stack smashing attack detected in bash host tab completion

Possibly a duplicate of bug LP: #1926355 https://bugs.launchpad.net/bugs/1926355

I couldn't install the debug symbols:

 bash-dbgsym : Depends: bash (= 5.0-6ubuntu1) but 5.0-6ubuntu1.1 is to be installed

And I had to add a Package: bash line to my crash file..

Here's the frames that look most likely related:

#13 0x00007f29177a85fa in _dl_find_dso_for_object () from /lib64/ld-linux-x86-64.so.2
No symbol table info available.
#14 0x000055f19a675880 in ?? ()
No symbol table info available.
#15 0x00007ffd864d6140 in ?? ()
No symbol table info available.
#16 0x00007f2980000002 in ?? ()
No symbol table info available.
#17 0x00007f291769c62c in nss_load_library (ni=0x0) at nsswitch.c:359
        shlen = <error reading variable shlen (Cannot access memory at address 0xffffffb7)>
        saved_errno = 1
        shlib_name = <error reading variable shlib_name (Cannot access memory at address 0xffffffb7)>
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Thank you for the bug report.

The update has been reverted, please downgrade glibc binary packges to 2.31-0ubuntu9.2 until the new update becomes available.

The problem seems to be caused by the fix for LP: #1914044.

Status changed to 'Confirmed' because the bug affects multiple users.

We're also seeing this with rsyncd:

| Apr 28 09:35:04 behaim rsync[2152929]: *** stack smashing detected ***: terminated

From apt history logs:

| Upgrade: libldap-2.4-2:amd64 (2.4.49+dfsg-2ubuntu1.7, 2.4.49+dfsg-2ubuntu1.8), libc6-dev:amd64 (2.31-0ubuntu9.2, 2.31-0ubuntu9.3), grub-common:amd64 (2.04-1ubuntu26.9, 2.04-1ubuntu26.11), python3-pip:amd64 (20.0.2-5ubuntu1.1, 20.0.2-5ubuntu1.3), libc6:amd64 (2.31-0ubuntu9.2,
2.31-0ubuntu9.3)...

There is a WIP branch to prevent upgrades from 2.31-0ubuntu9.3 and cause crashes again on that path: https://code.launchpad.net/~rbalint/ubuntu/+source/glibc/+git/glibc/+ref/ubuntu/focal

So I don't know exactly what was going on with sarnold's machine but I now finally understand why the 0ubuntu9.3 update caused problems:

The tls accounting patch added a glibc tunable (https://www.gnu.org/software/libc/manual/html_node/Tunables.html). A tunable is defined internally as a name and a type (and some other data) but during the build it also gets assigned an ID and unfortunately the tunable added by the tls accounting patch ends changing the ID of the glibc.pthread.mutex_spin_count tunable. The problems occur when you have a new dynamic linker / ld.so but an old libpthread.so: libpthread.so's _init function calls get_tunable with the ID for glibc.pthread.mutex_spin_count, but get_tunable is implemented in ld.so, where this ID corresponds to the new glibc.rtld.nns tunable. The type for glibc.pthread.mutex_spin_count is int32 and the type for glibc.rtld.nns is size_t, so when get_tunable writes the value into the pointer it is passed, it does indeed smash the stack. Even if this doesn't happen, libpthread might well misbehave in all sorts of ways if gets back values appropriate for glibc.rtld.nns when it's expecting values for glibc.pthread.mutex_spin_count.

So this explains the behaviour seen in bug 1926355, completely. What I don't understand wrt this bug is that "new ld.so / old libpthread.so" should be a very temporary situation during an upgrade. I guess a process that has the old ld.so loaded might dlopen the new libpthread.so and experience a similar issue, although dlopening libpthread isn't really a think that works aiui. But it could be a similar problem with some other library.

Unfortunately, this means that upgrades from 0ubuntu9.3 to 0ubuntu9.4 are vulnerable to the same issue.

Hello Seth, or anyone else affected,

Accepted glibc into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/glibc/2.31-0ubuntu9.4 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

What kinds of tests are we hoping for, here? From people who never backed out the broken glibc manually? (This might be a difficult group to reach.)

Or from just anyone, to try to find out if the revert and new fixes were done correctly?

Thanks

I'm more interested in people updating from the version currently in updates to the version currently in proposed.

All autopkgtests for the newly accepted glibc (2.31-0ubuntu9.4) for focal have finished running.
The following regressions have been reported in tests triggered by the package:

snapd-glib/1.58-0ubuntu0.20.04.0 (armhf)
apt/2.0.6 (armhf)
libmath-mpfr-perl/4.13-1 (armhf)
art-nextgen-simulation-tools/20160605+dfsg-4 (armhf)
ruby-nokogiri/1.10.7+dfsg1-2build1 (armhf)
r-cran-rgdal/1.4-8-1build2 (armhf)
arrayfire/3.3.2+dfsg1-4ubuntu4 (armhf)
libpango-perl/1.227-3build1 (armhf)
libimage-sane-perl/5-1 (s390x)
ruby-bootsnap/1.4.6-1 (arm64)
mle/1.4.3-1 (ppc64el, arm64)
libsyntax-keyword-try-perl/0.11-1build1 (armhf)
awesome/4.3-4 (armhf)
cysignals/1.10.2+ds-4 (arm64)
gvfs/1.44.1-1ubuntu1 (ppc64el)
libuv1/1.34.2-1ubuntu1.3 (amd64)
bali-phy/3.4.1+dfsg-2build1 (arm64, s390x)
g10k/0.5.7-1 (armhf)
litl/0.1.9-7 (amd64)
ruby-libxml/3.1.0-2 (armhf)
ffmpeg/7:4.2.4-1ubuntu0.1 (armhf)
yorick/2.2.04+dfsg1-10 (ppc64el, s390x)
linux-ibm/5.4.0-1010.11 (amd64)
liborcus/0.15.3-3build2 (armhf)
node-nodedbi/1.0.13+dfsg-1build1 (amd64)
r-bioc-delayedarray/0.12.2+dfsg-1 (armhf)
postgresql-unit/7.2-2 (armhf)
python-freecontact/1.1-5build2 (armhf)
r-cran-rwave/2.4-8-2 (armhf)
libproc-fastspawn-perl/1.2-1build2 (armhf)
linux-hwe-5.11/5.11.0-44.48~20.04.2 (armhf)
foo2zjs/20171202dfsg0-4 (armhf)
r-cran-erm/1.0-0-1 (armhf)
libsys-cpuload-perl/0.03-8build5 (armhf)
libhttp-parser-xs-perl/0.17-1build5 (armhf)
php-luasandbox/3.0.3-2build2 (armhf)
pynfft/1.3.2-3build1 (armhf)
r-cran-processx/3.4.2-1 (ppc64el)
r-bioc-multtest/2.42.0-1 (armhf)
linux-hwe-5.13/5.13.0-23.23~20.04.2 (armhf)
python-blosc/1.7.0+ds1-2ubuntu2 (armhf)
gyoto/1.4.4-3 (armhf)
r-cran-sem/3.1.9-2build1 (armhf)
libtext-reflow-perl/1.17-1build3 (armhf)
python3.9/3.9.5-3ubuntu0~20.04.1 (armhf)
r-cran-samr/3.0-1 (armhf)
r-cran-dplyr/0.8.4-1 (armhf)
python3.8/3.8.10-0ubuntu1~20.04.2 (armhf)
findent/3.1.1-1build1 (armhf)
mercurial/5.3.1-1ubuntu1 (amd64)
libmemcached-libmemcached-perl/1.001801+dfsg-2build4 (armhf)
openbabel/3.0.0+dfsg-3ubuntu3 (armhf)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/focal/update_excuses.html#glibc

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

I tested an upgrade from 0ubuntu9.2 to 0ubuntu9.4 in a vm and could not reproduce this problem.

Hello Seth, or anyone else affected,

Accepted glibc into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/glibc/2.31-0ubuntu9.5 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

All autopkgtests for the newly accepted glibc (2.31-0ubuntu9.5) for focal have finished running.
The following regressions have been reported in tests triggered by the package:

garli/2.1-3build1 (armhf)
fpc/3.0.4+dfsg-23 (armhf)
lazarus/2.0.6+dfsg-3 (armhf)
libuv1/1.34.2-1ubuntu1.3 (i386)
ikiwiki-hosting/0.20180719-2 (armhf)
rtags/2.37-1 (amd64)
mercurial/5.3.1-1ubuntu1 (amd64, ppc64el)
foo2zjs/20171202dfsg0-4 (armhf)
frameworkintegration/5.68.0-0ubuntu1 (armhf)
hilive/2.0a-3build2 (arm64)
ruby-libxml/3.1.0-2 (s390x)
plasma-framework/5.68.0-0ubuntu1 (armhf)
feersum/1.407-2 (s390x)
r-bioc-delayedarray/0.12.2+dfsg-1 (armhf)
php-luasandbox/3.0.3-2build2 (ppc64el)
snapd-glib/1.58-0ubuntu0.20.04.0 (armhf)
bolt/0.8-4ubuntu1 (ppc64el)
threadweaver/5.68.0-0ubuntu1 (armhf)
python3.8/3.8.10-0ubuntu1~20.04.2 (amd64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/focal/update_excuses.html#glibc

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!