[Bug 1974037] Re: openssl: EVP_EC_gen() segfault without init
This bug was fixed in the package openssl - 3.0.3-5ubuntu2 --- openssl (3.0.3-5ubuntu2) kinetic; urgency=medium * d/p/Set-systemwide-default-settings-for-libssl-users: don't comment out the CipherString string to avoid an empty section. -- Simon Chopin Tue, 31 May 2022 13:02:15 +0200 ** Changed in: openssl (Ubuntu Kinetic) Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1974037 Title: openssl: EVP_EC_gen() segfault without init To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1974037/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1974037] Re: openssl: EVP_EC_gen() segfault without init
** Tags added: patch -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1974037 Title: openssl: EVP_EC_gen() segfault without init To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1974037/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1974037] Re: openssl: EVP_EC_gen() segfault without init
** Description changed:
- Imported from Debian bug http://bugs.debian.org/1010958:
+ [Impact]
+
+ The fix for
+ https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1968997 has
+ broken some code paths as the new string comparison functions now need
+ initialization, triggering segafults.
+
+ The provided debdiff fixes the immediate issue and also settles on a new
+ implementation not requiring the initialization in the first place.
+
+ [Test Plan]
+
+ Since this is a regression fix, we first need to check that the original
+ bug hasn't cropped up again:
+
+ sudo locale-gen tr_TR.UTF-8
+ LANG=C curl https://ubuntu.com/ > /dev/null # This work
+ LANG=tr_TF.UTF-8 curl https://ubuntu.com/ > /dev/null # This should work as
well
+
+ For the regression itself:
+
+ sudo apt install libssl-dev
+ cat < openssl_test.c
+ #include
+ int main()
+ {
+ EVP_PKEY_Q_keygen(NULL, NULL, "EC", "P-256");
+ }
+ EOF
+ gcc openssl_test.c -lcrypto -lssl -o openssl_test
+ ./openssl_test
+
+
+ [Where problems could occur]
+
+ This new patch set is relatively massive, on top of another massive one.
+ Some new regressions could crop up of a similar kind. Furthermore, the
+ homegrown string comparison function could be buggy, leading to algorithm
name mismatches.
+
+ [Other info]
+
+ The patches all come from upstream and have been merged on their 3.0
+ maintenance branch.
+
+ [Original report]
Source: sscg
Version: 3.0.2-1
Severity: serious
Tags: ftbfs
https://buildd.debian.org/status/logs.php?pkg=sscg&ver=3.0.2-1%2Bb1
...
1/10 generate_rsa_key_test FAIL 0.01s killed by signal 11
SIGSEGV
04:32:21 MALLOC_PERTURB_=87
/<>/obj-x86_64-linux-gnu/generate_rsa_key_test
...
Summary of Failures:
1/10 generate_rsa_key_test FAIL 0.01s killed by signal
11 SIGSEGV
Ok: 9
Expected Fail: 0
Fail: 1
Unexpected Pass:0
Skipped:0
Timeout:0
dh_auto_test: error: cd obj-x86_64-linux-gnu && LC_ALL=C.UTF-8
MESON_TESTTHREADS=4 ninja test returned exit code 1
make: *** [debian/rules:6: binary-arch] Error 25
This has also been reported on the openssl-users mailing list:
https://www.mail-archive.com/openssl-users@openssl.org/msg90830.html
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1974037
Title:
openssl: EVP_EC_gen() segfault without init
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1974037/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1974037] Re: openssl: EVP_EC_gen() segfault without init
Attached is a debdiff for the Jammy changes. I'm still working on Kinetic as this will be folded into the merge, but I still need to do some more work as some new patches have surfaced upstream since then, as well as a new Debian revision. I feel the Jammy SRU should still move forward. Note that the patchset is consequent as upstream has changed their approach to the issue a couple of times, now settling into reimplementing the string comparison functions entirely rather than relying on a C locale. This last approach has the benefit of not requiring initialization, which seems to have been the cause of all the regressions observed so far with the first solution. The patches for that last approach haven't made their way to Debian yet, AFAICT. ** Patch added: "openssl.debdiff" https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1974037/+attachment/5592652/+files/openssl.debdiff -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1974037 Title: openssl: EVP_EC_gen() segfault without init To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1974037/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1974037] Re: openssl: EVP_EC_gen() segfault without init
** Changed in: openssl (Ubuntu Kinetic) Status: Confirmed => In Progress -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1974037 Title: openssl: EVP_EC_gen() segfault without init To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1974037/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1974037] Re: openssl: EVP_EC_gen() segfault without init
** Merge proposal linked: https://code.launchpad.net/~schopin/ubuntu/+source/openssl/+git/openssl/+merge/423153 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1974037 Title: openssl: EVP_EC_gen() segfault without init To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1974037/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1974037] Re: openssl: EVP_EC_gen() segfault without init
** Changed in: openssl (Debian) Status: New => Fix Released ** Changed in: openssl (Debian) Importance: Undecided => Unknown -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1974037 Title: openssl: EVP_EC_gen() segfault without init To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1974037/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1974037] Re: openssl: EVP_EC_gen() segfault without init
This issue has been introduced in 3.0.3 upstream but we've backported the patch set to Jammy as well. The cherry-picked fix is in Debian in 3.0.3-4. ** Changed in: openssl (Ubuntu) Status: New => Confirmed ** Also affects: openssl (Ubuntu Kinetic) Importance: Undecided Status: Confirmed ** Also affects: openssl (Ubuntu Jammy) Importance: Undecided Status: New ** Changed in: openssl (Ubuntu Jammy) Status: New => Confirmed ** Changed in: openssl (Ubuntu Jammy) Importance: Undecided => High ** Changed in: openssl (Ubuntu Kinetic) Importance: Undecided => High -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1974037 Title: openssl: EVP_EC_gen() segfault without init To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1974037/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
