Bug 26061 - matio new security issue CVE-2019-13107
Summary: matio new security issue CVE-2019-13107
Status: NEW
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard:
Keywords: feedback
Depends on:
Blocks:
 
Reported: 2020-01-12 18:04 CET by David Walser
Modified: 2020-02-20 18:04 CET (History)
6 users (show)

See Also:
Source RPM: matio-1.5.13-2.mga7.src.rpm
CVE:
Status comment: Fixed upstream in 1.5.16


Attachments

Description David Walser 2020-01-12 18:04:38 CET
Fedora has issued an advisory today (January 12):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/N7AE25FWDBPC7KLVMPLHT4G64O4GISQQ/

The issue is fixed upstream in 1.5.16.
David Walser 2020-01-14 17:35:27 CET

Status comment: (none) => Fixed upstream in 1.5.16

Comment 1 David GEIGER 2020-01-23 11:27:09 CET
Done for mga7, also a scilab rebuild is needed due to the libmajor change but unfortunately it fails to build.
Comment 2 David Walser 2020-01-23 12:44:36 CET
So the matio update is:
matio-1.5.16-1.mga7
libmatio9-1.5.16-1.mga7
libmatio-devel-1.5.16-1.mga7

and the failed scilab rebuild looks like either a parallel make problem or a Java problem.  Maybe Nicolas can help.

CC: (none) => nicolas.salguero

Comment 3 Nicolas Salguero 2020-01-24 14:14:23 CET
Hi,

It is a java problem.

On my machine I tried to rebuild scilab with openjdk 8u242-b07 (which is in updates_testing) and it failed with the same error.

Then I tried to rebuild scilab with openjdk 8u232-b09 (which is in updates) and it succeeded.

In openjdk, the problem comes from the method loadLibrary of the class java.lang.ClassLoader:
"""
    static void loadLibrary(Class<?> fromClass, String name,
                            boolean isAbsolute) {
[...]
        assert sys_paths != null : "should be initialized at this point";
        assert usr_paths != null : "should be initialized at this point";
[...]
        for (int i = 0 ; i < sys_paths.length ; i++) { <- /!\ NPE HERE
[...]
    }
"""
So, if there was no concurrent problem, the NPE should not be possible.

A diff between openjdk 8u232-b09 and 8u242-b07 shows that the methods load0 and loadLibrary0 from the class java.lang.Runtime were marked as "synchronized" in openjdk 8u232-b09 and are no more marked as "synchronized" in openjdk 8u242-b07.

I will try to revert that change in a new build of openjdk to see if it solves the issue.

Best regards,

Nico.
Comment 4 Nicolas Salguero 2020-01-24 15:49:00 CET
Sadly it does not work.
Nicolas Salguero 2020-01-24 16:40:09 CET

Depends on: (none) => 26075

Nicolas Salguero 2020-01-27 18:09:20 CET

Depends on: 26075 => (none)

Comment 5 Nicolas Salguero 2020-01-27 18:11:04 CET
Scilab is now rebuilt.
Comment 6 David GEIGER 2020-01-27 18:28:22 CET
(In reply to Nicolas Salguero from comment #5)
> Scilab is now rebuilt.

Excellent! Thanks Nicolas.
Comment 7 David Walser 2020-01-27 19:46:49 CET
Advisory:
========================

Updated matio packages fix security vulnerability:

Multiple integer overflows exist in MATIO before 1.5.16, related to mat.c,
mat4.c, mat5.c, mat73.c, and matvar_struct.c (CVE-2019-13107).

The matio package has been updated to version 1.5.16 to fix this issue.

Also, the scilab package has been rebuilt against the updated matio package.

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13107
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/N7AE25FWDBPC7KLVMPLHT4G64O4GISQQ/
========================

Updated packages in core/updates_testing:
========================
matio-1.5.16-1.mga7
libmatio9-1.5.16-1.mga7
libmatio-devel-1.5.16-1.mga7
scilab-6.0.2-2.1.mga7
scilab-devel-6.0.2-2.1.mga7
scilab-doc-6.0.2-2.1.mga7
scilab-tests-6.0.2-2.1.mga7

from SRPMS:
matio-1.5.16-1.mga7.src.rpm
scilab-6.0.2-2.1.mga7.src.rpm

CC: (none) => geiger.david68210
Assignee: geiger.david68210 => qa-bugs

Comment 8 Herman Viaene 2020-01-28 15:12:44 CET
MGA7-64 Plasma on Lenovo B50
No installation issues
Tried some commands as Matlab is not my terrain.
$ matdump --version
matdump 1.5.16
Written by Christopher Hulbert

Copyright(C) 2006-2019, Christopher C. Hulbert

$ matdump --help

Usage: matdump [OPTIONS] mat_file [var1 var2 ...]

Runs various test on the Matlab I/O library libmatio

OPTIONS
-d,--data         Print data with header information
-f,--format whos  Turn on 'whos' display mode
-h,--human        Human readable sizes in 'whos' display mode
-v,--verbose      Turn on verbose messages
-H,--help         This output
-V,--version      version information

mat_file          name of the MAT file to dump
var1 var2 ...     If specified, dumps only listed variables

Report bugs to <t-beu@users.sourceforge.net>.

and$ scilab
java.io.IOException: Cannot run program "/opt/X11/bin/xprop": error=2, Bestand of map bestaat niet
        at java.lang.ProcessBuilder.start(ProcessBuilder.java:1048)
        at java.lang.Runtime.exec(Runtime.java:621)
        at java.lang.Runtime.exec(Runtime.java:451)
        at java.lang.Runtime.exec(Runtime.java:348)
        at org.GNOME.Accessibility.AtkWrapper.<clinit>(AtkWrapper.java:34)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
        at java.lang.Class.newInstance(Class.java:442)
        at java.awt.Toolkit.loadAssistiveTechnologies(Toolkit.java:805)
        at java.awt.Toolkit.getDefaultToolkit(Toolkit.java:887)
        at org.scilab.modules.commons.gui.ScilabKeyStroke.<clinit>(Unknown Source)
        at org.scilab.modules.commons.xml.XConfiguration.createDocument(Unknown Source)
        at org.scilab.modules.commons.xml.XConfiguration.getXConfigurationDocument(Unknown Source)
        at org.scilab.modules.core.Scilab.<clinit>(Unknown Source)
Caused by: java.io.IOException: error=2, Bestand of map bestaat niet
        at java.lang.UNIXProcess.forkAndExec(Native Method)
        at java.lang.UNIXProcess.<init>(UNIXProcess.java:247)
        at java.lang.ProcessImpl.start(ProcessImpl.java:134)

but eventually the scilab console opens, and that's about the end for me, the obvious "File" menus open .....
Someone else's conclusion ????

CC: (none) => herman.viaene

Comment 9 Thomas Andrews 2020-02-13 19:44:56 CET
Some of the things we run into as QA testers are mind-boggling. Before becoming part of QA, I had no idea we had all this capability included in Mageia.

I did a search for "scilab" and found the Wikipedia page. After reading that, I've come to the conclusion that we are unlikely to find a member of QA who would get any farther than you did, Herman. I certainly couldn't.

I'm going to send this on on the basis of a clean install, and because "eventually the scilab console opens" in your test.

Validating. Advisory in Comment 7.

Whiteboard: (none) => MGA7-64-OK
Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Comment 10 Thomas Backlund 2020-02-18 13:52:21 CET
dropping ok

this need to be patched / fixed so it finds the tool:

and$ scilab
java.io.IOException: Cannot run program "/opt/X11/bin/xprop": error=2, Bestand of map bestaat niet



$ urpmf bin/xprop
xprop:/usr/bin/xprop

CC: (none) => tmb
Keywords: validated_update => feedback

Comment 11 Thomas Andrews 2020-02-20 18:04:13 CET
Then the OK needs to be dropped, too.

Whiteboard: MGA7-64-OK => (none)


Note You need to log in before you can comment on or make changes to this bug.