Bug 596864 – <dev-scheme/guile-1.8.8-r3: Thread-unsafe umask modification

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2016-10-11 14:03:14 UTC]

From ${URL} :


The ‘mkdir’ procedure of GNU Guile, an implementation of the Scheme
programming language, temporarily changed the process’ umask to zero.
During that time window, in a multithreaded application, other threads
could end up creating files with insecure permissions.  For example,
‘mkdir’ without the optional ‘mode’ argument would create directories
as 0777.

This can be worked around by always passing the optional ‘mode’ argument
to Guile’s ‘mkdir’ procedure.

This will be fixed in Guile 2.0.13, to be released shortly.

Upstream bug report: http://bugs.gnu.org/24659
Patch: http://git.savannah.gnu.org/cgit/guile.git/commit/?h=stable-2.0&id=245608911698adb3472803856019bdd5670b6614




@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Kristian Fiskerstrand (RETIRED) 2016-10-11 15:59:20 UTC]

@maintainers: also needs separate verification on whether it affects the current stable branch (1.8.x), if not rating should be changed to ~3

[Comment 2 Kristian Fiskerstrand (RETIRED) 2016-10-11 20:22:10 UTC]

This likely also affects 1.8 branch

[Comment 3 Amy Liffey 2016-11-06 19:19:33 UTC]

committer	Amy Winston <[e-mail]>	2016-11-05 12:55:59 (GMT)
commit	f4acb8b7ed70914fc98bbb7532b44b7087b85048

dev-scheme/guile: version bump 2.0.13
Bugs: 597216,596864,596876

committer	Amy Winston <[e-mail]>	2016-11-06 19:13:23 (GMT)
commit	857729aac64d4c4a007fefdb66d2d461adac7110 

dev-scheme/guile: remove old 2.0.12


For the stable 1.8.8 version revbumped to r3:

committer	Amy Winston <[e-mail]>	2016-11-06 19:13:23 (GMT)
commit	5fda0962579cd0d6ec0e7ebf22bec1b4685be0bd

dev-scheme/guile: add unmask patch bug #596864

Version guile-1.8.8-r3 should be ready for stabilisation.
Desired arches: alpha amd64 arm arm64 hppa ia64 m68k ppc ppc64 s390 sh sparc x86

[Comment 4 Aaron Bauman (RETIRED) 2016-11-07 09:29:31 UTC]

(In reply to Amy Winston from comment #3)
> committer	Amy Winston <[e-mail]>	2016-11-05 12:55:59 (GMT)
> commit	f4acb8b7ed70914fc98bbb7532b44b7087b85048
> 
> dev-scheme/guile: version bump 2.0.13
> Bugs: 597216,596864,596876
> 
> committer	Amy Winston <[e-mail]>	2016-11-06 19:13:23 (GMT)
> commit	857729aac64d4c4a007fefdb66d2d461adac7110 
> 
> dev-scheme/guile: remove old 2.0.12
> 
> 
> For the stable 1.8.8 version revbumped to r3:
> 
> committer	Amy Winston <[e-mail]>	2016-11-06 19:13:23 (GMT)
> commit	5fda0962579cd0d6ec0e7ebf22bec1b4685be0bd
> 
> dev-scheme/guile: add unmask patch bug #596864
> 
> Version guile-1.8.8-r3 should be ready for stabilisation.
> Desired arches: alpha amd64 arm arm64 hppa ia64 m68k ppc ppc64 s390 sh sparc
> x86

Stable arches CC'ed per security project guidelines.  If you require the additional unstable arches to stabilize the package then please open a non-security bug requesting it.

GLSA Vote: No

[Comment 5 Agostino Sarubbo 2016-11-07 15:37:51 UTC]

amd64 stable

[Comment 6 Tobias Klausmann (RETIRED) 2016-11-14 17:20:34 UTC]

Stable on alpha.

[Comment 7 Jeroen Roovers (RETIRED) 2016-11-17 08:11:14 UTC]

Stable for HPPA PPC64.

[Comment 8 Agostino Sarubbo 2016-11-20 13:46:42 UTC]

x86 stable

[Comment 9 Markus Meier 2016-11-29 17:40:25 UTC]

arm stable

[Comment 10 Agostino Sarubbo 2016-12-19 14:38:07 UTC]

sparc stable

[Comment 11 Agostino Sarubbo 2016-12-19 15:14:58 UTC]

ia64 stable

[Comment 12 Agostino Sarubbo 2016-12-20 09:47:53 UTC]

ppc stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 13 Amy Liffey 2016-12-20 10:42:32 UTC]

commit c8a92cf2629cb44be78fcaea749d662795164b8e
Author: Amy Winston <[e-mail]>
Date:   Tue Dec 20 11:08:46 2016 +0100

    dev-scheme/guile: clean up sec bug #596864

[Comment 14 Mikle Kolyada (RETIRED) 2016-12-25 20:54:31 UTC]

GLSA vote: no.