Bug 765661 (CVE-2021-3567) – <app-accessibility/caribou-0.4.21-r2: Screensaver lock bypass

• Product: Gentoo Security
• Status: RESOLVED INVALID

[Description John Helmert III 2021-01-16 18:05:36 UTC]

From URL:

A few weeks ago, my kids wanted to hack my linux desktop, so they typed and clicked everywhere, while I was standing behind them looking at them play... when the screensaver core dumped and they actually hacked their way in! wow, those little hackers...

I thought it was a unique incident, but they managed to do it a second time. So I'd consider this issue... reproducible... by kids


Maintainer: Please confirm if we are affected and if so please produce a fixed version, there appears to be patches at URL.

[Comment 1 Larry the Git Cow 2021-01-23 04:00:40 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2c7cf52b42ecfc82e17986f1c026a54be3c900f6

commit 2c7cf52b42ecfc82e17986f1c026a54be3c900f6
Author:     Matthew S. Turnbull <[e-mail]>
AuthorDate: 2021-01-16 20:52:07 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2021-01-23 03:44:44 +0000

    app-accessibility/caribou: Fix crash due to xserver CVE fix
    
    xorg-server 1.20.10 contains a fix for CVE-2020-25712.
    
    This causes a previous work-around in caribou to result in
    a BadLength error, when interacting with XKB, and crashes
    the hosting application.
    
    Fixes provided by Cinnamon upstream from Fedora RPM:
    https://src.fedoraproject.org/rpms/caribou/tree/master
    
    This also includes an upstreamed antler fix and bumps
    PYTHON_COMPAT for 3.9 support.
    
    Bug: https://bugs.gentoo.org/765661
    Package-Manager: Portage-3.0.12, Repoman-3.0.2
    Signed-off-by: Matthew S. Turnbull <[e-mail]>
    Closes: https://github.com/gentoo/gentoo/pull/19082
    Signed-off-by: Sam James <[e-mail]>

 app-accessibility/caribou/caribou-0.4.21-r2.ebuild | 103 +++++++++++++++++++++
 .../files/caribou-fix-antler-style-css.patch       |  26 ++++++
 .../files/caribou-fix-compilation-error.patch      |  25 +++++
 .../caribou/files/caribou-fix-subkey-popmenu.patch |  32 +++++++
 .../files/caribou-fix-xadapter-xkb-calls.patch     |  46 +++++++++
 5 files changed, 232 insertions(+)

[Comment 2 Sam James 2021-01-23 04:06:51 UTC]

We'll give it a little bit of time (until later today) then kick it off for stabling?

[addCollapseLink(3, 1, 'Toggle comment display'); Comment 3 NATTkA bot 2021-01-23 04:08:52 UTC Comment hidden (obsolete)]

Unable to check for sanity:

> no match for package: gnome-extra/cinnamon-screensaver-0.4.21-r2

[Comment 4 Sam James 2021-01-24 21:54:27 UTC]

Let's go!

[Comment 5 Sam James 2021-01-25 14:03:37 UTC]

amd64 done

[Comment 6 Sam James 2021-02-01 04:42:49 UTC]

x86 done

all arches done

[Comment 7 John Helmert III 2021-02-01 04:52:38 UTC]

Please cleanup, thanks!

[Comment 8 Larry the Git Cow 2021-02-02 13:08:35 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=be71a794e927aa8dc8acf3cb4c163f883b0e504b

commit be71a794e927aa8dc8acf3cb4c163f883b0e504b
Author:     Matthew S. Turnbull <[e-mail]>
AuthorDate: 2021-02-01 16:02:54 +0000
Commit:     Joonas Niilola <[e-mail]>
CommitDate: 2021-02-02 13:07:12 +0000

    app-accessibility/caribou: Remove unpatched ebuild
    
    Bug: https://bugs.gentoo.org/765661
    Package-Manager: Portage-3.0.13, Repoman-3.0.2
    Signed-off-by: Matthew S. Turnbull <[e-mail]>
    Closes: https://github.com/gentoo/gentoo/pull/19287
    Signed-off-by: Joonas Niilola <[e-mail]>

 app-accessibility/caribou/caribou-0.4.21-r1.ebuild | 95 ----------------------
 1 file changed, 95 deletions(-)

[Comment 9 Thomas Deutschmann (RETIRED) 2021-05-31 21:36:27 UTC]

This regression is not a security bug, therefore closing as invalid.

[Comment 10 Sam James 2021-05-31 21:40:46 UTC]

(In reply to Thomas Deutschmann from comment #9)
> This regression is not a security bug, therefore closing as invalid.

Can you explain your reasoning please? It seems like this affects cinnamon-screensaver because it uses the accessibility tech from caribou?