fluidsynth.pc), which contains, on my system: prefix=/usr exec_prefix=${prefix} libdir=${exec_prefix}//usr/lib64 Note that this will expand to a double /usr there. This causes minuet to fail: ERROR: RPATH "/usr/usr/lib64" on /home/abuild/rpmbuild/BUILDROOT/minuet-17.12.2-1.2.x86_64/usr/lib64/qt5/plugins/minuet/minuetfluidsynthsoundcontroller.so is not allowed -- You are receiving this mail because: You are on the CC list for the bug.

1 2