| 2016-04-03 22:25:04 |
LaMont Jones |
bug |
|
|
added bug |
| 2016-04-03 22:25:04 |
LaMont Jones |
attachment added |
|
trace, etc from gdb. https://bugs.launchpad.net/bugs/1565567/+attachment/4622375/+files/sudo.bug |
|
| 2016-04-04 19:36:58 |
Brian Murray |
tags |
|
xenial |
|
| 2016-04-04 19:37:08 |
Brian Murray |
sudo (Ubuntu): importance |
Undecided |
High |
|
| 2016-04-09 22:27:26 |
Launchpad Janitor |
sudo (Ubuntu): status |
New |
Confirmed |
|
| 2016-05-04 04:27:58 |
Rafael David Tinoco |
nominated for series |
|
Ubuntu Xenial |
|
| 2016-05-04 12:01:24 |
Marc Deslauriers |
bug task added |
|
sudo (Ubuntu Xenial) |
|
| 2016-05-04 12:01:30 |
Marc Deslauriers |
sudo (Ubuntu Xenial): status |
New |
Confirmed |
|
| 2016-05-04 12:17:18 |
Marc Deslauriers |
sudo (Ubuntu): assignee |
|
Marc Deslauriers (mdeslaur) |
|
| 2016-05-04 12:17:51 |
Marc Deslauriers |
sudo (Ubuntu Xenial): assignee |
|
Marc Deslauriers (mdeslaur) |
|
| 2016-05-04 12:18:12 |
Marc Deslauriers |
bug watch added |
|
http://bugzilla.sudo.ws/show_bug.cgi?id=743 |
|
| 2016-05-04 12:18:12 |
Marc Deslauriers |
bug task added |
|
sudo |
|
| 2016-05-04 16:37:15 |
Marc Deslauriers |
sudo (Ubuntu): status |
Confirmed |
Fix Committed |
|
| 2016-05-04 16:37:17 |
Marc Deslauriers |
sudo (Ubuntu Xenial): status |
Confirmed |
In Progress |
|
| 2016-05-04 16:37:21 |
Marc Deslauriers |
sudo (Ubuntu Xenial): importance |
Undecided |
High |
|
| 2016-05-04 16:41:26 |
Marc Deslauriers |
description |
If the user is in a group with no name (because libnss-db got removed and the group was defined there, for example...) then:
the call to sudo_debug_printf in sudo_getgrgid (plugins/sudoers/pwutil.c, line 462) causes a SEGV when trying to get item->d.gr->gr_name (since item->d.gr is NULL). |
[Impact]
In certain environments, for example when using LDAP, users can end up in a group with no name. When that happens, sudo crashes when attempting to look up the group name for the debug log.
Upstream has commited a simple fix for this issue, it has been commited to Yakkety, and uploaded to Xenial.
[Test Case]
I currently don't know an easy way to reproduce this, it is environment-specific. A package containing the fix was successfully tested in the problematic environment.
[Regression Potential]
A regression in the patch would prevent users from using sudo. The risk of regression is low since the patch only changes the debug log.
Original report:
If the user is in a group with no name (because libnss-db got removed and the group was defined there, for example...) then:
the call to sudo_debug_printf in sudo_getgrgid (plugins/sudoers/pwutil.c, line 462) causes a SEGV when trying to get item->d.gr->gr_name (since item->d.gr is NULL). |
|
| 2016-05-04 16:41:34 |
Marc Deslauriers |
bug |
|
|
added subscriber Marc Deslauriers |
| 2016-05-04 16:41:39 |
Marc Deslauriers |
bug |
|
|
added subscriber Ubuntu Stable Release Updates Team |
| 2016-05-04 17:22:29 |
Adam Conrad |
sudo (Ubuntu Xenial): status |
In Progress |
Fix Committed |
|
| 2016-05-04 17:22:33 |
Adam Conrad |
bug |
|
|
added subscriber SRU Verification |
| 2016-05-04 17:22:37 |
Adam Conrad |
tags |
xenial |
verification-needed xenial |
|
| 2016-05-05 13:03:09 |
Launchpad Janitor |
sudo (Ubuntu): status |
Fix Committed |
Fix Released |
|
| 2016-05-05 19:20:55 |
Rafael David Tinoco |
tags |
verification-needed xenial |
verification-done xenial |
|
| 2016-05-07 20:57:30 |
Ben Kulbertis |
sudo (Ubuntu Xenial): status |
Fix Committed |
Fix Released |
|
| 2016-05-07 22:22:11 |
Marc Deslauriers |
sudo (Ubuntu Xenial): status |
Fix Released |
Fix Committed |
|
| 2016-05-07 23:40:23 |
Ben Kulbertis |
bug |
|
|
added subscriber Ben Kulbertis |
| 2016-05-11 15:39:16 |
Launchpad Janitor |
sudo (Ubuntu Xenial): status |
Fix Committed |
Fix Released |
|
| 2016-05-11 15:39:20 |
Chris J Arges |
removed subscriber Ubuntu Stable Release Updates Team |
|
|
|
