Bug 33711 - mpg123 new security issue CVE-2024-10573
Summary: mpg123 new security issue CVE-2024-10573
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2024-11-04 10:45 CET by Nicolas Salguero
Modified: 2024-11-12 21:27 CET (History)
4 users (show)

See Also:
Source RPM: mpg123-1.31.3-1.mga9.src.rpm
CVE: CVE-2024-10573
Status comment:


Attachments

Description Nicolas Salguero 2024-11-04 10:45:36 CET
That CVE was announced here:
https://www.openwall.com/lists/oss-security/2024/10/30/2
https://www.openwall.com/lists/oss-security/2024/10/30/3
https://www.openwall.com/lists/oss-security/2024/10/31/4
https://www.openwall.com/lists/oss-security/2024/11/01/2

To get the patch:
"""
svn co svn://scm.orgis.org/mpg123/branches/1.31-fixes
cd 1.31-fixes/
svn diff -r5270:5444
"""
Nicolas Salguero 2024-11-04 10:46:04 CET

CVE: (none) => CVE-2024-10573
Source RPM: (none) => mpg123-1.31.3-1.mga9.src.rpm
Status comment: (none) => Patches available from upstream

Comment 1 Lewis Smith 2024-11-04 20:39:34 CET
Thanks for the patch ref - saves a lot of hunting.
Cauldron is very up-to date, this is just M9.

Assigning yet again to DavidG, who routinely updates this SRPM.

Assignee: bugsquad => geiger.david68210

Comment 2 Nicolas Salguero 2024-11-07 12:03:19 CET
Suggested advisory:
========================

The updated packages fix a security vulnerability:

An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector. (CVE-2024-10573)

References:
https://www.openwall.com/lists/oss-security/2024/10/30/2
https://www.openwall.com/lists/oss-security/2024/10/30/3
https://www.openwall.com/lists/oss-security/2024/10/31/4
https://www.openwall.com/lists/oss-security/2024/11/01/2
========================

Updated packages in core/updates_testing:
========================
lib(64)mpg123_0-1.31.3-1.1.mga9
lib(64)mpg123-devel-1.31.3-1.1.mga9
mpg123-1.31.3-1.1.mga9
mpg123-jack-1.31.3-1.1.mga9
mpg123-openal-1.31.3-1.1.mga9
mpg123-portaudio-1.31.3-1.1.mga9
mpg123-pulse-1.31.3-1.1.mga9
mpg123-sdl-1.31.3-1.1.mga9
mpg123-sndio-1.31.3-1.1.mga9

from SRPM:
mpg123-1.31.3-1.1.mga9.src.rpm

Status comment: Patches available from upstream => (none)
Assignee: geiger.david68210 => qa-bugs
Status: NEW => ASSIGNED

katnatek 2024-11-07 18:47:47 CET

Keywords: (none) => advisory

Comment 3 katnatek 2024-11-08 23:23:20 CET
RH x86_64

rpm -qa|grep mpg123
mpg123-1.31.3-1.1.mga9
lib64mpg123_0-1.31.3-1.1.mga9
mpg123-pulse-1.31.3-1.1.mga9
mpg123-sdl-1.31.3-1.1.mga9
mpg123-jack-1.31.3-1.1.mga9
mpg123-openal-1.31.3-1.1.mga9
mpg123-portaudio-1.31.3-1.1.mga9
mpg123-sndio-1.31.3-1.1.mga9
libmpg123_0-1.31.3-1.1.mga9

mpg123 --list-modules

Available modules
-----------------
sndio          output  Output audio using sndio library
jack           output  Output audio using JACK (JACK Audio Connection Kit).
portaudio      output  Output audio using PortAudio
oss            output  Output audio using OSS
alsa           output  Output audio using Advanced Linux Sound Architecture (ALSA).
pulse          output  Output audio using PulseAudio Server
dummy          output  Dummy audio output - does not output audio.
sdl            output  Output audio using SDL (Simple DirectMedia Layer).
openal         output  Output audio using OpenAL.
raw            output  raw headerless stream (builtin)
cdr            output  compact disc digital audio stream (builtin)
wav            output  RIFF WAVE file (builtin)
au             output  Sun AU file (builtin)
test           output  output into the void (builtin)
hex            output  interleaved hex printout (builtin)
txt            output  plain text printout, a column per channel (builtin)

Play mp3 file looks good
Comment 4 Len Lawrence 2024-11-09 19:04:33 CET
mga9, x64

Already under way, so may as well continue.
Several of the release packages were missing so installed them before updating.
Clean update after that.
$ mpg123 KillerQueen.mp3
Played track OK.  'h' key showed list of interactive commands such as 'A' for more bass and '+' to increase volume.  That worked.

$ mpg123 -w downonthecorner.wav DownOnTheCorner.mp3
Playing MPEG stream 1 of 1: DownOnTheCorner.mp3 ...
MPEG 1.0 L III cbr128 44100 stereo
Title:   Down On The Corner
Artist:  Creedence Clearwater Revival
Comment: Created by Grip         Album:  Really The Best        
Year:    1994                    Genre:  Rock                   
[2:43] Decoding of DownOnTheCorner.mp3 finished.

The resulting WAV file could be played OK.
$ play downonthecorner.wav

Found this command in an old report:
$ mpg123 -o sdl BadMoonRising.mp3
This plays fine using the "SDL audio device"

Played random tracks from current directory:
$ mpg123 -Z *
[...]
Title:   Up Around The Bend
<typed l for list>
Playlist (">" indicates current track):
  BadMoonRising.mp3
  DownOnTheCorner.mp3
  downonthecorner.wav
  GreenRiver.mp3
  HeyTonight.mp3
  IHeardItOnTheGrapevine.mp3
  ProudMary.mp3
  reallythebest
  SuzyQ.mp3
  TravelinBand.mp3
> UpAroundTheBend.mp3
[...] <typed 'l'>
  BadMoonRising.mp3
  DownOnTheCorner.mp3
  downonthecorner.wav
  GreenRiver.mp3
  HeyTonight.mp3
> IHeardItOnTheGrapevine.mp3
  ProudMary.mp3
  reallythebest
  SuzyQ.mp3
  TravelinBand.mp3
  UpAroundTheBend.mp3
<typed 'f'>
<typed 'l'>
  BadMoonRising.mp3
  DownOnTheCorner.mp3
  downonthecorner.wav
  GreenRiver.mp3
  HeyTonight.mp3
  IHeardItOnTheGrapevine.mp3
  ProudMary.mp3
  reallythebest
  SuzyQ.mp3
> TravelinBand.mp3
  UpAroundTheBend.mp3

CtrlC to exit.
Enough testing.

CC: (none) => tarazed25

katnatek 2024-11-09 19:29:25 CET

CC: (none) => andrewsfarm
Whiteboard: (none) => MGA9-64-OK

Comment 5 Thomas Andrews 2024-11-09 21:19:03 CET
Validating.

CC: (none) => sysadmin-bugs
Keywords: (none) => validated_update

Comment 6 Dan Fandrich 2024-11-12 07:13:54 CET
This package was pushed today but for some reason this bug wasn't automatically closed.

CC: (none) => dan
Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED

Comment 7 Mageia Robot 2024-11-12 21:27:10 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0358.html

Note You need to log in before you can comment on or make changes to this bug.