I reproduced the orphan-rescan null dereference reported here against Debian cron 3.0pl1-212 and Ubuntu's 3.0pl1-209ubuntu1 source.
When an orphaned crontab's account becomes resolvable again, check_orphans() calls process_crontab() with old_db == NULL. On a validation failure (for example, an insecure spool-file mode), process_crontab() calls force_rescan_user(), which currently dereferences old_db through find_user(). The attached standalone patch guards that lookup and includes a regression test that reproduces the orphan/adoption path. The patch applied independently to the Debian -212 source. The regression passed with the fix and reproduced the crash when the fix was removed. The broader patched Debian source built and passed its existing integration suite in a disposable testbed. This attachment contains only the fix and test for this already-public issue. Please review for inclusion and any supported-release backports. Brett Sutton ** Patch added: "daybreak-F-03-orphan-rescan.patch" https://bugs.launchpad.net/bugs/1846025/+attachment/6014233/+files/daybreak-F-03-orphan-rescan.patch -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1846025 Title: cron can crash (SIGSEGV) when trying to re-parent orphans To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cron/+bug/1846025/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
