Bug 22852 - afflib new security issue CVE-2018-8050
Summary: afflib new security issue CVE-2018-8050
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA5TOO MGA6-64-OK MGA5-32-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2018-03-31 22:25 CEST by David Walser
Modified: 2018-05-12 09:58 CEST (History)
6 users (show)

See Also:
Source RPM: afflib-3.7.16-2.mga7.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2018-03-31 22:25:09 CEST
Fedora has issued an advisory on March 27:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/EK7SAU67TREHY4JCD4MLYAIXRYF3BAX5/

Mageia 5 and Mageia 6 are also affected.
David Walser 2018-03-31 22:25:15 CEST

Whiteboard: (none) => MGA6TOO

Comment 1 Marja Van Waes 2018-03-31 22:27:47 CEST
Assigning to all packagers collectively, since there is no registered maintainer for this package.
CC'ing daviddavid.

Assignee: bugsquad => pkg-bugs
CC: (none) => geiger.david68210, marja11

Comment 2 David GEIGER 2018-04-01 09:48:36 CEST
Done!
Comment 3 David Walser 2018-04-01 17:16:19 CEST
Advisory:
========================

Updated afflib packages fix security vulnerability:

A flaw was found in AFFLIB (aka AFFLIBv3) through 3.7.16. The af_get_page()
function in lib/afflib_pages.cpp allows remote attackers to cause a denial of
service (segmentation fault) via a corrupt AFF image that triggers an
unexpected pagesize value (CVE-2018-8050).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8050
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/EK7SAU67TREHY4JCD4MLYAIXRYF3BAX5/
========================

Updated packages in core/updates_testing:
========================
afflib-3.7.4-4.1.mga5
libafflib0-3.7.4-4.1.mga5
libafflib-devel-3.7.4-4.1.mga5
afflib-3.7.10-1.1.mga6
libafflib0-3.7.10-1.1.mga6
libafflib-devel-3.7.10-1.1.mga6

from SRPMS:
afflib-3.7.4-4.1.mga5.src.rpm
afflib-3.7.10-1.1.mga6.src.rpm

Version: Cauldron => 6
Whiteboard: MGA6TOO => MGA5TOO

Comment 4 David Walser 2018-05-04 04:23:09 CEST
Oops, forgot to assign to QA!

Assignee: pkg-bugs => qa-bugs

Comment 5 Herman Viaene 2018-05-06 13:47:32 CEST
MGA5-32 on Dell Latitude D600 Xfce
No installation issues.
Created image from my MGA6 partition on this laptop to an external harddisk.
# dd if=/dev/sda6 of=/run/media/tester5/35413397-6721-4f3f-a424-fc29c524258b/testaffsda6.img
29539904+0 records gelezen
29539904+0 records geschreven
15124430848 bytes (15 GB) gekopieerd, 1130,75 s, 13,4 MB/s
then tried
# affconvert /run/media/tester5/35413397-6721-4f3f-a424-fc29c524258b/testaffsda6.img 
/run/media/tester5/35413397-6721-4f3f-a424-fc29c524258b/testaffsda6.img: No such file or directory
Googling on this error did not make me any wiser and
]# affconvert 
affconvert version 3.7.4

usage:   affconvert [options] file1 [... files] 

examples:
  affconvert file1.iso --- convert file1.iso to file1.aff
Out of despair I renamed the file to testaffsda6.iso, but that didn'help.

CC: (none) => herman.viaene

Comment 6 Len Lawrence 2018-05-06 21:04:49 CEST
Tried installing this, pre-update but could not find aimage, which is supposed to be part of the afflib-tools package.

CC: (none) => tarazed25

Comment 7 Len Lawrence 2018-05-06 21:38:25 CEST
Trying Herman's approach led nowhere because afflib deals with AFF and RAW formats only.  AFAICS aimage is required to generate the AFF format image so where is it?
# ls /bin/aff*
/bin/affcat*      /bin/affcrypto*     /bin/affixcompress*  /bin/affstats*
/bin/affcompare*  /bin/affdiskprint*  /bin/affrecover*     /bin/affuse*
/bin/affconvert*  /bin/affinfo*       /bin/affsegment*     /bin/affverify*
/bin/affcopy*     /bin/affix*         /bin/affsign*        /bin/affxml*

affconvert could be used to convert a RAW file to AFF format but what is RAW format?
Comment 8 Len Lawrence 2018-05-06 23:05:59 CEST
The img file was created with dd so you cannot get more raw than that.
Renamed sda8.img to sda8.raw and fed it to affconvert, and it was accepted.  !!
Comment 9 Len Lawrence 2018-05-07 00:06:08 CEST
# dd if=/dev/sda8 of=/run/media/lcl/regulus/sda8.img
32452608+0 records in
32452608+0 records out
16615735296 bytes (17 GB, 15 GiB) copied, 105.949 s, 157 MB/s

# mv sda8.img sda8.raw
# affconvert /run/media/lcl/regulus/sda8.raw sda8.aff
convert /run/media/lcl/regulus/sda8.raw --> /run/media/lcl/regulus/sda8.aff
Converting page 990 of 990
md5: 424108ab221b9addd3e36405db476fa1
sha1: 5f875a90fb9017757caf18ba3c782c2c219863dc
bytes converted: 16615735296 
Total pages: 991  (991 compressed)
Conversion finished.
affconvert: Can't convert a file to itself
<???>
# cd /run/media/lcl/regulus/
$ ll sda8*
-rwxr-xr-x 1 root root  4433886580 May  6 20:15 sda8.aff*
-rw-r--r-- 1 root root 16615735296 May  6 20:15 sda8.raw

@Herman: you could try something like that on your /testaffsda6.img.
Comment 10 Len Lawrence 2018-05-07 02:27:34 CEST
Updated the packages, changed ownership of the test files to user and ran the conversion again.
$ affconvert /run/media/lcl/regulus/sda8.raw sda8.aff
convert /run/media/lcl/regulus/sda8.raw --> /run/media/lcl/regulus/sda8.aff
Converting page 990 of 990
md5: 424108ab221b9addd3e36405db476fa1
sha1: 5f875a90fb9017757caf18ba3c782c2c219863dc
bytes converted: 16615735296 
Total pages: 991  (991 compressed)
Conversion finished.
affconvert: Can't convert a file to itself

$ affinfo sda8_before.aff
sda8_before.aff is a AFF file

sda8_before.aff
[skipping data segments]
                                        data       
Segment                       arg      length    data
=======                 =========    ========    ====
badflag                         0        512   BAD SECTOR....#.:]j...,BZGl..%..
badsectors                      2          8   = 0 (64-bit value)
afflib_version                  0          8   "3.7.10"
aff_file_type                   0          3   AFF
acquisition_commandline         0         51   affconvert /run/media/lcl/regulu
pagesize                 16777216          0   
sectorsize                    512          0   
imagesize                       2          8   = 16615735296 (64-bit value)
md5                             0         16   4241 08AB 221B 9ADD D3E3 6405...
sha1                            0         20   5F87 5A90 FB90 1775 7CAF 18BA 3C78 
                                               2C2C 2198 63DC 
image_gid                       0         16   7DE1 C35D 1845 9711 CCFD 95C2...
acquisition_date                0         20   2018-05-06 20:15:42.

Total segments:            1003   (1003 real)
  Page  segments:           991
  Hash  segments:             0
  Signature segments:         0
  Null segments:              0

$ ll sda8*
-rwxr-xr-x 1 lcl lcl  4433886580 May  6 20:15 sda8.aff*
-rwxr-xr-x 1 lcl lcl  4433886580 May  6 20:15 sda8_before.aff*
-rw-r--r-- 1 lcl lcl 16615735296 May  6 20:15 sda8.raw
$ affinfo sda8.aff > after
$ affinfo sda8_before.aff > before
$ diff before after
1c1
< sda8_before.aff is a AFF file
---
> sda8.aff is a AFF file
3c3
< sda8_before.aff
---
> sda8.aff
8c8
< badflag                         0        512   BAD SECTOR....#.:]j...,BZGl..%..
---
> badflag                         0        512   BAD SECTOR.m..T. .O<*S6J,....I..
19c19
< image_gid                       0         16   7DE1 C35D 1845 9711 CCFD 95C2...
---
> image_gid                       0         16   0618 D4A7 5486 FF8D BABF 0859...

Close enough.

$ affinfo sda8.raw
sda8.raw is a Raw file

sda8.raw
[skipping data segments]
                                        data       
Segment                       arg      length    data
=======                 =========    ========    ====

Total segments:             991   (991 real)
  Page  segments:           991
  Hash  segments:             0
  Signature segments:         0
  Null segments:              0

$ affcopy sda8.aff ~/temp.aff
/home/lcl/temp.aff: 4433856067 bytes transferred in 8.71 seconds. xfer rate: 509.18 MBytes/sec
$ ll ~/temp.aff
-rw-r--r-- 1 lcl lcl 4433886580 May  7 01:03 /home/lcl/temp.aff

$ affverify ~/temp.aff
<Reads every sector>
  Read    16592666624/   16615735296 bytes; done in  0:00:00
  Read    16609443840/   16615735296 bytes; done in  0:00:00

Calculated SHA1: 5f875a90fb9017757caf18ba3c782c2c219863dc  VERIFIES
Calculated MD5:  424108ab221b9addd3e36405db476fa1          VERIFIES

$ affix ~/temp.aff
/home/lcl/temp.aff  Scanning AFF file...

This returned almost immediately which implies nothing needed fixing.

$ affxml sda8.aff
That worked OK, generating an XML description of the file.
$ affcompare -b sda8.aff sda8_before.aff
  Metadata segments  in both files:

    < badflag arg=0 len=512
          BAD SECTOR.m..T. .O<*S6J,....I....7.."L9..u.Bn6~..r_...A.Gl.
    > badflag arg=0 len=512
          BAD SECTOR....#.:]j...,BZGl..%....c0.}....$.e..........K.(..
        *** Metadata segment are different (bad flags should be different!)

    < image_gid arg=0 len=16
          ....T......Y..w_
    > image_gid arg=0 len=16
          }..].E......x...
        *** Metadata segment are different 

^C

Crashed out of that because it was taking a long time.

These were fairly obvious tests but some of the other tools required a deeper knowledge of the system.  This looks OK for 64 bits on Mageia 6.

Whiteboard: MGA5TOO => MGA5TOO MGA6-64-OK

Comment 11 Herman Viaene 2018-05-07 10:38:43 CEST
@ Len Comment 9
Renamed testaffsda6.iso to testaffsda6.raw, now affconvert is running. Will report back when it finishes.
Comment 12 Herman Viaene 2018-05-07 13:28:38 CEST
# affconvert testaffsda6.raw testaff.aff
convert testaffsda6.raw --> testaffsda6.aff
Converting page 901 of 901
md5: c970d6e868fbf6dd7213a26daa079ec9
sha1: 07b893d00a7c1bd0b2d9ec17e578650c01fb11cf
bytes converted: 15124430848 
Total pages: 902  (890 compressed)
Conversion finished.


affconvert: Can't convert a file to itself
and
# ls -als testaffsd*
 6317340 -rwxr-xr-x 1 root root  6468950914 mei  6 12:38 testaffsda6.aff*
14769956 -rw-r--r-- 1 root root 15124430848 mei  6 12:38 testaffsda6.raw

# affinfo testaffsda6.aff 
testaffsda6.aff is a AFF file

testaffsda6.aff
[skipping data segments]
                                        data       
Segment                       arg      length    data
=======                 =========    ========    ====
badflag                         0        512   g.isQ.J.)......F|.T.....vZ.c3...
badsectors                      2          8   = 0 (64-bit value)
afflib_version                  0          7   "3.7.4"
aff_file_type                   0          3   AFF
acquisition_commandline         0         38   affconvert testaffsda6.raw testa
pagesize                 16777216          0   
sectorsize                    512          0   
imagesize                       2          8   = 15124430848 (64-bit value)
md5                             0         16   C970 D6E8 68FB F6DD 7213 A26D AA07 9EC9 
sha1                            0         20   07B8 93D0 0A7C 1BD0 B2D9 EC17 E578 
                                               650C 01FB 11CF 
image_gid                       0         16   F658 8AAF 47DD 661A 485B 0FFD 4E8E 2F76 
acquisition_date                0         20   2018-05-06 12:38:51.

Total segments:             914   (914 real)
  Page  segments:           902
  Hash  segments:             0
  Signature segments:         0
  Null segments:              0

# affinfo testaffsda6.raw
testaffsda6.raw is a Raw file

testaffsda6.raw
[skipping data segments]
                                        data       
Segment                       arg      length    data
=======                 =========    ========    ====

Total segments:             902   (902 real)
  Page  segments:           902
  Hash  segments:             0
  Signature segments:         0
  Null segments:              0

Well at least the commands work, but I'm not really happy. Check on affconvert --help, and you'll find 
- no reference to a .raw suffix needed
- no need to define an output file
Comment 13 Len Lawrence 2018-05-07 16:48:14 CEST
@Herman - you are right - the documentation is not all that helpful, and I am still wondering where aimage went.
Comment 14 Len Lawrence 2018-05-09 09:59:39 CEST
Adding OK for mga5 32-bits on Herman's behalf.
Is this sufficient or should we also test 64-bits for mga5?  Cannot remember our policy wrt this question.
Len Lawrence 2018-05-09 10:00:08 CEST

Whiteboard: MGA5TOO MGA6-64-OK => MGA5TOO MGA6-64-OK MGA5-32-OK

Comment 15 David Walser 2018-05-09 11:51:30 CEST
(In reply to Len Lawrence from comment #14)
> Is this sufficient or should we also test 64-bits for mga5?  Cannot remember
> our policy wrt this question.

Testing one arch is sufficient for most packages.  We actually tested both for this one.  Validate it.
Len Lawrence 2018-05-09 13:07:22 CEST

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 16 Thomas Backlund 2018-05-12 09:13:19 CEST
advisory added to svn

Keywords: (none) => advisory
CC: (none) => tmb

Comment 17 Mageia Robot 2018-05-12 09:58:49 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2018-0231.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.