ssh fails to load opensc-pkcs11.so

[Valery Ushakov]

I have PKCS11Provider opensc-pkcs11.so in my ~/.ssh/config

After the last update of openssh-client I now get:

$ strace -o slogin.log slogin host
lib_contains_symbol: open opensc-pkcs11.so: No such file or directory
provider opensc-pkcs11.so is not a PKCS11 library
(uwe@host) Password for uwe@host:

$ grep -i pkcs11 slogin.log
read(3, "PKCS11Provider opensc-pkcs11.so\n"..., 4096) = 1603
openat(AT_FDCWD, "opensc-pkcs11.so", O_RDONLY) = -1 ENOENT (No such file or directory)
write(2, "provider opensc-pkcs11.so is not"..., 51) = 51

$ dpkg-query --listfiles opensc-pkcs11 | grep opensc-pkcs11.so
/usr/lib/x86_64-linux-gnu/onepin-opensc-pkcs11.so
/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so
/usr/lib/x86_64-linux-gnu/pkcs11/onepin-opensc-pkcs11.so
/usr/lib/x86_64-linux-gnu/pkcs11/opensc-pkcs11.so

ProblemType: Bug
DistroRelease: Ubuntu 22.04
Package: openssh-client 1:8.9p1-3ubuntu0.3
ProcVersionSignature: Ubuntu 5.19.0-50.50-generic 5.19.17
Uname: Linux 5.19.0-50-generic x86_64
ApportVersion: 2.20.11-0ubuntu82.5
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Wed Jul 26 15:46:30 2023
InstallationDate: Installed on 2022-08-25 (334 days ago)
InstallationMedia: Ubuntu 22.04 LTS "Jammy Jellyfish" - Release amd64 (20220419)
RelatedPackageVersions:
 ssh-askpass 1:1.2.4.1-13
 libpam-ssh N/A
 keychain N/A
 ssh-askpass-gnome N/A
SSHClientVersion: OpenSSH_8.9p1 Ubuntu-3ubuntu0.3, OpenSSL 3.0.2 15 Mar 2022
SourcePackage: openssh
UpgradeStatus: No upgrade log present (probably fresh install)

[Seth Arnold (seth-arnold)]

Can you run fatrace or opensnoop-bpfcc to discover what exact paths are being probed?

Thanks

[Marc Deslauriers (mdeslaur)]

Can you try putting the full path to the library in your config file?

[Marc Deslauriers (mdeslaur)]

One of the commits for the security fix for CVE-2023-28408 will now attempt to mmap the library and search for the "C_GetFunctionList" symbol before doing the dlopen. Unfortunately, dlopen allows specifying just the library name and the dynamic linker will search for it, but the new code just tries to open the filename directly.

[Valery Ushakov (v-ushakov)]

Yes,

PKCS11Provider /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so

works. I guess you can close it then.

Though, parenthetically speaking, I realize NFS homes shared by heterogeneous systems are not in wide use now, but the above fix doesn't work very well in that kind of environment :)

[Marc Deslauriers (mdeslaur)]

I've filed an upstream bug for this, let's see if they consider this to be an issue or not: https://bugzilla.mindrot.org/show_bug.cgi?id=3594

Thanks!

[Marc Deslauriers (mdeslaur)]

Upstream says the change is intentional, so I am closing this bug. Thanks!