Bug 33409 - gtk+2.0 and gtk+3.0 new security issue CVE-2024-6655
Summary: gtk+2.0 and gtk+3.0 new security issue CVE-2024-6655
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK MGA9-32-OK
Keywords: advisory, validated_update
Depends on: 33198
Blocks: 33449
  Show dependency tree / graph
 
Reported: 2024-07-17 15:40 CEST by Nicolas Salguero
Modified: 2024-09-25 20:09 CEST (History)
5 users (show)

See Also:
Source RPM: gtk+2.0-2.24.33-5.mga9.src.rpm, gtk+3.0-3.24.38-1.mga9.src.rpm
CVE: CVE-2024-6655
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Nicolas Salguero 2024-07-17 15:40:58 CEST 
Ubuntu has issued an advisory on July 16:
https://ubuntu.com/security/notices/USN-6899-1

Mageia 9 is also affected.
Nicolas Salguero 2024-07-17 15:41:31 CEST

CVE: (none) => CVE-2024-6655
Status comment: (none) => Patches available from Ubuntu
Source RPM: (none) => gtk+3.0-3.24.43-1.mga10.src.rpm, gtk+2.0-2.24.33-5.mga9.src.rpm
Whiteboard: (none) => MGA9TOO

Comment 1 Lewis Smith 2024-07-17 20:38:20 CEST 
I cannot find the patches. This is the best thing I did find:
gtk+2.0_2.24.33.orig.tar.xz
https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/gtk+2.0/2.24.33-4ubuntu1.1/gtk+2.0_2.24.33.orig.tar.xz

but the equivalent link for GTK+3 went nowhere.
They are Ubuntu files anyway.

Assigning globally.

Assignee: bugsquad => pkg-bugs

Comment 2 Nicolas Salguero 2024-07-18 09:11:31 CEST 
Hi,

In Debian and Ubuntu, the "orig" tarballs are the upstream ones.

The patches from Debian or Ubuntu are in the "debian" tarballs:

https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/gtk+2.0/2.24.33-4ubuntu1.1/gtk+2.0_2.24.33-4ubuntu1.1.debian.tar.xz

https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/gtk+3.0/3.24.41-4ubuntu1.1/gtk+3.0_3.24.41-4ubuntu1.1.debian.tar.xz

Best regards,

Nico.
Comment 3 Nicolas Salguero 2024-09-18 14:28:04 CEST Comment hidden (obsolete)

Whiteboard: MGA9TOO => (none)
Status comment: Patches available from Ubuntu => (none)
Status: NEW => ASSIGNED
Assignee: pkg-bugs => qa-bugs
Source RPM: gtk+3.0-3.24.43-1.mga10.src.rpm, gtk+2.0-2.24.33-5.mga9.src.rpm => gtk+2.0-2.24.33-5.mga9.src.rpm, glib2.0-2.76.3-1.mga9.src.rpm, gtk+3.0-3.24.38-1.mga9.src.rpm
Version: Cauldron => 9

Comment 4 Nicolas Salguero 2024-09-18 15:12:01 CEST 
Suggested advisory:
========================

The updated packages fix a packaging issue and a security vulnerability:

A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory. (CVE-2024-6655)

References:
https://ubuntu.com/security/notices/USN-6899-1
========================

Updated packages in core/updates_testing:
========================
gtk+2.0-2.24.33-5.1.mga9
lib(64)gail18-2.24.33-5.1.mga9
lib(64)gail-devel-2.24.33-5.1.mga9
lib(64)gtk+-x11-2.0_0-2.24.33-5.1.mga9
lib(64)gtk+2.0_0-2.24.33-5.1.mga9
lib(64)gtk+2.0-devel-2.24.33-5.1.mga9
lib(64)gtk-gir2.0-2.24.33-5.1.mga9

gtk+3.0-3.24.38-1.1.mga9
gtk-update-icon-cache-3.24.38-1.1.mga9
lib(64)gail3_0-3.24.38-1.1.mga9
lib(64)gail3.0-devel-3.24.38-1.1.mga9
lib(64)gtk+3_0-3.24.38-1.1.mga9
lib(64)gtk+3.0-devel-3.24.38-1.1.mga9
lib(64)gtk-gir3.0-3.24.38-1.1.mga9

from SRPMS:
gtk+2.0-2.24.33-5.1.mga9.src.rpm
gtk+3.0-3.24.38-1.1.mga9.src.rpm

Source RPM: gtk+2.0-2.24.33-5.mga9.src.rpm, glib2.0-2.76.3-1.mga9.src.rpm, gtk+3.0-3.24.38-1.mga9.src.rpm => gtk+2.0-2.24.33-5.mga9.src.rpm, gtk+3.0-3.24.38-1.mga9.src.rpm
Depends on: (none) => 33198

Nicolas Salguero 2024-09-18 15:15:20 CEST

Depends on: 33198 => (none)

Nicolas Salguero 2024-09-18 15:15:44 CEST

Depends on: (none) => 33198

katnatek 2024-09-18 19:02:26 CEST

Keywords: (none) => advisory

Comment 5 katnatek 2024-09-21 01:04:10 CEST 
RH x86_64 

Tested in pack with bug#33198

LC_ALL=C urpmi --auto --auto-update
medium "QA Testing (64-bit)" is up-to-date
medium "Core Release (distrib1)" is up-to-date
medium "Core Updates (distrib3)" is up-to-date
medium "Nonfree Release (distrib11)" is up-to-date
medium "Nonfree Updates (distrib13)" is up-to-date
medium "Tainted Release (distrib21)" is up-to-date
medium "Tainted Updates (distrib23)" is up-to-date
medium "Core 32bit Release (distrib31)" is up-to-date
medium "Core 32bit Updates (distrib32)" is up-to-date
medium "Nonfree 32bit Release (distrib36)" is up-to-date
medium "Nonfree 32bit Updates (distrib37)" is up-to-date
medium "Tainted 32bit Release (distrib41)" is up-to-date
medium "Tainted 32bit Updates (distrib42)" is up-to-date

installing glib-gettextize-2.76.3-1.2.mga9.x86_64.rpm lib64gtk-gir3.0-3.24.38-1.1.mga9.x86_64.rpm gtk+2.0-2.24.33-5.1.mga9.x86_64.rpm gtk+3.0-3.24.38-1.1.mga9.x86_64.rpm glib2.0-common-2.76.3-1.2.mga9.x86_64.rpm lib64gtk-gir2.0-2.24.33-5.1.mga9.x86_64.rpm lib64gio2.0_0-2.76.3-1.2.mga9.x86_64.rpm lib64gtk+-x11-2.0_0-2.24.33-5.1.mga9.x86_64.rpm lib64gtk+2.0_0-2.24.33-5.1.mga9.x86_64.rpm lib64glib2.0_0-2.76.3-1.2.mga9.x86_64.rpm lib64gtk+3_0-3.24.38-1.1.mga9.x86_64.rpm gtk-update-icon-cache-3.24.38-1.1.mga9.x86_64.rpm lib64glib2.0-devel-2.76.3-1.2.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ###################################################################################
     1/13: lib64glib2.0_0        ###################################################################################
     2/13: lib64gio2.0_0         ###################################################################################
     3/13: glib2.0-common        ###################################################################################
     4/13: lib64gtk+2.0_0        ###################################################################################
     5/13: gtk+2.0               ###################################################################################
     6/13: lib64gtk+-x11-2.0_0   ###################################################################################
     7/13: gtk-update-icon-cache ###################################################################################
     8/13: lib64gtk+3_0          ###################################################################################
     9/13: gtk+3.0               ###################################################################################
    10/13: glib-gettextize       ###################################################################################
    11/13: lib64glib2.0-devel    ###################################################################################
    12/13: lib64gtk-gir3.0       ###################################################################################
    13/13: lib64gtk-gir2.0       ###################################################################################
     1/13: removing lib64gtk-gir2.0-2.24.33-5.mga9.x86_64
                                 ###################################################################################
     2/13: removing lib64gtk-gir3.0-3.24.38-1.mga9.x86_64
                                 ###################################################################################
     3/13: removing lib64gtk+-x11-2.0_0-2.24.33-5.mga9.x86_64
                                 ###################################################################################
     4/13: removing lib64glib2.0-devel-2.76.3-1.mga9.x86_64
                                 ###################################################################################
     5/13: removing gtk+3.0-3.24.38-1.mga9.x86_64
                                 ###################################################################################
     6/13: removing lib64gtk+3_0-3.24.38-1.mga9.x86_64
                                 ###################################################################################
     7/13: removing gtk+2.0-2.24.33-5.mga9.x86_64
                                 ###################################################################################
     8/13: removing glib-gettextize-2.76.3-1.mga9.x86_64
                                 ###################################################################################
     9/13: removing lib64gtk+2.0_0-2.24.33-5.mga9.x86_64
                                 ###################################################################################
    10/13: removing glib2.0-common-2.76.3-1.mga9.x86_64
                                 ###################################################################################
    11/13: removing lib64gio2.0_0-2.76.3-1.mga9.x86_64
                                 ###################################################################################
    12/13: removing gtk-update-icon-cache-3.24.38-1.mga9.x86_64
                                 ###################################################################################
    13/13: removing lib64glib2.0_0-2.76.3-1.mga9.x86_64
                                 ###################################################################################

urpmq --whatrequires lib64gtk+3_0|uniq and
urpmq --whatrequires-recursive lib64gtk+2.0_0|uniq

Produce a huge list

strace geany
openat(AT_FDCWD, "/lib64/libgtk-3.so.0", O_RDONLY|O_CLOEXEC) = 3

Handbrake
strace ghb
openat(AT_FDCWD, "/lib64/libgtk-3.so.0", O_RDONLY|O_CLOEXEC) = 3

Both applications start without issues
Users of mate,lxde and gnome should give an eye to this update
Comment 6 katnatek 2024-09-21 01:28:20 CEST 
RH x86_64

strace pidgin
openat(AT_FDCWD, "/lib64/libgtk-x11-2.0.so.0", O_RDONLY|O_CLOEXEC) = 3

The file is part of lib64gtk+-x11-2.0

The application works
Comment 7 katnatek 2024-09-21 21:22:56 CEST 
VM x86_64 lxde

Tested in pack with bug#33198

 LC_ALL=C urpmi --auto --auto-update 
medium "QA Testing (64-bit)" is up-to-date
medium "Core Release" is up-to-date
medium "Core Updates" is up-to-date
medium "Nonfree Release" is up-to-date
medium "Nonfree Updates" is up-to-date


installing gtk-update-icon-cache-3.24.38-1.1.mga9.x86_64.rpm lib64gtk+2.0_0-2.24.33-5.1.mga9.x86_64.rpm lib64gtk+3_0-3.24.38-1.1.mga9.x86_64.rpm lib64gtk+-x11-2.0_0-2.24.33-5.1.mga9.x86_64.rpm lib64glib2.0_0-2.76.3-1.2.mga9.x86_64.rpm lib64gtk-gir3.0-3.24.38-1.1.mga9.x86_64.rpm lib64gio2.0_0-2.76.3-1.2.mga9.x86_64.rpm gtk+2.0-2.24.33-5.1.mga9.x86_64.rpm gtk+3.0-3.24.38-1.1.mga9.x86_64.rpm glib2.0-common-2.76.3-1.2.mga9.x86_64.rpm from //home/qateam/qa-testing/x86_64
Preparing...                     #############################################
     1/10: lib64glib2.0_0        #############################################
     2/10: lib64gio2.0_0         #############################################
     3/10: glib2.0-common        #############################################
     4/10: lib64gtk+-x11-2.0_0   #############################################
     5/10: lib64gtk+2.0_0        #############################################
     6/10: gtk+2.0               #############################################
     7/10: gtk-update-icon-cache #############################################
     8/10: lib64gtk+3_0          #############################################
     9/10: gtk+3.0               #############################################
    10/10: lib64gtk-gir3.0       #############################################
     1/10: removing lib64gtk-gir3.0-3.24.38-1.mga9.x86_64
                                 #############################################
     2/10: removing gtk+2.0-2.24.33-5.mga9.x86_64
                                 #############################################
     3/10: removing lib64gtk+2.0_0-2.24.33-5.mga9.x86_64
                                 #############################################
     4/10: removing lib64gtk+-x11-2.0_0-2.24.33-5.mga9.x86_64
                                 #############################################
     5/10: removing lib64gtk+3_0-3.24.38-1.mga9.x86_64
                                 #############################################
     6/10: removing gtk+3.0-3.24.38-1.mga9.x86_64
                                 #############################################
     7/10: removing glib2.0-common-2.76.3-1.mga9.x86_64
                                 #############################################
     8/10: removing lib64gio2.0_0-2.76.3-1.mga9.x86_64
                                 #############################################
     9/10: removing gtk-update-icon-cache-3.24.38-1.mga9.x86_64
                                 #############################################
    10/10: removing lib64glib2.0_0-2.76.3-1.mga9.x86_64
                                 #############################################
writing /var/lib/rpm/installed-through-deps.list

Reboot

Desktop Starts
lxterminal work
pcmanfm works

Basic functions looks without issues
Comment 8 Morgan Leijström 2024-09-22 21:28:21 CEST 
Tested update of installed packages on all systems i tested kernel Bug 33574 
Most mga-64, Plasma
One mga-32, LXDE
No regression noted.

CC: (none) => fri

Comment 9 Herman Viaene 2024-09-23 13:20:15 CEST 
MGA9-64 server Plasma Wayland on HP-Pavillion
No installation issues.Of all dependents I choose aisleriot and played it under strace and found refs 
openat(AT_FDCWD, "/lib64/libgtk-3.so.0", O_RDONLY|O_CLOEXEC) = 3
To answer demand in Comment 6, I"ll repeat the test under MATE

CC: (none) => herman.viaene

Comment 10 Herman Viaene 2024-09-23 13:31:53 CEST 
No issues under MATE in any aspect OK for me

Whiteboard: (none) => MGA9-64-OK

Comment 11 Thomas Andrews 2024-09-23 13:53:21 CEST 
Thank you, Herman.

This one is basic to Mageia operation, so we should have 32-bit tests as well.

CC: (none) => andrewsfarm

katnatek 2024-09-23 19:42:04 CEST

Blocks: (none) => 33449

Comment 12 katnatek 2024-09-24 04:21:27 CEST 
RH i586

rpm -qa|grep 2.24.33-5.1.mga9
gtk+2.0-2.24.33-5.1.mga9
libgtk+-x11-2.0_0-2.24.33-5.1.mga9
libgtk+2.0_0-2.24.33-5.1.mga9

rpm -qa|grep 3.24.38-1.1.mga9
gtk-update-icon-cache-3.24.38-1.1.mga9
gtk+3.0-3.24.38-1.1.mga9
libgtk+3_0-3.24.38-1.1.mga9
libgtk-gir3.0-3.24.38-1.1.mga9

geany starts and works
Comment 13 Jose Manuel López 2024-09-24 08:31:29 CEST 
Hi.

Installed in Mga x86_64 Plasma without issues.

rpm -qa|grep gtk+2
gtk+2.0-2.24.33-5.1.mga9
lib64gtk+2.0_0-2.24.33-5.1.mga9

rpm -qa|grep gtk+3
lib64gtk+3_0-3.24.38-1.1.mga9
gtk+3.0-3.24.38-1.1.mga9

My desktop is working normally.

CC: (none) => joselp

Comment 14 Thomas Andrews 2024-09-25 16:59:29 CEST 
Thank you, everyone. I even tested this on Foolishness, my Dell Inspiron 5100, 32-bit Xfce, with no issues. 

Validating.

Whiteboard: MGA9-64-OK => MGA9-64-OK MGA9-32-OK
Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 15 Mageia Robot 2024-09-25 20:09:35 CEST 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0312.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED
Note You need to log in before you can comment on or make changes to this bug.