April 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1222752] New: ugrep: build results depend on CPU
by bugzilla_noreply＠suse.com 29 Aug '24

29 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1222752 Bug ID: 1222752 Summary: ugrep: build results depend on CPU Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: Andreas.Stieger(a)gmx.de Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de Blocks: 1100677 Target Milestone: --- Found By: Development Blocker: --- While working on reproducible builds for openSUSE, I found that our ugrep binaries depend on the build machine CPU again. It seems SR 1166721 reverted my previous SR 818786 related: https://github.com/Genivia/ugrep/pull/50 CPU march=native ; partial fix The buildroot diff shows +++ /home/abuild/rpmbuild/BUILD.unsorted/ugrep-5.1.4/Makefile @@ -327,9 +327,9 @@ SED = /usr/bin/sed SET_MAKE = SHELL = /usr/bin/bash -SIMD_AVX2_FLAGS = -mavx2 +SIMD_AVX2_FLAGS = SIMD_AVX512BW_FLAGS = -SIMD_FLAGS = -msse2 -DHAVE_AVX2 +SIMD_FLAGS = -msse2 -DHAVE_SSE2 There are multiple ways to solve that: - never use AVX2 (as before) - always use AVX2 - detect AVX2 at runtime instead of compile-time -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1216393] New: Electron/Chromium can't render h264 in webrtc
by bugzilla_noreply＠suse.com 29 Aug '24

29 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1216393 Bug ID: 1216393 Summary: Electron/Chromium can't render h264 in webrtc Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: bjorn.bidar(a)thaodan.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- * Description: When trying to stream WebRTC with h264 in Electron/Chromium the screen stays black even thou OpenH264 is correctly installed. * How to reproduce: 1. Open Chromium 2. Open https://mozilla.github.io/webrtc-landing/pc_test_no_h264.html 3. Click test ** Another option is to use: https://mozilla.github.io/webrtc-landing/pc_test.html 1. Tick require h264 2. Start the video, wait 3. The message now should be "No H264 found in the offer!!!" * Background and reason for the bug: openSUSE builds both Chromium and Electron in a way that h264 isn't compiled into both packages but loaded using the Openh264 provided by openSUSE but blessed by Cisco. However Chromium has to use some of the openh264 to build even thou it's not used during runtime. The gyp option `rtc_use_h264` has be set to true and third_party/openh264 has to be included in the tarball (already the case in the upstream third_party/openh264 tarball). This is due webrtc using openh264 headers in third_party/webrtc/modules/video_coding/codecs/h264/h264_encoder_impl.cc -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1218303] New: VUL-0: CVE-2023-6704: libavif,chromium,ungoogled-chromium: use after free in libavif
by bugzilla_noreply＠suse.com 29 Aug '24

29 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1218303 Bug ID: 1218303 Summary: VUL-0: CVE-2023-6704: libavif,chromium,ungoogled-chromium: use after free in libavif Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: Andreas.Stieger(a)gmx.de QA Contact: qa-bugs(a)suse.de CC: aaronpuchert(a)alice-dsl.net, andrea.mattiazzo(a)suse.com, Andreas.Stieger(a)gmx.de, gmbr3(a)opensuse.org, security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- It was reported that libavif before 1.0.3, and as bundled in Chromium, contained a use-after-free bug. colorProperties could be pointing to a dangling pointer if findAlphaItem() resizes the meta.items array. Also bundled in chromium, see bug 1218048 References: https://github.com/AOMediaCodec/libavif/pull/1808 https://github.com/AOMediaCodec/libavif/commit/b984f48be99b41405cb4a7d44380… https://github.com/AOMediaCodec/libavif/releases/tag/v1.0.3 https://bugs.chromium.org/p/chromium/issues/detail?id=1504792 -- You are receiving this mail because: You are on the CC list for the bug.

1 11

[Bug 1220201] New: Firefox on Wayland - download dialog disappearing
by bugzilla_noreply＠suse.com 29 Aug '24

29 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1220201 Bug ID: 1220201 Summary: Firefox on Wayland - download dialog disappearing Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Firefox Assignee: factory-mozilla(a)lists.opensuse.org Reporter: opensuse(a)mike.franken.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Using Firefox on Wayland the download dialog is disappearing after chosing "save file" and before selecting the download file and directory. One can see the "enter name ..." dialog for a second, then it vanishes. On the same machine this does not happen with Xorg. There is no error or warning in the journal, i.e. for a crash. Operating System: openSUSE Tumbleweed 20240220 KDE Plasma Version: 5.27.10 KDE Frameworks Version: 5.115.0 Qt Version: 5.15.12 Kernel Version: 6.7.5-1-default (64-bit) Graphics Platform: X11 Processors: 8 × 11th Gen Intel® Core™ i7-1165G7 @ 2.80GHz Memory: 15,0 GiB of RAM Graphics Processor: Mesa Intel® Xe Graphics Manufacturer: Dell Inc. Product Name: XPS 13 9310 2-in-1 -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1220814] New: kernel 6.7.6-1-default Oops: unable to handle page faults and workqueue lockup (udev related?)
by bugzilla_noreply＠suse.com 28 Aug '24

28 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1220814 Bug ID: 1220814 Summary: kernel 6.7.6-1-default Oops: unable to handle page faults and workqueue lockup (udev related?) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: michael.burge77(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 873182 --> https://bugzilla.suse.com/attachment.cgi?id=873182&action=edit full journalctl of the third crash I have an old portable with a wonky dc power jack which tends to generate a few quick AC0<->BAT0 events in succession. Starting with kernel 6.7.6-1-default the system locks up. Log is full of ``` Mar 01 17:34:02 ost (udev-worker)[23694]: AC0: Process '/usr/sbin/tlp auto' terminated by signal KILL. Mar 01 17:34:02 ost (udev-worker)[23694]: AC0: Failed to wait for spawned command '/usr/sbin/tlp auto': Input/output error Mar 01 17:34:02 ost (udev-worker)[23694]: AC0: Failed to execute '/usr/sbin/tlp auto', ignoring: Input/output error Mar 01 17:34:17 ost (udev-worker)[24044]: AC0: Process '/usr/sbin/tlp auto' terminated by signal KILL. Mar 01 17:34:17 ost (udev-worker)[24044]: AC0: Failed to wait for spawned command '/usr/sbin/tlp auto': Input/output error Mar 01 17:34:17 ost (udev-worker)[24044]: AC0: Failed to execute '/usr/sbin/tlp auto', ignoring: Input/output error Mar 01 17:34:17 ost plasmashell[2682]: plasma-pk-updates: acPluggedChanged onBattery: false -> true Mar 01 17:34:17 ost kernel: BUG: unable to handle page fault for address: 0000000000007b8a Mar 01 17:34:17 ost kernel: #PF: supervisor read access in kernel mode Mar 01 17:34:17 ost kernel: #PF: error_code(0x0000) - not-present page ``` until it locks up with ``` Mar 01 18:11:29 ost kernel: note: kworker/11:5[23457] exited with irqs disabled Mar 01 18:11:50 ost systemd-logind[1443]: Power key pressed short. Mar 01 18:11:54 ost systemd-logind[1443]: Power key pressed short. Mar 01 18:11:55 ost systemd-logind[1443]: Power key pressed short. Mar 01 18:11:58 ost plasmashell[5912]: [5912:0301/181158.744595:ERROR:command_buffer_proxy_impl.cc(128)] ContextResult::kTransientFailure: Failed to send GpuControl.CreateCommandBuffer. Mar 01 18:12:05 ost systemd-logind[1443]: Power key pressed short. Mar 01 18:12:06 ost kernel: BUG: workqueue lockup - pool cpus=11 node=0 flags=0x0 nice=0 stuck for 37s! ``` at which point only holding down the power button works. -- You are receiving this mail because: You are on the CC list for the bug.

1 15

[Bug 1219282] New: Distorted sound in some applications, apparently occurring under system heavier load
by bugzilla_noreply＠suse.com 27 Aug '24

27 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1219282 Bug ID: 1219282 Summary: Distorted sound in some applications, apparently occurring under system heavier load Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Sound Assignee: tiwai(a)suse.com Reporter: bartoletti.stefano(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 872253 --> https://bugzilla.suse.com/attachment.cgi?id=872253&action=edit sound devices I'm experiencing some annoying sound problems, that are occurring only during some circumstances (apparently under heavier system load, but I don't know if this is a factor), and appeared starting from about a month ago (end of December 2023). Before that, everything was working normally. I'm running a fully updated tumbleweed, and I can notice this problem mainly when running games under Wine. Basically, the game starts fine, and after a while (there is not a fixed time), the audio starts crackling/scratching. Sometimes this just distorts the sound output, sometimes it is so severe to mute any sound completely. - It does not happen with every application. At the moment, browsers, VLC, spotify, and so on play sound correctly. Games run under Wine (through flatpak) and some other Linux games (still flatpak) have this problem. When this happens, when I close an app that causes this problem, sometimes even other apps (said browsers, spotify, etc) have their sounds distorted, at least for a while. - I'm not sure about this, but I think that I noticed this problem more often when there is a heavier system load (especially disk I/O), but to be honest, after all this time trying to figure this out without results, it may be me drawing unrelated conclusions. - This problem occurs only with a specific audio device, that controls my laptop built-in speakers: an "AMD Family 17h/19h HD Audio". My system is also equipped with an "AMD Renoir Radeon High Definition Audio" device that controls audio from the HDMI port, which works correctly when I connect it to i.e. an external TV. Everything is also working correctly with Bluetooth headphones or wired headphones connected to the jack port. This problem is occurring with every possible configuration that I can't test: - Both with pipewire (my default engine, which was working correctly until a month ago) and pulseaudio - Both with my user account and with a brand new test account that I created just for testing this - By logging in both with Wayland and X11 (and even ICEWM) - With every Kernel that I was able to test right now (current 6.7.x, 6.6.x, 6.5.x), but only starting from the end of December (before that, no problems even with these versions) I'm very puzzled and mildly annoyed by my inability to find a solution. From what I can see, this seems to be unrelated to my specific user config and I am unable to understand what should I do. Every possible related issue that I found by googling is mainly related to not having sound at all, which is easily diagnosed, while in my case this occurs in ways that I am not able to correctly pinpoint and troubleshoot. If it is useful, I've opened a question on Superuser, but it has received much attention. Anyway, it's here https://superuser.com/q/1827353/170331 I'm adding some useful info as attachments, feel free to ask for more. Thanks! -- You are receiving this mail because: You are on the CC list for the bug.

1 17

[Bug 1220707] New: openSUSE:Factory:PowerPC:ToTest images not built
by bugzilla_noreply＠suse.com 27 Aug '24

27 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1220707 Bug ID: 1220707 Summary: openSUSE:Factory:PowerPC:ToTest images not built Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: liv.dywan(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- OBSRSync regularly fail to sync openSUSE:Factory:PowerPC:ToTest with openQA on o3, which is reflected in minion job failures https://openqa.opensuse.org/minion/jobs?id=3467803 https://build.opensuse.org/repositories/openSUSE:Factory:PowerPC:ToTest/ seems to confirm images are not published. See also https://progress.opensuse.org/issues/155743 Note: I'm not sure I filed this in the right place, so please feel free to move as necessary. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1222468] New: VUL-0: CVE-2024-22189: caddy: quic-go: memory exhaustion attack against QUIC's connection ID mechanism
by bugzilla_noreply＠suse.com 23 Aug '24

23 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1222468 Bug ID: 1222468 Summary: VUL-0: CVE-2024-22189: caddy: quic-go: memory exhaustion attack against QUIC's connection ID mechanism Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://smash.suse.de/issue/400376/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: camila.matos(a)suse.com QA Contact: qa-bugs(a)suse.de CC: camila.matos(a)suse.com, jkowalczyk(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Blocks: 1222461 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1222461 +++ quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID` frame. The attacker can prevent the receiver from sending out (the vast majority of) these `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22189 https://www.cve.org/CVERecord?id=CVE-2024-22189 https://github.com/quic-go/quic-go/commit/4a99b816ae3ab03ae5449d15aac45147c… https://github.com/quic-go/quic-go/security/advisories/GHSA-c33x-xqrf-c478 https://seemann.io/posts/2024-03-19-exploiting-quics-connection-id-manageme… https://www.youtube.com/watch?v=JqXtYcZAtIA&t=3683s https://bugzilla.redhat.com/show_bug.cgi?id=2273513 -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1220403] New: VUL-0: CVE-2024-23837: libhtp: excessive processing time of HTTP headers can lead to denial of service
by bugzilla_noreply＠suse.com 23 Aug '24

23 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1220403 Bug ID: 1220403 Summary: VUL-0: CVE-2024-23837: libhtp: excessive processing time of HTTP headers can lead to denial of service Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/395171/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: otto.hollmann(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-23837 https://www.cve.org/CVERecord?id=CVE-2024-23837 https://github.com/OISF/libhtp/commit/20ac301d801cdf01b3f021cca08a22a87f477… https://github.com/OISF/libhtp/security/advisories/GHSA-f9wf-rrjj-qx8m https://redmine.openinfosecfoundation.org/issues/6444 -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1223398] New: VUL-0: CVE-2024-22373: gdcm: out-of-bounds write in the JPEG2000Codec:DecodeByStreamsCommon functionality
by bugzilla_noreply＠suse.com 23 Aug '24

23 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1223398 Bug ID: 1223398 Summary: VUL-0: CVE-2024-22373: gdcm: out-of-bounds write in the JPEG2000Codec:DecodeByStreamsCommon functionality Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/403162/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Other Assignee: axel.braun(a)gmx.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- An out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22373 https://www.cve.org/CVERecord?id=CVE-2024-22373 https://talosintelligence.com/vulnerability_reports/TALOS-2024-1935 https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1935 -- You are receiving this mail because: You are on the CC list for the bug.

1 5