Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 904247 (CVE-2023-29491) - <sys-libs/ncurses-6.4_p20230408, <sys-libs/ncurses-compat-6.4_p20240330: Multiple vulnerabilities
Summary: <sys-libs/ncurses-6.4_p20230408, <sys-libs/ncurses-compat-6.4_p20240330: Mult...
Status: IN_PROGRESS
Alias: CVE-2023-29491
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://www.microsoft.com/en-us/secur...
Whiteboard: A3 [glsa cleanup]
Keywords:
Depends on: 904263 904277 904388 930803 930804
Blocks:
  Show dependency tree
 
Reported: 2023-04-13 01:11 UTC by Sam James
Modified: 2024-07-12 09:03 UTC (History)
7 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
ncurses-6.4_p20230918 without gentoo patches (ncurses-6.4_p20230918.ebuild,13.62 KB, text/plain)
2023-09-26 21:26 UTC, Martin Filo
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-04-13 01:11:15 UTC
From https://www.openwall.com/lists/oss-security/2023/04/12/5:
"""
Our team has worked with the maintainer of the ncurses library (used by several software packages in Linux) to fix several memory corruption vulnerabilities.
They are now fixed at commit 20230408 - see details here (https://invisible-island.net/ncurses/NEWS.html#index-t20230408 [1])
A CVE was assigned (CVE-2023-29491) - it's still under a "reserved" status.
"""
Comment 1 Larry the Git Cow gentoo-dev 2023-04-13 01:49:00 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c46795fb6af168a089d6ba651a41d3aadedcbcd4

commit c46795fb6af168a089d6ba651a41d3aadedcbcd4
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2023-04-13 01:34:10 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-04-13 01:48:34 +0000

    sys-libs/ncurses: add 6.4_p20230408
    
    Bug: https://bugs.gentoo.org/904247
    Signed-off-by: Sam James <sam@gentoo.org>

 sys-libs/ncurses/Manifest                     |  21 ++
 sys-libs/ncurses/ncurses-6.4_p20230408.ebuild | 430 ++++++++++++++++++++++++++
 2 files changed, 451 insertions(+)
Comment 2 Holger Hoffstätte 2023-04-13 07:14:29 UTC
I just tried 6.4_p20230408 and it breaks OpenRC output: everything is printed in color and as (null).
Comment 3 Holger Hoffstätte 2023-04-13 07:55:48 UTC
(In reply to Holger Hoffstätte from comment #2)
> I just tried 6.4_p20230408 and it breaks OpenRC output: everything is
> printed in color and as (null).

This does not happen with 6.4_p20230401 - everything looks OK.
Comment 4 Daniel Pouzzner 2023-04-13 16:52:57 UTC
Seeing same here -- rc-status output is correct with sys-libs/ncurses-6.4_p20230401, and wrecked with sys-libs/ncurses-6.4_p20230408:

mega / # rc-status
Runlevel: (null)default(null)
 dictd
(null)                                                                                         (null)[(null)  started  (null)](null)
 dbus
[...]

(crazy colors omitted of necessity:-)
Comment 5 Larry the Git Cow gentoo-dev 2023-04-13 16:56:50 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4f216f091714951425b866d71dcb4fd1557d4ab2

commit 4f216f091714951425b866d71dcb4fd1557d4ab2
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2023-04-13 16:56:00 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-04-13 16:56:00 +0000

    profiles: mask =sys-libs/ncurses-6.4_p20230408
    
    Bug: https://bugs.gentoo.org/904247
    Bug: https://bugs.gentoo.org/904263
    Signed-off-by: Sam James <sam@gentoo.org>

 profiles/package.mask | 6 ++++++
 1 file changed, 6 insertions(+)
Comment 6 Larry the Git Cow gentoo-dev 2023-04-16 03:30:10 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=36cb6e7e797ce084f8952716da8816e3613bedd0

commit 36cb6e7e797ce084f8952716da8816e3613bedd0
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2023-04-16 03:26:39 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-04-16 03:28:54 +0000

    sys-libs/ncurses: add 6.4_p20230415
    
    This should fix the issues with vim (bug #904263) but this version remains
    masked for now because OpenRC itself needs fixing due to abuse of ncurses
    (bug #904277).
    
    Bug: https://bugs.gentoo.org/904247
    Bug: https://bugs.gentoo.org/904277
    Closes: https://bugs.gentoo.org/904263
    Signed-off-by: Sam James <sam@gentoo.org>

 profiles/package.mask                         |   5 +
 sys-libs/ncurses/Manifest                     |   3 +
 sys-libs/ncurses/ncurses-6.4_p20230415.ebuild | 431 ++++++++++++++++++++++++++
 3 files changed, 439 insertions(+)
Comment 7 Martin Filo 2023-09-26 21:26:06 UTC
Created attachment 871520 [details]
ncurses-6.4_p20230918 without gentoo patches

I tried newest ncurses-6.4_p20230918 without gentoo patches and I didn't found any issue.
Comment 8 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-09-26 21:27:45 UTC
(In reply to Martin Filo from comment #7)
> Created attachment 871520 [details]
> ncurses-6.4_p20230918 without gentoo patches
> 
> I tried newest ncurses-6.4_p20230918 without gentoo patches and I didn't
> found any issue.

I'm not sure why you've posted this here. There's a fixed version in tree already, but it's masked because OpenRC isn't yet compatible with it.

The incompatibility is not to do with any Gentoo patches and there's some work going on in bug 904277 for it.

If you want a general version bump, please file a new bug for that.
Comment 9 Larry the Git Cow gentoo-dev 2024-04-06 08:25:30 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dc92b4a3a8aafac2120438d89ea4e85d77006c97

commit dc92b4a3a8aafac2120438d89ea4e85d77006c97
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2024-04-06 08:24:36 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2024-04-06 08:24:36 +0000

    profiles: (finally) unmask ncurses
    
    OpenRC is now fixed.
    
    Bug: https://bugs.gentoo.org/904247
    Bug: https://bugs.gentoo.org/904263
    Signed-off-by: Sam James <sam@gentoo.org>

 profiles/package.mask | 11 -----------
 1 file changed, 11 deletions(-)
Comment 10 Larry the Git Cow gentoo-dev 2024-04-06 09:20:25 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f50dd58c32a3b97ce0a017ceb2a3077a36ecbe5a

commit f50dd58c32a3b97ce0a017ceb2a3077a36ecbe5a
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2024-04-06 09:19:16 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2024-04-06 09:20:07 +0000

    sys-libs/ncurses-compat: add 6.4_p20240330
    
    Bug: https://bugs.gentoo.org/904247
    Bug: https://bugs.gentoo.org/922817
    Signed-off-by: Sam James <sam@gentoo.org>

 sys-libs/ncurses-compat/Manifest                   | 117 +++++++
 .../ncurses-compat-6.4_p20240330.ebuild            | 382 +++++++++++++++++++++
 2 files changed, 499 insertions(+)