Bug 27775

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13351

Upstream commit fixing it linked from here:
https://ubuntu.com/security/CVE-2019-13351

Summary: jackit security vulnerability CVE-2019-13351 => jackit new security issue CVE-2019-13351

Done for mga7!

CC: (none) => geiger.david68210

Advisory:
========================

Updated jackit packages fix security vulnerability:

posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 has a "double
file descriptor close" issue during a failed connection attempt when jackd2 is
not running. Exploitation success depends on multithreaded timing of that
double close, which can result in unintended information disclosure, crashes,
or file corruption due to having the wrong file associated with the file
descriptor (CVE-2019-13351).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13351
========================

Updated packages in core/updates_testing:
========================
jackit-1.9.12-2.1.mga7
libjack0-1.9.12-2.1.mga7
libjack-devel-1.9.12-2.1.mga7
jackit-example-clients-1.9.12-2.1.mga7

from jackit-1.9.12-2.1.mga7.src.rpm

Assignee: bugsquad => qa-bugs

mga7, x86

Looking at TV with vlc.  Never managed to get TV configured in kodi.  Installed vlc-plugin-jack but had no problems with TV signal.  Checked plugins and  extensions in the vlc interface; JACK output registered 100, input was 0.

Tried
$ jack_monitor_client vlc
and received a lot of messages...
e.g Acquire audio card Audio0
creating alsa driver ... hw:0|hw:0|1024|2|48000|0|0|nomon|swmeter|-|32bit
configuring for 48000Hz, period = 1024 frames (21.3 ms), buffer = 2 periods
...
jack_port_request_monitor_by_name called with an incorrect port vlc
could not enable monitoring for vlc

Getting lost here.  That needs a port number.

Updated the four packages.
Example clients turn up in /usr/bin
/usr/bin/jack_alias*              /usr/bin/jack_monitor_client*
/usr/bin/jack_bufsize*            /usr/bin/jack_multiple_metro*
/usr/bin/jack_connect*            /usr/bin/jack_net_master*
/usr/bin/jack_control*            /usr/bin/jack_net_slave*
/usr/bin/jack_cpu*                /usr/bin/jack_netsource*
/usr/bin/jack_cpu_load*           /usr/bin/jack_rec*
/usr/bin/jackd*                   /usr/bin/jack_samplerate*
/usr/bin/jackdbus*                /usr/bin/jack_server_control*
/usr/bin/jack_disconnect@         /usr/bin/jack_session_notify*
/usr/bin/jack_evmon*              /usr/bin/jack_showtime*
/usr/bin/jack_freewheel*          /usr/bin/jack_simdtests*
/usr/bin/jack_iodelay*            /usr/bin/jack_simple_client*
/usr/bin/jack_latent_client*      /usr/bin/jack_simple_session_client*
/usr/bin/jack_load*               /usr/bin/jack_test*
/usr/bin/jack_lsp*                /usr/bin/jack_thru*
/usr/bin/jack_metro*              /usr/bin/jack_transport*
/usr/bin/jack_midi_dump*          /usr/bin/jack_unload*
/usr/bin/jack_midi_latency_test*  /usr/bin/jack_wait*
/usr/bin/jack_midiseq*            /usr/bin/jack_zombie*
/usr/bin/jack_midisine*

Ran up vlc again with a TV channel list.
The following command is used in testing only.
$ jack_freewheel y
Cannot connect to server socket err = No such file or directory
Cannot connect to server request channel
jackdmp 1.9.12
.....
JACK server starting in realtime mode with priority 10
self-connect-mode is "Don't restrict self connect requests"
Cannot lock down 82280346 byte memory area (Cannot allocate memory)
audio_reservation_init
Acquire audio card Audio0
....
Jack main caught signal 2
Released audio card Audio0
audio_reservation_finish

$ strace -o vlc.trace vlc --avcodec-hw none channels.xspf
$ grep jack vlc.trace
stat("/usr/lib64/vlc/plugins/access/libaccess_jack_plugin.so", {st_mode=S_IFREG|0755, st_size=23824, ...}) = 0
stat("/usr/lib64/vlc/plugins/audio_output/libjack_plugin.so", {st_mode=S_IFREG|0755, st_size=19728, ...}) = 0

So, jackit is being used by vlc.  vlc-plugin-jack is in the list for lib64jack0.
Tried mplayer on a video with similar results.

Not going to pass this, although the basics seem to work.  It would be useful if somebody could reproduce the fault by running Kodi TV.  It should fault before the update and work afterwards.

Ping!  Ping!

CC: (none) => tarazed25

Going to move this one on.

Whiteboard: (none) => MGA7-64-OK

Validating. Advisory in Comment 3.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Advisory pushed to SVN.

Keywords: (none) => advisory
CC: (none) => ouaurelien

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2020-0476.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED