August 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1228907] New: VUL-0: CVE-2024-7541: ofono: lack of proper initialization of memory leads to disclosure of sensitive information when parsing the responses from AT+CMT commands
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228907 Bug ID: 1228907 Summary: VUL-0: CVE-2024-7541: ofono: lack of proper initialization of memory leads to disclosure of sensitive information when parsing the responses from AT+CMT commands Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/416427/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mpluskal(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- oFono AT CMT Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CMT commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23308. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-7541 https://www.cve.org/CVERecord?id=CVE-2024-7541 http://www.zerodayinitiative.com/advisories/ZDI-24-1081/ https://bugzilla.redhat.com/show_bug.cgi?id=2303004 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1228908] New: VUL-0: CVE-2024-7542: ofono: lack of proper initialization of memory leads to disclosure of sensitive information when parsing responses from AT+CMGR commands
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228908 Bug ID: 1228908 Summary: VUL-0: CVE-2024-7542: ofono: lack of proper initialization of memory leads to disclosure of sensitive information when parsing responses from AT+CMGR commands Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/416428/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mpluskal(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- oFono AT CMGR Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CMGR commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23309. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-7542 https://www.cve.org/CVERecord?id=CVE-2024-7542 http://www.zerodayinitiative.com/advisories/ZDI-24-1082/ https://bugzilla.redhat.com/show_bug.cgi?id=2303005 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1228864] perl-Bootloader can break systemd-boot installations dropping shim.efi
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

1 0

[Bug 1217488] New: pynfs CID* tests fails: OP_SETCLIENTID should return NFS4_OK, instead got NFS4ERR_DELAY
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1217488 Bug ID: 1217488 Summary: pynfs CID* tests fails: OP_SETCLIENTID should return NFS4_OK, instead got NFS4ERR_DELAY Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel:Filesystems Assignee: nfbrown(a)suse.com Reporter: petr.vorel(a)suse.com QA Contact: petr.vorel(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Although we start due #1217128 testing via cdmackay/pynfs.git, which has fix for "nfs4lib.BadCompoundRes: operation OP_SETCLIENTID should return NFS4_OK [1], instead got NFS4ERR_DELAY", we still get 9 tests failing with this error on Tumbleweed. Any idea what could be wrong now? O I can ask Calum Mackay on linux-nfs if you're busy with more important stuff. [1] https://git.linux-nfs.org/?p=cdmackay/pynfs.git;a=commit;h=0d4d3fd0bb7a6386… -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1228903] New: VUL-0: CVE-2024-7537: ofono: lack of proper validation of user-supplied data leads to out-of-bounds read when processing SMS message lists
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228903 Bug ID: 1228903 Summary: VUL-0: CVE-2024-7537: ofono: lack of proper validation of user-supplied data leads to out-of-bounds read when processing SMS message lists Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/416423/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mpluskal(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- oFono QMI SMS Handling Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SMS message lists. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23157. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-7537 https://www.cve.org/CVERecord?id=CVE-2024-7537 http://www.zerodayinitiative.com/advisories/ZDI-24-1077/ https://bugzilla.redhat.com/show_bug.cgi?id=2303000 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1228905] New: VUL-0: CVE-2024-7539: ofono: lack of proper validation of the length of user-supplied data when parsing the responses from AT+CUSD commands leads to a stack-based buffer overflow
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228905 Bug ID: 1228905 Summary: VUL-0: CVE-2024-7539: ofono: lack of proper validation of the length of user-supplied data when parsing the responses from AT+CUSD commands leads to a stack-based buffer overflow Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/416425/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mpluskal(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- oFono CUSD Stack-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CUSD commands. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-23195. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-7539 https://www.cve.org/CVERecord?id=CVE-2024-7539 http://www.zerodayinitiative.com/advisories/ZDI-24-1079/ https://bugzilla.redhat.com/show_bug.cgi?id=2303002 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1228904] New: VUL-0: CVE-2024-7538: ofono: lack of proper validation of the length of user-supplied data when parsing of responses from AT Commands leads to stack-based buffer overflow
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228904 Bug ID: 1228904 Summary: VUL-0: CVE-2024-7538: ofono: lack of proper validation of the length of user-supplied data when parsing of responses from AT Commands leads to stack-based buffer overflow Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/416424/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mpluskal(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- oFono CUSD AT Command Stack-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT Commands. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-23190. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-7538 https://www.cve.org/CVERecord?id=CVE-2024-7538 http://www.zerodayinitiative.com/advisories/ZDI-24-1078/ https://bugzilla.redhat.com/show_bug.cgi?id=2303001 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1228906] New: VUL-0: CVE-2024-7540: ofono: lack of proper initialization of memory leads to disclosure of sensitive information when parsing responses from AT+CMGL commands
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228906 Bug ID: 1228906 Summary: VUL-0: CVE-2024-7540: ofono: lack of proper initialization of memory leads to disclosure of sensitive information when parsing responses from AT+CMGL commands Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/416426/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mpluskal(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CMGL commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23307. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-7540 https://www.cve.org/CVERecord?id=CVE-2024-7540 http://www.zerodayinitiative.com/advisories/ZDI-24-1080/ https://bugzilla.redhat.com/show_bug.cgi?id=2303003 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1224149] New: [SELinux] sdbootutil (snapperd_t) failes to execute systemd-pcrlock (init_exec_t)
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1224149 Bug ID: 1224149 Summary: [SELinux] sdbootutil (snapperd_t) failes to execute systemd-pcrlock (init_exec_t) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: arvidjaar(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Operating System: openSUSE MicroOS 10:~ # sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 33 10:~ # zypper info selinux-policy Loading repository data... Reading installed packages... Information for package selinux-policy: --------------------------------------- Repository : openSUSE-Tumbleweed-Oss Name : selinux-policy Version : 20240321-1.2 Arch : noarch Vendor : openSUSE Installed Size : 24.8 KiB Installed : Yes (automatically) Status : up-to-date Source package : selinux-policy-20240321-1.2.src Upstream URL : https://github.com/fedora-selinux/selinux-policy.git Summary : SELinux policy configuration Description : SELinux Reference Policy. A complete SELinux policy that can be used as the system policy for a variety of systems and used as the basis for creating other policies. 10:~ # rpm -q sdbootutil sdbootutil-1+git20240506.573a6a4-1.1.x86_64 10:~ # rpm -qf /usr/lib/systemd/systemd-pcrlock systemd-experimental-255.4-3.1.x86_64 10:~ # ls -l /etc/systemd/tpm2-pcr-public-key.pem /etc/systemd/tpm2-pcr-private-key.pem ls: cannot access '/etc/systemd/tpm2-pcr-public-key.pem': No such file or directory ls: cannot access '/etc/systemd/tpm2-pcr-private-key.pem': No such file or directory 10:~ # sdbootutil defaults to systemd-pcrlock if is is present and no previous keypair for the signed policy is present. 10:~ # semodule -DB 10:~ # systemctl start snapper-cleanup.service 10:~ # semodule -B 10:~ # ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts boot ---- time->Sun May 12 08:54:27 2024 type=AVC msg=audit(1715493267.232:132): avc: denied { execute } for pid=1325 comm="sdbootutil" name="systemd-pcrlock" dev="dm-0" ino=57169 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=0 ---- time->Sun May 12 08:54:27 2024 type=AVC msg=audit(1715493267.232:133): avc: denied { execute } for pid=1325 comm="sdbootutil" name="systemd-pcrlock" dev="dm-0" ino=57169 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=0 10:~ # Other denials for snapper_t are list in boo#1224120 for which I have local policy override. -- You are receiving this mail because: You are on the CC list for the bug.

1 14

[Bug 1211018] vim in toolbox: Unknown function: dist#script#DetectFiletype
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1211018 https://bugzilla.suse.com/show_bug.cgi?id=1211018#c4 Alexandre Vicenzi <alexandre.vicenzi(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|containers-bugowner(a)suse.de |danish.prakash(a)suse.com Resolution|--- |FIXED CC| |alexandre.vicenzi(a)suse.com, | |containers-bugowner(a)suse.de Status|NEW |RESOLVED --- Comment #4 from Alexandre Vicenzi <alexandre.vicenzi(a)suse.com> --- Closing because this was fixed. -- You are receiving this mail because: You are on the CC list for the bug.

1 0