March 2019 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1036967] New: VUL-1: libmad: heap-based buffer overflow in mad_bit_skip (bit.c)
by bugzilla_noreply＠novell.com 27 Jul '22

27 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1036967 Bug ID: 1036967 Summary: VUL-1: libmad: heap-based buffer overflow in mad_bit_skip (bit.c) Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 723244 --> http://bugzilla.opensuse.org/attachment.cgi?id=723244&action=edit 00211-libmad-heapoverflow-mad_bit_skip_reproducer Ref: https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-i… =========================================================== Description: libmad stays for “M”peg “A”udio “D”ecoder library. There is an heap overflow discovered through madplay. The complete ASan output: # madplay -v -i -o raw:out $FILE ==12603==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61200000c09f at pc 0x7f72d6aa05c0 bp 0x7fff03e32040 sp 0x7fff03e32038 READ of size 1 at 0x61200000c09f thread T0 #0 0x7f72d6aa05bf in mad_bit_skip /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/bit.c:130:21 #1 0x7f72d6b032ad in III_huffdecode /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/layer3.c:953:3 #2 0x7f72d6b032ad in III_decode /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/layer3.c:2403 #3 0x7f72d6af1a8e in mad_layer_III /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/layer3.c:2648:13 #4 0x7f72d6ab584d in mad_frame_decode /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/frame.c:453:7 #5 0x7f72d6ada4e4 in run_sync /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/decoder.c:404:11 #6 0x7f72d6ad8c59 in mad_decoder_run /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/decoder.c:557:12 #7 0x5277a1 in decode /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:1862:12 #8 0x5277a1 in play_one /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:1951 #9 0x5277a1 in play_all /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:2041 #10 0x5215a2 in player_run /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:2768:14 #11 0x50c46c in main /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/madplay.c:816:7 #12 0x7f72d599d78f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 #13 0x41aa78 in _init (/usr/bin/madplay+0x41aa78) Affected version: 0.15.1b Fixed version: N/A Commit fix: N/A Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00211-libmad-heapoverflow-mad_b… Timeline: 2017-01-01: bug discovered and reported to upstream 2017-04-30: blog post about the issue Note: This bug was found with American Fuzzy Lop. Permalink: libmad: heap-based buffer overflow in mad_bit_skip (bit.c) =========================================================== (open-)SUSE: https://software.opensuse.org/package/libmad 0.15.1b (TW, 42.{1,2}, multimedia:libs repo) -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1120170] New: [tmux] split-window/new-window behaviour changed when PWD differs from caller current directory
by bugzilla_noreply＠novell.com 26 Jul '22

26 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1120170 Bug ID: 1120170 Summary: [tmux] split-window/new-window behaviour changed when PWD differs from caller current directory Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: x86-64 OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: sledz(a)zone42.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- tmux 2.8 contains a change in behaviour compared to previous versions when the current directory differs from the contents of the PWD environment variable: Consider running the following at a shell prompt in a tmux session: cd / PWD=/etc tmux split-window With tmux 2.7 (Leap 15.0) the shell in the new split ends up with its current directory set to /, whereas with tmux 2.8 the shell in the new split ends up with its current directory set to /etc. Unfortunately, this breaks processes (such as openembedded's terminal.py) which change the current directory but don't change PWD. The problem was reported upstream at https://github.com/tmux/tmux/issues/1549 and it has been fixed. -- You are receiving this mail because: You are on the CC list for the bug.

2 11

[Bug 1116887] New: VUL-1: CVE-2018-19387: tmux: format_cb_pane_tabs in format.c in tmux 2.7 through 2.8 might allow attackers to cause a denial of service
by bugzilla_noreply＠novell.com 26 Jul '22

26 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1116887 Bug ID: 1116887 Summary: VUL-1: CVE-2018-19387: tmux: format_cb_pane_tabs in format.c in tmux 2.7 through 2.8 might allow attackers to cause a denial of service Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/219484/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: nemysis(a)openSUSE.org Reporter: kbabioch(a)suse.com QA Contact: security-team(a)suse.de CC: mimi.vx(a)gmail.com Found By: Security Response Team Blocker: --- CVE-2018-19387 format_cb_pane_tabs in format.c in tmux 2.7 through 2.8 might allow attackers to cause a denial of service (NULL Pointer Dereference and application crash) by arranging for a malloc failure. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-19387 http://www.cvedetails.com/cve/CVE-2018-19387/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19387 https://github.com/tmux/tmux/issues/1547 https://github.com/openbsd/src/commit/b32e1d34e10a0da806823f57f02a4ae6e93d7… -- You are receiving this mail because: You are on the CC list for the bug.

2 5

[Bug 1116431] New: systemd tmpfiles does not clean-up sddm-auth files
by bugzilla_noreply＠novell.com 20 Jul '22

20 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1116431 Bug ID: 1116431 Summary: systemd tmpfiles does not clean-up sddm-auth files Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: 64bit OS: Other Status: NEW Severity: Enhancement Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: martin(a)winter-rosenheim.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Over time, the /tmp directory contains a growing number of sddm-auth files. The systemd tmpfile services makes no attempt to clean them up. I would suggest to add a rule to /etc/tmpfiles.d to remove these files. -- You are receiving this mail because: You are on the CC list for the bug.

2 1

[Bug 1084717] New: The Leap 15.0 installation procedure creates a 500 MB EFI partition
by bugzilla_noreply＠novell.com 19 Jul '22

19 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1084717 Bug ID: 1084717 Summary: The Leap 15.0 installation procedure creates a 500 MB EFI partition Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: x86-64 OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Installation Assignee: yast2-maintainers(a)suse.de Reporter: bugrprt21882(a)online.de QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Executing a default "fresh" Leap 15.0 installation (Build 153) results in a 500 MB EFI partition being created. Attempting to change the EFI partition size to something less than 256 MB results in an error message indicating that, "the partition size is much too small" being raised. -- You are receiving this mail because: You are on the CC list for the bug.

2 7

[Bug 1129549] New: YaST Control Center - Multilingual issue
by bugzilla_noreply＠novell.com 19 Jul '22

19 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1129549 Bug ID: 1129549 Summary: YaST Control Center - Multilingual issue Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: bugrprt21882(a)online.de QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- System Language and System Locale: de_DE.UTF-8 User "root" Locale: de_DE.UTF-8 Regardless of whether the Qt graphical user interface or the ncurses text-mode user interface, the following module names and, where noted, also the associated comment, are English: * "Software-Repositories" - comment also in English. * "Create New Directory Server" - comment also in English. * "Create New Kerberos Server" - comment also in English. * "User Logon Management" - comment also in English. The following German language module names have English comments: * "Datum und Zeit". * "Netzwerkeinstellungen". * "Benutzer und Gruppenverwaltung". -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1041090] New: trackerbug: packages do not build reproducibly from unsorted input
by bugzilla_noreply＠novell.com 18 Jul '22

18 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1041090 Bug ID: 1041090 Summary: trackerbug: packages do not build reproducibly from unsorted input Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE 13.2 Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bwiedemann(a)suse.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: Development Blocker: --- See also https://reproducible-builds.org/docs/stable-inputs/ When linking .o files in random filesystem order the linker will vary the ordering of functions and apply varying optimizations resulting in binaries that differ on every build and thus trigger rebuilds of depending packages and are published to mirrors and users when actually nothing really changed. -- You are receiving this mail because: You are on the CC list for the bug.

2 15

[Bug 1123721] New: suse-module-tools must not depend on mkintird / dracut
by bugzilla_noreply＠novell.com 14 Jul '22

14 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1123721 Bug ID: 1123721 Summary: suse-module-tools must not depend on mkintird / dracut Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: martin.wilck(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Discussion on https://build.opensuse.org/request/show/657402 and via email. Email from Dominique Leuenberger, 2019-01-24 ------------- Some more thinking and tinkering around the problems with suse-module- tools - and your https://github.com/openSUSE/rpm-config-SUSE/pull/6 Adding a runtime dependency from suse-module-tools to dracut is a bad thing (with the current setup), as you already know: * coreutils buildrequires suse-module-tools in order to get the initrd macros in place. * coreutils is part of the distro bootstrap cycle (which is already large/too large). Adding dracut (plus dependency chain) into this cycle will make it close to impossible to bootstrap any new distro, namely SLE16 This shall not mean that dracut as a dependency on suse-module-tools is wrong per se, and as you did in the last weeks, we should try to find a solution for this issue, and I think the started path is not the worst: * we remove the macro to rebuild the initrd from suse-module-tools, and move that to a common place (rpm-config-SUSE comes to mind, it already contains commonly used macros) * With this, coreutils could completely give up on the dependency on suse-module-tools, which means s-module-tools could be downgraded from a ring0 to a ring1 package. The macro is already smart enough to skipt over the execution of /usr/lib/module-init-tools/regenerate-initrd- posttrans if it does not exist * An additional problem will show up though: dracut requires suse- module-tools, and suse-module-tools will require dracut. To break that cycle in OBS you will have to add a "#!BuildIgnore: suse-module-tools" to suse-module-tools.spec. This way forward would solve the technical difficulties we have around building a self-contained distro, without making it harder on the distro maintainers AND will allow us to add a dependency to s-m-t that is being interpreted by OBS (or we could even add a fileprovides then - once coreutils no longer cares for it) If any mail recipient has a valid reason AGAINST this plan, please speak up - but please also offer alternative solutions. Otherwise, let's get things moving. There are still two ring0 packages that will need touching (rpm-config-SUSE and coreutils) - and ring0 packages are 'tough' as they put a high load onto the distro build, meaning stagins willing to take them are scarse. ------------- https://github.com/openSUSE/rpm-config-SUSE/pull/6 has been accepted for rpm-config-SUSE. The initrd-related macros have _not_ been removed from suse-module-tools yet (15.0.20). The dependency on mkinitrd has been replaced by a weak "recommends". -- You are receiving this mail because: You are on the CC list for the bug.

2 20

[Bug 1123697] New: "rpm -V kernel-default" shows wrong permissions for initrd
by bugzilla_noreply＠novell.com 14 Jul '22

14 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1123697 Bug ID: 1123697 Summary: "rpm -V kernel-default" shows wrong permissions for initrd Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-maintainers(a)forge.provo.novell.com Reporter: martin.wilck(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- # rpm -V kernel-default .M....... g /boot/initrd-4.12.14-25.23-default This happens on all distros at least since SLE12-SP3. The reason is that dracut creates the initrd with permissions 0600 (bug 1008340), but the kernel package contains a dummy initrd with permissions 0644. -- You are receiving this mail because: You are on the CC list for the bug.

2 30

[Bug 1122182] New: multipath broken on power on tumbleweed
by bugzilla_noreply＠novell.com 14 Jul '22

14 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1122182 Bug ID: 1122182 Summary: multipath broken on power on tumbleweed Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: ro(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- looks like the ipr controller strikes again on sle15 it still works: (xinomavro) # lsscsi -H [0] ipr [1] lpfc [2] lpfc [3] ipr # multipath -v3 -ll [...] ===== paths list ===== uuid hcil dev dev_t pri dm_st chk_st vend/prod/rev dev_st 0:2:0:0 sda 8:0 -1 undef undef IBM,IPR-0 6F46AC00 unknown 0:2:1:0 sdb 8:16 -1 undef undef IBM,IPR-0 6F46AC00 unknown 0:2:2:0 sdc 8:32 -1 undef undef IBM,IPR-0 6F46AC00 unknown 0:2:3:0 sdd 8:48 -1 undef undef IBM,IPR-0 6F425500 unknown 3:2:0:0 sde 8:64 -1 undef undef IBM,IPR-0 6F46AC00 unknown 3:2:1:0 sdf 8:80 -1 undef undef IBM,IPR-0 6F46AC00 unknown 3:2:2:0 sdg 8:96 -1 undef undef IBM,IPR-0 6F46AC00 unknown 3:2:3:0 sdh 8:112 -1 undef undef IBM,IPR-0 6F425500 unknown Jan 16 13:15:58 | libdevmapper version 1.03.01 (2017-12-18) Jan 16 13:15:58 | DM multipath kernel driver v1.13.0 Jan 16 13:15:58 | params = 1 queue_if_no_path 1 alua 2 1 service-time 0 1 2 8:48 1 1 service-time 0 1 2 8:112 1 1 Jan 16 13:15:58 | status = 2 0 1 0 2 1 A 0 1 2 8:48 A 0 0 1 E 0 1 2 8:112 A 0 0 1 Jan 16 13:15:58 | 1IBM_IPR-0_6F42550000000020: disassemble map [1 queue_if_no_path 1 alua 2 1 service-time 0 1 2 8:48 1 1 service-time 0 1 2 8:112 1 1 ] Jan 16 13:15:58 | sdd: udev property SCSI_IDENT_LUN_T10 whitelisted Jan 16 13:15:58 | sdd: mask = 0x8 Jan 16 13:15:58 | sdd: path state = running Jan 16 13:15:58 | sdd: detect_prio = yes (setting: multipath internal) Jan 16 13:15:58 | failed to issue vpd inquiry for pgc9 Jan 16 13:15:58 | loading /lib64/multipath/libpriosysfs.so prioritizer Jan 16 13:15:58 | sdd: prio = sysfs (setting: storage device autodetected) Jan 16 13:15:58 | sdd: prio args = "" (setting: storage device autodetected) Jan 16 13:15:58 | sdd: sysfs prio = 50 Jan 16 13:15:58 | sdh: udev property SCSI_IDENT_LUN_T10 whitelisted Jan 16 13:15:58 | sdh: mask = 0x8 Jan 16 13:15:58 | sdh: path state = running Jan 16 13:15:58 | sdh: detect_prio = yes (setting: multipath internal) Jan 16 13:15:58 | failed to issue vpd inquiry for pgc9 Jan 16 13:15:58 | sdh: prio = sysfs (setting: storage device autodetected) Jan 16 13:15:58 | sdh: prio args = "" (setting: storage device autodetected) Jan 16 13:15:58 | sdh: sysfs prio = 10 Jan 16 13:15:58 | 1IBM_IPR-0_6F42550000000020: disassemble status [2 0 1 0 2 1 A 0 1 2 8:48 A 0 0 1 E 0 1 2 8:112 A 0 0 1 ] 1IBM_IPR-0_6F42550000000020 dm-6 IBM,IPR-0 6F425500 size=2.6T features='1 queue_if_no_path' hwhandler='1 alua' wp=rw |-+- policy='service-time 0' prio=50 status=active | `- 0:2:3:0 sdd 8:48 active ready running `-+- policy='service-time 0' prio=10 status=enabled `- 3:2:3:0 sdh 8:112 active ready running [...] on tumbleweed: (obs-power8-01) # multipath -v3 -ll [...] Jan 16 12:10:56 | sdd: size = 6694404096 Jan 16 12:10:56 | sdd: vendor = IBM Jan 16 12:10:56 | sdd: product = IPR-0 5ECDEA00 Jan 16 12:10:56 | sdd: rev = Jan 16 12:10:56 | sdd: h:b:t:l = 3:2:1:0 Jan 16 12:10:56 | sdd: tgt_node_name = Jan 16 12:10:56 | sdd: 61512 cyl, 128 heads, 32 sectors/track, start at 0 Jan 16 12:10:56 | 3:2:1:0: attribute vpd_pg80 not found in sysfs Jan 16 12:10:56 | failed to read sysfs vpd pg80 Jan 16 12:10:56 | sdd: fail to get serial Jan 16 12:10:56 | sdd: detect_checker = yes (setting: multipath internal) Jan 16 12:10:56 | sdd: path_checker = tur (setting: storage device autodetected) Jan 16 12:10:56 | sdd: checker timeout = 60 s (setting: multipath.conf defaults/devices section) Jan 16 12:10:56 | sdd: tur state = up ===== paths list ===== uuid hcil dev dev_t pri dm_st chk_st vend/prod/rev dev_st 0:2:0:0 sda 8:0 -1 undef undef IBM,IPR-10 5ECDEA00 unknown 0:2:1:0 sdb 8:16 -1 undef undef IBM,IPR-0 5ECDEA00 unknown 3:2:0:0 sdc 8:32 -1 undef undef IBM,IPR-10 5ECDEA00 unknown 3:2:1:0 sdd 8:48 -1 undef undef IBM,IPR-0 5ECDEA00 unknown Jan 16 12:10:56 | libdevmapper version 1.03.01 (2018-07-19) Jan 16 12:10:56 | DM multipath kernel driver v1.13.0 Jan 16 12:10:56 | unloading const prioritizer Jan 16 12:10:56 | unloading tur checker obs-power8-01:~ # dmesg | grep -E "mapper|multipath" [ 15.461123] device-mapper: uevent: version 1.0.3 [ 15.461239] device-mapper: ioctl: 4.39.0-ioctl (2018-04-03) initialised: dm-devel(a)redhat.com [ 15.462946] systemd-modules-load[1317]: Inserted module 'dm_multipath' [ 228.941013] device-mapper: multipath service-time: version 0.3.0 loaded [ 228.941142] device-mapper: table: table load rejected: not all devices are blk-mq request-stackable [ 228.941169] device-mapper: table: unable to determine table type [ 228.943508] device-mapper: table: table load rejected: not all devices are blk-mq request-stackable [ 228.943523] device-mapper: table: unable to determine table type [ 228.946381] device-mapper: table: table load rejected: not all devices are blk-mq request-stackable [ 228.946387] device-mapper: table: unable to determine table type [ 228.949130] device-mapper: table: table load rejected: not all devices are blk-mq request-stackable [ 228.949137] device-mapper: table: unable to determine table type [ 334.250096] systemd[1]: Listening on Device-mapper event daemon FIFOs. [ 334.250195] systemd[1]: Listening on multipathd control socket. [ 336.190785] device-mapper: table: 254:0: multipath: error getting device [ 336.190812] device-mapper: ioctl: error adding target to table [ 336.192423] device-mapper: table: table load rejected: not all devices are blk-mq request-stackable [ 336.192430] device-mapper: table: unable to determine table type [ 336.200096] device-mapper: table: 254:0: multipath: error getting device [ 336.200108] device-mapper: ioctl: error adding target to table [ 336.202816] device-mapper: table: table load rejected: not all devices are blk-mq request-stackable [ 336.202821] device-mapper: table: unable to determine table type -- You are receiving this mail because: You are on the CC list for the bug.

2 14