CVE-2017-1000364 fix cause Scilab crash with "Segmentation fault (core dumped)"

Bug #1699892 reported by Norbert
8
This bug affects 2 people
Affects Status Importance Assigned to Milestone
linux (Debian)
New
Unknown
linux (Ubuntu)
Confirmed
Undecided
Unassigned
scilab (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

Steps to introduce:
1. Install Ubuntu 14.04 LTS or Ubuntu 16.04 LTS.
2. Install Scilab 5.5.0 or 5.5.2 (sudo apt-get install scilab).
3. Install all system upgrades (sudo apt-get update; sudo apt-get upgrade)
4. Get new kernel with new updates
  linux-image-3.13.0-121-generic (in Trusty) /
  linux-image-4.4.0-81-generic (in Xenial).
5a. Try to start Scilab from GUI - it crashes.
5b. Try to start Scilab from terminal - it reports "Segmentation fault (core dumped)".

Expected results:
* Scilab is working normally with new kernel.

Actual results:
* Scilab is crashing with new kernel (linux-image-3.13.0-121-generic in Trusty / linux-image-4.4.0-81-generic in Xenial), but works with previous one (linux-image-3.13.0-119-generic in Trusty / linux-image-4.4.0-78-generic in Xenial).

Notes:
* First discovered and documented by ubuntu-fr (see https://forum.ubuntu-fr.org/viewtopic.php?id=2011162) and then Philippe Roux on Scilab MailingLists (http://mailinglists.scilab.org/Scilab-users-scilab-gt-Segmentation-fault-td4036624.html).
* The problem exists on both 32-bit and 64-bit architectures.
* Temporary solution is to use previous kernel.
* The problem may be related to these: new "linux-image-4.4.0-81-generic Regression: Oracle Java plugin crashes" (bug 1699772) or old "scilab libraries are heavily underlinked, causing segfaults on load" (bug 1299686).
* SegvReason is "writing unknown VMA".
* May be related to CVE-2017-1000364 (see bug 1698919).

ProblemType: Bug
DistroRelease: Ubuntu 16.04
Package: scilab 5.5.2-2ubuntu3
ProcVersionSignature: Ubuntu 4.4.0-81.104-generic 4.4.67
Uname: Linux 4.4.0-81-generic i686
NonfreeKernelModules: wl
ApportVersion: 2.20.1-0ubuntu2.6
Architecture: i386
CurrentDesktop: MATE
Date: Thu Jun 22 23:27:11 2017
InstallationDate: Installed on 2016-04-21 (427 days ago)
InstallationMedia: Ubuntu 16.04 LTS "Xenial Xerus" - Release i386 (20160420.1)
PackageArchitecture: all
SourcePackage: scilab
UpgradeStatus: No upgrade log present (probably fresh install)
---
ApportVersion: 2.20.1-0ubuntu2.6
Architecture: i386
AudioDevicesInUse:
 USER PID ACCESS COMMAND
 /dev/snd/controlC0: nikolay 1885 F.... pulseaudio
CurrentDesktop: MATE
DistroRelease: Ubuntu 16.04
InstallationDate: Installed on 2016-04-21 (427 days ago)
InstallationMedia: Ubuntu 16.04 LTS "Xenial Xerus" - Release i386 (20160420.1)
MachineType: ASUSTeK COMPUTER INC. UX32A
NonfreeKernelModules: wl
Package: scilab 5.5.2-2ubuntu3
PackageArchitecture: all
ProcFB: 0 inteldrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-4.4.0-81-generic root=UUID=ab9c3c8a-b6dc-40f9-b9a7-eea4950cf89e ro quiet splash vt.handoff=7
ProcVersionSignature: Ubuntu 4.4.0-81.104-generic 4.4.67
RelatedPackageVersions:
 linux-restricted-modules-4.4.0-81-generic N/A
 linux-backports-modules-4.4.0-81-generic N/A
 linux-firmware 1.157.11
Tags: xenial xenial
Uname: Linux 4.4.0-81-generic i686
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dialout dip lpadmin plugdev sambashare sudo uucp
_MarkForUpload: True
dmi.bios.date: 02/12/2014
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: UX32A.216
dmi.board.asset.tag: ATN12345678901234567
dmi.board.name: UX32A
dmi.board.vendor: ASUSTeK COMPUTER INC.
dmi.board.version: 1.0
dmi.chassis.asset.tag: No Asset Tag
dmi.chassis.type: 10
dmi.chassis.vendor: ASUSTeK COMPUTER INC.
dmi.chassis.version: 1.0
dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvrUX32A.216:bd02/12/2014:svnASUSTeKCOMPUTERINC.:pnUX32A:pvr1.0:rvnASUSTeKCOMPUTERINC.:rnUX32A:rvr1.0:cvnASUSTeKCOMPUTERINC.:ct10:cvr1.0:
dmi.product.name: UX32A
dmi.product.version: 1.0
dmi.sys.vendor: ASUSTeK COMPUTER INC.
---
ApportVersion: 2.14.1-0ubuntu3.24
Architecture: i386
AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1:
CRDA: Error: command ['iw', 'reg', 'get'] failed with exit code 1: nl80211 not found.
CurrentDesktop: MATE
DistroRelease: Ubuntu 14.04
HibernationDevice: RESUME=UUID=347e9507-87b1-431d-b36f-538d190a517f
InstallationDate: Installed on 2014-04-18 (1162 days ago)
InstallationMedia: Ubuntu 14.04 LTS "Trusty Tahr" - Release i386 (20140417)
IwConfig:
 lo no wireless extensions.

 eth0 no wireless extensions.

 eth1 no wireless extensions.
Lsusb:
 Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
 Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
MachineType: innotek GmbH VirtualBox
Package: scilab 5.5.0-2
PackageArchitecture: all
ProcFB: 0 VESA VGA
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.13.0-119-generic root=UUID=6fb393d4-832a-4ae9-9cb1-9b0bd5908a1f ro quiet splash vt.handoff=7
ProcVersionSignature: Ubuntu 3.13.0-119.166-generic 3.13.11-ckt39
RelatedPackageVersions:
 linux-restricted-modules-3.13.0-119-generic N/A
 linux-backports-modules-3.13.0-119-generic N/A
 linux-firmware 1.127.23
RfKill:

Tags: trusty trusty third-party-packages
Uname: Linux 3.13.0-119-generic i686
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo
_MarkForUpload: True
dmi.bios.date: 12/01/2006
dmi.bios.vendor: innotek GmbH
dmi.bios.version: VirtualBox
dmi.board.name: VirtualBox
dmi.board.vendor: Oracle Corporation
dmi.board.version: 1.2
dmi.chassis.type: 1
dmi.chassis.vendor: Oracle Corporation
dmi.modalias: dmi:bvninnotekGmbH:bvrVirtualBox:bd12/01/2006:svninnotekGmbH:pnVirtualBox:pvr1.2:rvnOracleCorporation:rnVirtualBox:rvr1.2:cvnOracleCorporation:ct1:cvr:
dmi.product.name: VirtualBox
dmi.product.version: 1.2
dmi.sys.vendor: innotek GmbH

Revision history for this message
Norbert (nrbrtx) wrote :
tags: added: apport-collected
description: updated
Revision history for this message
Norbert (nrbrtx) wrote : AlsaInfo.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : CRDA.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : CurrentDmesg.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : Dependencies.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : IwConfig.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : JournalErrors.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : Lspci.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : Lsusb.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : ProcCpuinfoMinimal.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : ProcEnviron.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : ProcInterrupts.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : ProcModules.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : PulseList.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : RfKill.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : UdevDb.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : WifiSyslog.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : Re: linux-image-4.4.0-81-generic cause scilab-5.5.2 to crash with "Segmentation fault (core dumped)"

scilab crashed with SIGSEGV

Norbert (nrbrtx)
description: updated
Revision history for this message
Joseph Salisbury (jsalisbury) wrote : Status changed to Confirmed

This change was made by a bot.

Changed in linux (Ubuntu):
status: New → Confirmed
Revision history for this message
Norbert (nrbrtx) wrote : Re: linux-image-4.4.0-81-generic cause scilab-5.5.2 to crash with "Segmentation fault (core dumped)"

I tried to rebuild scilab from source with
* sudo apt-get build-dep scilab
* mkdir ~/Temp
* cd ~/Temp
* apt-get source --compile scilab

but it was stopped because of scilab crash:

-- Building documentation (en_US) --
LANG=C LC_ALL=en_US.UTF-8 SCI_DISABLE_TK=1 SCI_JAVA_ENABLE_HEADLESS=1 ./bin/scilab-adv-cli -noatomsautoload -nb -l en_US -nouserstartup -e "try xmltojar([],[],'en_US');catch disp(lasterror()); exit(-1);end;exit(0);"
Segmentation fault (core dumped)
Makefile:2156: recipe for target 'doc' failed
make[1]: *** [doc] Error 1
make[1]: Leaving directory '/home/nikolay/Temp/scilab-5.5.2'
/usr/share/cdbs/1/class/makefile.mk:47: recipe for target 'debian/stamp-makefile-build' failed
make: *** [debian/stamp-makefile-build] Error 2
dpkg-buildpackage: error: debian/rules build gave error exit status 2
Build command 'cd scilab-5.5.2 && dpkg-buildpackage -b -uc' failed.
E: Sub-process dpkg-source returned an error code (1)

So the problem is related to new linux kernel (not scilab).

Revision history for this message
Norbert (nrbrtx) wrote :

Got scilab compiled normally with linux-image-4.4.0-78-generic.

Revision history for this message
Norbert (nrbrtx) wrote :

As already noted (http://mailinglists.scilab.org/Scilab-users-Scilab-error-tp4036627p4036632.html) scilab works normally with linux-image-4.4.0-79-generic.
So it is kernel problem.

description: updated
Norbert (nrbrtx)
description: updated
description: updated
Norbert (nrbrtx)
summary: - linux-image-4.4.0-81-generic cause scilab-5.5.2 to crash with
+ linux-image-4.4.0-81-generic (on Xenial) and linux-
+ image-3.13.0-121-generic (on Trusty) cause scilab-5.5.2 to crash with
"Segmentation fault (core dumped)"
summary: - linux-image-4.4.0-81-generic (on Xenial) and linux-
- image-3.13.0-121-generic (on Trusty) cause scilab-5.5.2 to crash with
- "Segmentation fault (core dumped)"
+ CVE-2017-1000364 fix cause Scilab crash with "Segmentation fault (core
+ dumped)"
description: updated
tags: added: trusty
Revision history for this message
Norbert (nrbrtx) wrote : AlsaInfo.txt

apport information

tags: added: third-party-packages
description: updated
Revision history for this message
Norbert (nrbrtx) wrote : BootDmesg.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : CurrentDmesg.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : Dependencies.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : Lspci.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : ProcCpuinfoMinimal.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : ProcEnviron.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : ProcInterrupts.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : ProcModules.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : PulseList.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : UdevDb.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : UdevLog.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote : WifiSyslog.txt

apport information

Revision history for this message
Norbert (nrbrtx) wrote :

Bug exists in Trusty - error in linux-image-3.13.0-121-generic.

Norbert (nrbrtx)
no longer affects: openjdk-8 (Ubuntu)
Changed in linux (Debian):
status: Unknown → New
Revision history for this message
Ignacio (ignacio-rubioscola) wrote :
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in scilab (Ubuntu):
status: New → Confirmed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.