April 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1223176] New: VUL-0: CVE-2024-32475: envoy: abnormal termination when using auto_sni with authority header longer than 255 characters
by bugzilla_noreply＠suse.com 20 Sep '24

20 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1223176 Bug ID: 1223176 Summary: VUL-0: CVE-2024-32475: envoy: abnormal termination when using auto_sni with authority header longer than 255 characters Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/402625/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: wolfgang.engel(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: stoyan.manolov(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Envoy is a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with `auto_sni` enabled, a request containing a `host`/`:authority` header longer than 255 characters triggers an abnormal termination of Envoy process. Envoy does not gracefully handle an error when setting SNI for outbound TLS connection. The error can occur when Envoy attempts to use the `host`/`:authority` header value longer than 255 characters as SNI for outbound TLS connection. SNI length is limited to 255 characters per the standard. Envoy always expects this operation to succeed and abnormally aborts the process when it fails. This vulnerability is fixed in 1.30.1, 1.29.4, 1.28.3, and 1.27.5. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-32475 https://www.cve.org/CVERecord?id=CVE-2024-32475 https://github.com/envoyproxy/envoy/commit/b47fc6648d7c2dfe0093a601d44cb704… https://github.com/envoyproxy/envoy/security/advisories/GHSA-3mh5-6q8v-25wj https://bugzilla.redhat.com/show_bug.cgi?id=2276149 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1220501] New: Kernel panics on EEVDF
by bugzilla_noreply＠suse.com 20 Sep '24

20 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1220501 Bug ID: 1220501 Summary: Kernel panics on EEVDF Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Major Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: l4rryc0n5014(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 873070 --> https://bugzilla.suse.com/attachment.cgi?id=873070&action=edit Compressed copy of /var/log/journal, accessed from Windows with WinBTRFS My laptop has been kernel panicking quite frequently as of late. At first I thought it was because of the boot option `pcie_aspm=force acpi_backlight=native` but it wasn't. I dropped into recovery mode to check `journalctl` and I found the recent panics were due to: EEVDF scheduling fail, picking leftmost BUG: kernel NULL pointer dereference, address: 00000000000000a0 I saw a lot of `EEVDF scheduling fail` before the entries cuts off for the next boot session which was me ACPI shutting down the laptop each time it grinds to a halt. Sometimes, I saw two additional entries in the journal: #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page A quick search on the first two entries yielded <https://lkml.org/lkml/2024/2/19/678>. Not sure how to read the thing considering it's Linux kernel stuffs. I also thought it was due to data corruption or something on the `/` and `/home` but `btrfs check --force --check-data-csum` said both were healthy, and I reinstalled openSUSE back Feb 19 after zeroing the two partitions for good measure (due to mishaps that compromised data integrity). The only things that has anything to do with the kernel I installed were VBox, Docker, KVM and QEMU, and the NVIDIA driver with blacklisting `nouveau` using https://en.opensuse.org/SDB:NVIDIA_the_hard_way, the rest was from https://en.opensuse.org/SDB:NVIDIA_drivers for G06 with a bunch more G06 stuff installed. Included is a compressed file or /var/log/journal which should include my laptop model; but for safety measure, I am using an Acer Nitro 5 (AN515-46-R6QR) running AMD Ryzen 7 6800H with an NVIDIA 3060 Mobile, upgraded to 32GB of RAM from stock configuration of 16GB with an additional 2TB drive added to the spare M.2 slot. -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1214406] New: [kubeadm1.27] Multiple Issues before `kubeadm init` runs successfully
by bugzilla_noreply＠suse.com 19 Sep '24

19 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1214406 Bug ID: 1214406 Summary: [kubeadm1.27] Multiple Issues before `kubeadm init` runs successfully Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Containers Assignee: priyanka.saggu(a)suse.com Reporter: eich(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: Development Blocker: --- 1. The Kubernetes package on TW seems to require cri-o as runtime dependency, however, it requires containerd. Thus, - cri-o should not be installed as a dependency - containerd had to be installed enabled and started (containerd doesn't have an rccontainerd link) 2. kubelet.service does not start: It complains about the option `--container-runtime` not being known. This option is pulled in from /etc/sysconfig/kubelet. It needs to be deleted from this file. It is not clear who has created this file and which package owns it. The rpm database does not know it. Since it is pulled in by ..../systemd/system/kubelet.service.d/10-kubeadm.conf I suspect it comes from kubernetes1.27-kubeadem but it's hard to tell where it is created - at least not in a post-install script. It would be good if the file was '%ghost' in the %files section of the package it originates from. The same is true for the environment file /var/lib/kubelet/kubeadm-flags.env which is written by `kubeadm init`. 3. 'kubeadm init' checks if the kubelet service is enabled. 4. Moreover, it requires a reboot to start all dependent services and load all required kernel modules: - br_netfilter needs to be loaded - containerd needs to be started This was fine for kubic these packages were originally meant for as this had transactional updates and required a reboot. On a 'regular' system where this is not the case, these modules should probably be loaded and services be started from a 'postinstall' script. -- You are receiving this mail because: You are on the CC list for the bug.

1 17

[Bug 1219528] New: go 1.22rc2 breaks mockery
by bugzilla_noreply＠suse.com 16 Sep '24

16 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1219528 Bug ID: 1219528 Summary: go 1.22rc2 breaks mockery Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: mrueckert(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- package: https://build.opensuse.org/package/show/home:darix:restic/mockery upstream issue: https://github.com/vektra/mockery/issues/752 stack trace in upstream issue. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1221701] New: GCC 14: libquicktime package fails
by bugzilla_noreply＠suse.com 15 Sep '24

15 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1221701 Bug ID: 1221701 Summary: GCC 14: libquicktime package fails Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: michal.jires(a)suse.com QA Contact: qa-bugs(a)suse.de CC: danilo.spinella(a)suse.com Blocks: 1220571 Target Milestone: --- Found By: --- Blocker: --- Building libquicktime with GCC 14 fails here: https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:… Due to: error: File not found: /home/abuild/rpmbuild/BUILDROOT/libquicktime-1.2.4+git20180804.fff99cd-5.5.x86_64/usr/lib64/libquicktime/lqt_lame.so ./libquicktime-1.2.4+git20180804.fff99cd/config.log: conftest.c:59:5: error: return type defaults to 'int' [-Wimplicit-int] ./libquicktime-1.2.4+git20180804.fff99cd/config.log: 59 | main() ./libquicktime-1.2.4+git20180804.fff99cd/config.log: | ^~~~ Builds with automatically generated: Index: libquicktime-1.2.4+git20180804.fff99cd/configure.ac =================================================================== --- libquicktime-1.2.4+git20180804.fff99cd.orig/configure.ac +++ libquicktime-1.2.4+git20180804.fff99cd/configure.ac @@ -282,6 +282,7 @@ have_lame="false" AC_TRY_RUN([ #include <lame/lame.h> #include <stdio.h> +int main() { int version_major; See the meta bug#1220571 for more info. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1220524] New: Files in virtualbox shared folder (on the guest) show wrong timestamp
by bugzilla_noreply＠suse.com 13 Sep '24

13 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1220524 Bug ID: 1220524 Summary: Files in virtualbox shared folder (on the guest) show wrong timestamp Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Virtualization:Tools Assignee: virt-bugs(a)suse.de Reporter: suse.junky(a)t-online.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- On my openSUSE Tumbleweed system (bare metal) Operating System: openSUSE Tumbleweed 20240225 KDE Plasma Version: 5.27.10 KDE Frameworks Version: 5.115.0 Qt Version: 5.15.12 Kernel Version: 6.7.6-1-default (64-bit) Graphics Platform: X11 I use virtualbox # zypper se -si virtual* Loading repository data... Reading installed packages... S | Name | Type | Version | Arch | Repository ---+------------------------+---------+-----------------------+--------+------------------ i | virtualbox | package | 7.0.14-3.1 | x86_64 | (System Packages) i+ | virtualbox-kmp-default | package | 7.0.14_k6.7.6_1-3.2 | x86_64 | (System Packages) i+ | virtualbox-qt | package | 7.0.14-3.1 | x86_64 | (System Packages) # One guest is an openSUSE Tumbleweed 20240225 system with # zypper se -si virtualbox* Loading repository data... Reading installed packages... S | Name | Type | Version | Arch | Repository ---+------------------------+---------+---------------------+--------+------------------ i+ | virtualbox-guest-tools | package | 7.0.14-3.1 | x86_64 | (System Packages) i+ | virtualbox-kmp-default | package | 7.0.14_k6.7.6_1-3.2 | x86_64 | (System Packages) # The host shares a directory (/mnt/Lokal/VM_share) with the guest. On the host system I have (in my home directory) a file > ls -la *.jpg -rw-r--r-- 1 A users 40749 Mar 3 2023 Opensuse_beer_label.jpg when I copy this file to the shared directory > cp -a Opensuse_beer_label.jpg /mnt/Lokal/VM_share/ everything looks fine (on the host) > ls -la /mnt/Lokal/VM_share/ total 64 drwxr-xr-x 3 A users 4096 Feb 27 09:51 . drwxr-xr-x 7 root root 4096 Jan 3 2022 .. -rw-r--r-- 1 A users 40749 Mar 3 2023 Opensuse_beer_label.jpg > but on the guest system I see in the shared folder > ls -la total 64 drwxrwx--- 1 root vboxsf 4096 Jan 1 1970 . dr-xr-xr-x 5 root root 4096 Feb 27 09:40 .. -rwxrwx--- 1 root vboxsf 40749 Feb 27 09:44 Opensuse_beer_label.jpg > The timestamps in the share of the VM don’t make sense to me. This happens to all files copied to the share. Even when I copy files in the guest to the share their timestamps are changed (in the share) to the current date . However when I look at those files on the host they do have the correct date; i.e. the date of the original file in the guest. On MS Windows 11 (bare metal) with virtualbox 7.0.14 and openSUSE Tumbleweed 20240225 as guest I see the same behaviour. Kubuntu (as guest) does not show this behaviour although it uses VBoxGuestAdditions_7.0.14 as well. I discussed this already here: https://forums.opensuse.org/t/files-in-the-virtualbox-share-show-wrong-time… and a third user could very this behaviour in its setup as well. -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1217824] New: longterm kernel: figure out how to build KMPs
by bugzilla_noreply＠suse.com 13 Sep '24

13 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1217824 Bug ID: 1217824 Summary: longterm kernel: figure out how to build KMPs Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: rfrohl(a)suse.com Reporter: rfrohl(a)suse.com QA Contact: qa-bugs(a)suse.de CC: tiwai(a)suse.com Target Milestone: --- Found By: --- Blocker: --- One of the major open questions, before introducing the longterm kernel to Factory, is how KPMs can be build. This issue is supposed to server as a reminder, that this likely blocks the addition to Factory until it is resolved. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1215463] New: VirtualBox shared folders no longer working in Tumbleweed 20230915
by bugzilla_noreply＠suse.com 13 Sep '24

13 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1215463 Bug ID: 1215463 Summary: VirtualBox shared folders no longer working in Tumbleweed 20230915 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Virtualization:Other Assignee: virt-bugs(a)suse.de Reporter: nixuser(a)linuxmail.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Recent updates in the last two week or so have broken shared folders in VirtualBox. You can mount the shares, and "ls" the files, but any attempt to access a file results in "killed" as a response. If I launch Thunar in Xfce it locks up and must be killed. Video scaling is working, and copy/paste between the host and guest are also working. Issue exists for Tumbleweed guests with a Fedora or Win10 host. Other hosts not tested. Tumbleweed guest fully up to date 20230915. -- You are receiving this mail because: You are on the CC list for the bug.

1 18

[Bug 1221763] New: ptrace(PTRACE_ATTACH) fails on processes of the same user
by bugzilla_noreply＠suse.com 13 Sep '24

13 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1221763 Bug ID: 1221763 Summary: ptrace(PTRACE_ATTACH) fails on processes of the same user Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Major Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: giuliano.belinassi(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Recent updates of tumbleweed broke `ptrace(PTRACE_ATTACH, ...)` when attaching to a process from the same user. This breaks attaching a debugger (gdb) to a process and userspace livepatching. A single line reproducer in a clean system is: ``` $ sleep 5000 & gdb -p $(pidof sleep) ``` If you see the following message: ``` Attaching to process 12606 ptrace: Operation not permitted. ``` This means ptrace is not working. As a contrast, running gdb with sudo works as intended. Value of /proc/sys/kernel/yama/ptrace_scope: ``` $ cat /proc/sys/kernel/yama/ptrace_scope 1 ``` -- You are receiving this mail because: You are on the CC list for the bug.

1 40

[Bug 1215976] New: Hawk fails to build in Factory
by bugzilla_noreply＠suse.com 12 Sep '24

12 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1215976 Bug ID: 1215976 Summary: Hawk fails to build in Factory Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: High Availability Assignee: ha-bugs(a)suse.de Reporter: aburlakov(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- After the update in the Factory, there has disappeared the useradd and groupadd commands. Adding the shadow package in the BuildRequires has fixed it. -- You are receiving this mail because: You are on the CC list for the bug.

1 4