11570 – X server segfault vulnerability

Bug 11570 - X server segfault vulnerability

Summary: X server segfault vulnerability

Status:	RESOLVED OLD

Alias:	None

Product:	Mageia
Classification:	Unclassified
Component:	RPM Packages (show other bugs)
Version:	2
Hardware:	All Linux

Priority:	Normal Severity: critical
Target Milestone:	---
Assignee:	Mageia Bug Squad
QA Contact:

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:

Reported:	2013-10-31 06:39 CET by Kevin Bulgrien
Modified:	2013-11-23 16:18 CET (History)
CC List:	2 users (show)

See Also:
Source RPM:	x11-server-1.11.4-2.4.mga2.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Kevin Bulgrien 2013-10-31 06:39:10 CET

Description of problem:

I play Minecraft on multiple Mageia 2 systems.  On both x86_64 and i586 instances on two completely different hardware platforms, application of recent security updates rendered Minecraft unplayable.  Before the update, everything worked fine.  After a reboot subsequent to application of the updates, the minecraft launcher triggers a segfault of the X server after pressing the play button, but before the splash screen is displayed.  The segfault terminates the current KDE session.

The first instance was observed on x86_64 on Oct 25, 2013.  Though I was very sure that the only factor was the Mageia security update, because the update occurred on one day and the fault occurred the next, some minor doubt was present.  This is the record of that update:

Oct 25 21:10:28 matrix MageiaUpdate[3923]: ### Program is starting ###
Oct 25 21:10:29 matrix MageiaUpdate[3923]: opening the RPM database
Oct 25 21:10:30 matrix MageiaUpdate[3923]: opening the RPM database
Oct 25 21:13:51 matrix MageiaUpdate: transaction on / (remove=0, install=0, upgrade=5)
Oct 25 21:13:59 matrix MageiaUpdate[3923]: [RPM] lib64icu48-1:4.8.1.1-2.1.mga2.x86_64 installed
Oct 25 21:14:00 matrix MageiaUpdate[3923]: [RPM] x11-server-common-1.11.4-2.4.mga2.x86_64 installed
Oct 25 21:14:00 matrix MageiaUpdate[3923]: [RPM] x11-server-xorg-1.11.4-2.4.mga2.x86_64 installed
Oct 25 21:14:01 matrix MageiaUpdate[3923]: [RPM] lib64icu-devel-1:4.8.1.1-2.1.mga2.x86_64 installed
Oct 25 21:14:02 matrix MageiaUpdate[3923]: [RPM] python-pycrypto-2.3-2.2.mga2.x86_64 installed
Oct 25 21:14:02 matrix MageiaUpdate[3923]: [RPM] lib64icu-devel-1:4.8.1.1-2.mga2.x86_64 removed
Oct 25 21:14:03 matrix MageiaUpdate[3923]: [RPM] x11-server-xorg-1.11.4-2.2.mga2.x86_64 removed
Oct 25 21:14:04 matrix MageiaUpdate[3923]: [RPM] x11-server-common-1.11.4-2.2.mga2.x86_64 removed
Oct 25 21:14:05 matrix MageiaUpdate[3923]: [RPM] lib64icu48-1:4.8.1.1-2.mga2.x86_64 removed
Oct 25 21:14:05 matrix MageiaUpdate[3923]: [RPM] python-pycrypto-2.3-2.1.mga2.x86_64 removed
Oct 25 21:14:06 matrix MageiaUpdate[3923]: running: rpm -ql x11-server-xorg-1.11.4-2.4.mga2
Oct 25 21:14:06 matrix MageiaUpdate[3923]: running: rpm -ql python-pycrypto-2.3-2.2.mga2
Oct 25 21:14:06 matrix MageiaUpdate[3923]: running: rpm -ql x11-server-common-1.11.4-2.4.mga2
Oct 25 21:14:06 matrix MageiaUpdate[3923]: running: rpm -ql lib64icu-devel-4.8.1.1-2.1.mga2
Oct 25 21:14:06 matrix MageiaUpdate[3923]: running: rpm -ql lib64icu48-4.8.1.1-2.1.mga2
Oct 25 21:14:07 matrix MageiaUpdate[3923]: opening the RPM database
Oct 25 21:39:32 matrix MageiaUpdate[3923]: ### Program is exiting ###

However, tonight, I started an i586 system that had not received this update with the express thought to test for this problem.  I booted the system.  I verified that the minecraft launcher could start normally.  (It is not necessary to actually play minecraft to trigger the segfault.  All one has to do is press the play button and wait for the "connect" screen.  The segfault, if it occurs, happens before the connect screen is visible.)

I then applied updates to the i586 system:
Oct 30 23:27:25 roz MageiaUpdate[17538]: ### Program is starting ###
Oct 30 23:27:50 roz MageiaUpdate[17538]: opening the RPM database
Oct 30 23:27:51 roz MageiaUpdate[17538]: opening the RPM database
Oct 30 23:36:51 roz MageiaUpdate: transaction on / (remove=0, install=0, upgrade=9)
Oct 30 23:36:53 roz MageiaUpdate[17538]: [RPM] libsystemd-id1280-44-13.1.mga2.i586 installed
Oct 30 23:36:53 roz MageiaUpdate[17538]: [RPM] libsystemd-journal0-44-13.1.mga2.i586 installed
Oct 30 23:36:53 roz MageiaUpdate[17538]: [RPM] libsystemd-daemon0-44-13.1.mga2.i586 installed
Oct 30 23:36:54 roz MageiaUpdate[17538]: [RPM] libsystemd-login0-44-13.1.mga2.i586 installed
Oct 30 23:36:55 roz MageiaUpdate[17538]: [RPM] systemd-44-13.1.mga2.i586 installed
Oct 30 23:36:57 roz MageiaUpdate[17538]: [RPM] systemd-units-44-13.1.mga2.i586 installed                                                                      
Oct 30 23:36:58 roz MageiaUpdate[17538]: [RPM] libpolkit1_0-0.104-4.2.mga2.i586 installed                                                                     
Oct 30 23:36:58 roz MageiaUpdate[17538]: [RPM] polkit-0.104-4.2.mga2.i586 installed                                                                           
Oct 30 23:36:59 roz MageiaUpdate[17538]: [RPM] systemd-sysvinit-44-13.1.mga2.i586 installed                                                                   
Oct 30 23:36:59 roz MageiaUpdate[17538]: [RPM] polkit-0.104-4.1.mga2.i586 removed                                                                             
Oct 30 23:37:00 roz MageiaUpdate[17538]: [RPM] libpolkit1_0-0.104-4.1.mga2.i586 removed                                                                       
Oct 30 23:37:00 roz MageiaUpdate[17538]: [RPM] systemd-sysvinit-44-13.mga2.i586 removed                                                                       
Oct 30 23:37:00 roz MageiaUpdate[17538]: [RPM] systemd-44-13.mga2.i586 removed
Oct 30 23:37:01 roz MageiaUpdate[17538]: [RPM] systemd-units-44-13.mga2.i586 removed                                                                          
Oct 30 23:37:01 roz MageiaUpdate[17538]: [RPM] libsystemd-journal0-44-13.mga2.i586 removed                                                                    
Oct 30 23:37:01 roz MageiaUpdate[17538]: [RPM] libsystemd-id1280-44-13.mga2.i586 removed                                                                      
Oct 30 23:37:01 roz MageiaUpdate[17538]: [RPM] libsystemd-daemon0-44-13.mga2.i586 removed                                                                     
Oct 30 23:37:02 roz MageiaUpdate[17538]: [RPM] libsystemd-login0-44-13.mga2.i586 removed                                                                      
Oct 30 23:37:07 roz MageiaUpdate: transaction on / (remove=0, install=0, upgrade=7)                                                                           
Oct 30 23:37:08 roz MageiaUpdate[17538]: [RPM] libhpip0-3.12.4-1.3.mga2.i586 installed                                                                        
Oct 30 23:37:08 roz MageiaUpdate[17538]: [RPM] liblm_sensors4-1:3.3.3-1.mga2.i586 installed                                                                   
Oct 30 23:37:09 roz MageiaUpdate[17538]: [RPM] lm_sensors-1:3.3.3-1.mga2.i586 installed                                                                       
Oct 30 23:37:10 roz MageiaUpdate[17538]: [RPM] hplip-hpijs-3.12.4-1.3.mga2.i586 installed
Oct 30 23:37:10 roz MageiaUpdate[17538]: [RPM] xinetd-2.3.15-1.1.mga2.i586 installed
Oct 30 23:37:11 roz MageiaUpdate[17538]: [RPM] rtkit-0.10-3.1.mga2.i586 installed
Oct 30 23:37:12 roz MageiaUpdate[17538]: [RPM] hplip-model-data-3.12.4-1.3.mga2.i586 installed
Oct 30 23:37:12 roz MageiaUpdate[17538]: [RPM] lm_sensors-1:3.3.2-6.mga2.i586 removed
Oct 30 23:37:12 roz MageiaUpdate[17538]: [RPM] hplip-hpijs-3.12.4-1.2.mga2.i586 removed
Oct 30 23:37:13 roz MageiaUpdate[17538]: [RPM] libhpip0-3.12.4-1.2.mga2.i586 removed
Oct 30 23:37:13 roz MageiaUpdate[17538]: [RPM] liblm_sensors4-1:3.3.2-6.mga2.i586 removed
Oct 30 23:37:13 roz MageiaUpdate[17538]: [RPM] xinetd-2.3.15-1.mga2.i586 removed
Oct 30 23:37:14 roz MageiaUpdate[17538]: [RPM] rtkit-0.10-3.mga2.i586 removed
Oct 30 23:37:14 roz MageiaUpdate[17538]: [RPM] hplip-model-data-3.12.4-1.2.mga2.i586 removed
Oct 30 23:38:20 roz MageiaUpdate: transaction on / (remove=0, install=0, upgrade=8)
Oct 30 23:38:24 roz MageiaUpdate[17538]: [RPM] libicu48-1:4.8.1.1-2.1.mga2.i586 installed
Oct 30 23:38:25 roz MageiaUpdate[17538]: [RPM] x11-server-common-1.11.4-2.4.mga2.i586 installed
Oct 30 23:38:26 roz MageiaUpdate[17538]: [RPM] gnupg-1.4.12-1.3.mga2.i586 installed
Oct 30 23:38:27 roz MageiaUpdate[17538]: [RPM] gnupg2-2.0.18-1.4.mga2.i586 installed
Oct 30 23:38:28 roz MageiaUpdate[17538]: [RPM] x11-server-xorg-1.11.4-2.4.mga2.i586 installed
Oct 30 23:38:29 roz MageiaUpdate[17538]: [RPM] libicu-devel-1:4.8.1.1-2.1.mga2.i586 installed
Oct 30 23:38:29 roz MageiaUpdate[17538]: [RPM] libnas2-1.9.2-6.1.mga2.i586 installed
Oct 30 23:38:30 roz MageiaUpdate[17538]: [RPM] python-pycrypto-2.3-2.2.mga2.i586 installed
Oct 30 23:38:30 roz MageiaUpdate[17538]: [RPM] libicu-devel-1:4.8.1.1-2.mga2.i586 removed
Oct 30 23:38:30 roz MageiaUpdate[17538]: [RPM] x11-server-xorg-1.11.4-2.2.mga2.i586 removed
Oct 30 23:38:31 roz MageiaUpdate[17538]: [RPM] gnupg2-2.0.18-1.2.mga2.i586 removed
Oct 30 23:38:31 roz MageiaUpdate[17538]: [RPM] gnupg-1.4.12-1.2.mga2.i586 removed
Oct 30 23:38:32 roz MageiaUpdate[17538]: [RPM] x11-server-common-1.11.4-2.2.mga2.i586 removed
Oct 30 23:38:32 roz MageiaUpdate[17538]: [RPM] libicu48-1:4.8.1.1-2.mga2.i586 removed
Oct 30 23:38:32 roz MageiaUpdate[17538]: [RPM] libnas2-1.9.2-6.mga1.i586 removed
Oct 30 23:38:33 roz MageiaUpdate[17538]: [RPM] python-pycrypto-2.3-2.1.mga2.i586 removed
Oct 30 23:38:33 roz MageiaUpdate[17538]: running: rpm -ql systemd-units-44-13.1.mga2
Oct 30 23:38:33 roz MageiaUpdate[17538]: running: rpm -ql libsystemd-login0-44-13.1.mga2
Oct 30 23:38:33 roz MageiaUpdate[17538]: running: rpm -ql libsystemd-daemon0-44-13.1.mga2
Oct 30 23:38:33 roz MageiaUpdate[17538]: running: rpm -ql libsystemd-id1280-44-13.1.mga2
Oct 30 23:38:33 roz MageiaUpdate[17538]: running: rpm -ql libsystemd-journal0-44-13.1.mga2
Oct 30 23:38:33 roz MageiaUpdate[17538]: running: rpm -ql systemd-44-13.1.mga2
Oct 30 23:38:33 roz MageiaUpdate[17538]: running: rpm -ql systemd-sysvinit-44-13.1.mga2
Oct 30 23:38:33 roz MageiaUpdate[17538]: running: rpm -ql libpolkit1_0-0.104-4.2.mga2
Oct 30 23:38:33 roz MageiaUpdate[17538]: running: rpm -ql polkit-0.104-4.2.mga2
Oct 30 23:38:33 roz MageiaUpdate[17538]: running: rpm -ql hplip-hpijs-3.12.4-1.3.mga2
Oct 30 23:38:33 roz MageiaUpdate[17538]: running: rpm -ql lm_sensors-3.3.3-1.mga2
Oct 30 23:38:33 roz MageiaUpdate[17538]: running: rpm -ql liblm_sensors4-3.3.3-1.mga2
Oct 30 23:38:33 roz MageiaUpdate[17538]: running: rpm -ql hplip-model-data-3.12.4-1.3.mga2
Oct 30 23:38:33 roz MageiaUpdate[17538]: running: rpm -ql rtkit-0.10-3.1.mga2
Oct 30 23:38:34 roz MageiaUpdate[17538]: running: rpm -ql xinetd-2.3.15-1.1.mga2
Oct 30 23:38:34 roz MageiaUpdate[17538]: running: rpm -ql libhpip0-3.12.4-1.3.mga2
Oct 30 23:38:34 roz MageiaUpdate[17538]: running: rpm -ql gnupg-1.4.12-1.3.mga2
Oct 30 23:38:34 roz MageiaUpdate[17538]: running: rpm -ql python-pycrypto-2.3-2.2.mga2
Oct 30 23:38:34 roz MageiaUpdate[17538]: running: rpm -ql gnupg2-2.0.18-1.4.mga2
Oct 30 23:38:34 roz MageiaUpdate[17538]: running: rpm -ql x11-server-xorg-1.11.4-2.4.mga2
Oct 30 23:38:34 roz MageiaUpdate[17538]: running: rpm -ql libnas2-1.9.2-6.1.mga2
Oct 30 23:38:34 roz MageiaUpdate[17538]: running: rpm -ql x11-server-common-1.11.4-2.4.mga2
Oct 30 23:38:34 roz MageiaUpdate[17538]: running: rpm -ql libicu-devel-4.8.1.1-2.1.mga2
Oct 30 23:38:34 roz MageiaUpdate[17538]: running: rpm -ql libicu48-4.8.1.1-2.1.mga2
Oct 30 23:38:41 roz MageiaUpdate[17538]: opening the RPM database
Oct 30 23:38:44 roz MageiaUpdate[17538]: ### Program is exiting ###

I rebooted the system to assure that the updated X server was loaded.

I then invoked the minecraft launcher and pressed play.  The X server segfaulted and terminated the KDE session.

Though the i586 update was larger in scope, it seems certain that the smaller RPM set observed with the x86_64 system is at the root of the problem.

Version-Release number of selected component (if applicable):

x11-server-1.11.4-2.4

How reproducible:

Mageia 2 x86_64 or i586 system in a state prior to the updates listed above.
task-kde4-minimal installation is sufficient to demonstrate the problem.
Login as a normal user via KDE.
Current minecraft installation.
Start the minecraft launcher.
Login and press play.
Segfault occurs prior to selecting a world to play.

Steps to Reproduce:

1. Set up a system without the most recent updates.

2. The Oracle java JRE is installed as follows.  It is acknowledged that this is not necessarily the ideal way to set up java, but it worked fine for months.
The problem is observable with either 7u25 or 7u45.  For example, obtain Oracle jre-7u45-linux-x64.tar.gz from java.com.

As a privileged user:

# mkdir /opt/java
# tar -xzf jre-7u45-linux-x64.tar.gz
# ln -s jre1.7.0_45 jre

As a regular user, for example, create minecraft.sh with the following content:

export JAVA_HOME=/opt/java/jre
export PATH=/opt/java/jre/bin:$PATH
java -jar ${HOME}/Downloads/Minecraft.jar

3. Download Minecraft.jar from:
     https://minecraft.net/download
   The jar URL is:
     https://s3.amazonaws.com/Minecraft.Download/launcher/Minecraft.jar
   Place the jar in ${HOME}/Downloads

4. Launch minecraft using the minecraft.sh created above.  If minecraft has not been installed before, it will be necessary to let the launcher download files and set up ~/.minecraft.  I have observed that the download process appears to hang at the end of updating at times.  After waiting a while to be sure nothing is actually running, when this happens, I exit the launcher and restart it.  My observations are with launcher 1.3.1 and the prior revision also.  A paid Mojang account is probably required to reproduce.  Login.  Press the prominent Play button at the bottom of the UI.  Wait.  X segfaults after some console activity and before it is possible to interact with the client.

I have logged the following on the Minecraft forums.

http://www.minecraftforum.net/topic/2067009-launcher-128-play-kde-restartimpossible-to-play-could-play-yesterday/#entry25386501

In summary:

/var/log/messages says:

Oct 26 22:03:21 matrix kdm[1962]: X server for display :0 terminated unexpectedly
Oct 26 22:03:21 matrix acpid: client 4126[0:0] has disconnected
Oct 26 22:03:21 matrix acpid: client 4126[0:0] has disconnected
Oct 26 22:03:21 matrix acpid: client connected from 4626[0:0]
Oct 26 22:03:21 matrix acpid: 1 client rule loaded
Oct 26 22:03:21 matrix acpid: client connected from 4626[0:0]
Oct 26 22:03:21 matrix acpid: 1 client rule loaded

/var/log/Xorg.0.log.old shows a seg fault...

[  1355.328]
Backtrace:
[  1355.328] 0: /etc/X11/X (xorg_backtrace+0x26) [0x567d86]
[  1355.328] 1: /etc/X11/X (0x400000+0x16b9d9) [0x56b9d9]
[  1355.328] 2: /lib64/libpthread.so.0 (0x7f422ae38000+0xef70) [0x7f422ae46f70]
[  1355.328] Segmentation fault at address (nil)
[  1355.328]
Fatal server error:
[  1355.328] Caught signal 11 (Segmentation fault). Server aborting
[  1355.328]
[  1355.328]
Please consult the The X.Org Foundation support
                 at http://bugs.mageia.org
 for help.
[  1355.328] Please also check the log file at "/var/log/Xorg.0.log" for additional information.
[  1355.328]
[  1355.345] (II) evdev: Power Button: Close
[  1355.345] (II) UnloadModule: "evdev"
[  1355.345] (II) Unloading evdev
[  1355.356] (II) evdev: Power Button: Close
[  1355.356] (II) UnloadModule: "evdev"
[  1355.356] (II) Unloading evdev
[  1355.370] (II) evdev: Eee PC WMI hotkeys: Close
[  1355.370] (II) UnloadModule: "evdev"
[  1355.370] (II) Unloading evdev
[  1355.380] (II) evdev: AT Translated Set 2 keyboard: Close
[  1355.380] (II) UnloadModule: "evdev"
[  1355.380] (II) Unloading evdev
[  1355.390] (II) evdev: ImExPS/2 Logitech Explorer Mouse: Close
[  1355.390] (II) UnloadModule: "evdev"
[  1355.390] (II) Unloading evdev
[  1355.824] Server terminated with error (1). Closing log file.

I believe that if I backed off the update packages, minecraft would function properly again, but I have no experience with backing out updates.


Reproducible: 

Steps to Reproduce:

Comment 1 David Walser 2013-10-31 15:16:16 CET

Possibly related to the last x11-server security update, packaged by Funda.  Hopefully he can have a look at this.

CC: (none) => fundawang

Comment 2 claire robinson 2013-10-31 15:20:53 CET

Just tested here with mga2 32 (old intel graphics) and mageia java (openjdk).

Downloaded the Minecraft.jar and started with just java -jar Minecraft.jar. As Mageia java openjdk is not in opt the exports are not needed.

Registered a free mojang account and logged in and pressed Play Demo and was able to smash stuff, but this computer is too slow and grinds to a halt when the music begins to play. Managed to log out and close the program normally though with no errors.

It could be difficult to trace with oracle java and binary blobs in use.

claire robinson 2013-10-31 15:21:13 CET

CC: (none) => eeeemail

Comment 3 Manuel Hiebel 2013-11-23 16:18:26 CET

Mageia 2 changed to end-of-life (EOL) status on ''22 November''. Mageia 2 is no
longer maintained, which means that it will not receive any further security or
bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of Mageia
please feel free to click on "Version" change it against that version of Mageia
and reopen this bug.

Thank you for reporting this bug and we are sorry it could not be fixed.

--
The Mageia Bugsquad

Status: NEW => RESOLVED
Resolution: (none) => OLD

Note You need to log in before you can comment on or make changes to this bug.