tcpdump segv if -Z and -w is specified

[Lars Ekman]

[ Impact ]

There is currently a bug in tcpdump causing it to segfault on Noble machines and newer.

This is because of a bad interaction with d/p/drop-privs-only-if-non-root.diff
where using -Z root sets username to NULL, causing a null pointer dereference and subsequent segmentation fault.

[ Test Plan ]

Make sure you are on a noble machine or newer and that tcpdump is installed.

$ sudo apt install tcpdump

To reproduce the issue simply run the following command:

$ sudo tcpdump -Z root -ni lo -w /tmp/lo.pcap

Note that running it with sudo or being in a root shell is a requirement to trigger the crash.
You will see the following when reproducing the crash:
```
ghadi@XPS-17-9720 ~ » sudo tcpdump -Z root -ni lo -w /tmp/lo.pcap
[1] 1250151 segmentation fault sudo tcpdump -Z root -ni lo -w /tmp/lo.pcap
```

[ Where problems could occur ]

Since the patch makes sure that the username is valid before changing ownership, a possible regression might be that tcpdump fails to run due to permission issues, or that it still segfaults due to other checks that might be required.

[ Other info ]

The bug has been fixed in debian upstream here: https://salsa.debian.org/debian/tcpdump/-/blob/master/debian/patches/drop-privs-after-opening-savefile.diff

There is also a discussion about it on the debian bug tracker: https://bugs.debian.org/935112

This was fixed in:

commit b4b1230f07df973f8c8c339ec022f2357bc1179e
From: Romain Francoise <email address hidden>
Date: Fri, 23 Aug 2024 18:39:26 +0200
Subject: Avoid getpwnam(NULL) when called with `-Z root' (#1078771)
Link: https://salsa.debian.org/debian/tcpdump/-/commit/b4b1230f07df973f8c8c339ec022f2357bc1179e

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Ural Tunaboyu (uralt)]

Ubuntu 24.10 (Oracular Oriole) has reached end of life, so this bug will not be fixed for that specific release.

[Ghadi Rahme (ghadi-rahme)]

noble debdiff

[Ghadi Rahme (ghadi-rahme)]

plucky debdiff

[Matthew Ruffell (mruffell)]

Hi Ghadi,

This is missing a SRU template, please write one, and replace the description with it.
https://documentation.ubuntu.com/sru/en/latest/reference/bug-template/

Your versions are slightly incorrect, this would technically be sufficient, but ideally following
https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Update_the_packaging
is best. This would be the case:
2.0-2ubuntu1 in two releases 2.0-2ubuntu1.11.10.1 and 2.0-2ubuntu1.12.04.1
so the new versions would be 4.99.4-3ubuntu4.24.04.1 and 4.99.4-3ubuntu4.25.04.1 ideally.

The patch itself is good, well done.

The debian changelog entry... this is a nitpick, but I would like to see the format:

* Fixes segfault when running as the root user. (LP: #2071891)
  - d/p/check-username-validity-to-avoid-segfault.patch

instead.

Thanks,
Matthew

[Ghadi Rahme (ghadi-rahme)]

Hi Mathew,

Thank you for reviewing this!

Apologies for the SRU template I completely forgot to update it. Let me know what you think about it now!

I have also changed the versions strings and changed the format in the changelog file like you recommended.

Regards,
Ghadi

[Matthew Ruffell (mruffell)]

Hi Ghadi,

A couple minor notes:

We don't really need an entire new patch here, since we aren't really patching
tcpdump.c, we are actually patching d/p/drop-privs-after-opening-savefile.diff
so I would prefer if the change was made there, to reduce confusion from what
is an actual upstream patch and what is debian delta.

The change is really:

commit b4b1230f07df973f8c8c339ec022f2357bc1179e
From: Romain Francoise <email address hidden>
Date: Fri, 23 Aug 2024 18:39:26 +0200
Subject: Avoid getpwnam(NULL) when called with `-Z root' (#1078771)
Link: https://salsa.debian.org/debian/tcpdump/-/commit/b4b1230f07df973f8c8c339ec022f2357bc1179e

and I added this, along with some other minor changes to the SRU template.

I have sponsored for plucky and noble.

Plucky:
Uploading tcpdump_4.99.4-3ubuntu4.25.04.1.dsc
Uploading tcpdump_4.99.4-3ubuntu4.25.04.1.debian.tar.xz
Uploading tcpdump_4.99.4-3ubuntu4.25.04.1_source.buildinfo
Uploading tcpdump_4.99.4-3ubuntu4.25.04.1_source.changes

Noble:
Uploading tcpdump_4.99.4-3ubuntu4.24.04.1.dsc
Uploading tcpdump_4.99.4-3ubuntu4.24.04.1.debian.tar.xz
Uploading tcpdump_4.99.4-3ubuntu4.24.04.1_source.buildinfo
Uploading tcpdump_4.99.4-3ubuntu4.24.04.1_source.changes

Thanks,
Matthew

[Matthew Ruffell (mruffell)]

Actual debdiff that was sponsored for plucky.

[Matthew Ruffell (mruffell)]

Debdiff for tcpdump on noble

[Julian Andres Klode (juliank)]

Hello Lars, or anyone else affected,

Accepted tcpdump into plucky-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/tcpdump/4.99.4-3ubuntu4.25.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-plucky to verification-done-plucky. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-plucky. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Julian Andres Klode (juliank)]

Hello Lars, or anyone else affected,

Accepted tcpdump into noble-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/tcpdump/4.99.4-3ubuntu4.24.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-noble to verification-done-noble. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-noble. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Ghadi Rahme (ghadi-rahme)]

noble verification:

root@build-noble:~# apt list --installed tcpdump
Listing... Done
tcpdump/noble-proposed,noble-proposed,now 4.99.4-3ubuntu4.24.04.1 amd64 [installed]
N: There is 1 additional version. Please use the '-a' switch to see it

root@build-noble:~# sudo tcpdump -Z root -ni lo -w /tmp/lo.pcap
tcpdump: listening on lo, link-type EN10MB (Ethernet), snapshot length 262144 bytes
^C0 packets captured
0 packets received by filter
0 packets dropped by kernel

Test successfully passes on noble.

[Ghadi Rahme (ghadi-rahme)]

plucky verification:

root@build-plucky:~# apt list --installed tcpdump
tcpdump/plucky-proposed,now 4.99.4-3ubuntu4.25.04.1 amd64 [installed,automatic]
Notice: There is 1 additional version. Please use the '-a' switch to see it

root@build-plucky:~# sudo tcpdump -Z root -ni lo -w /tmp/lo.pcap
tcpdump: listening on lo, link-type EN10MB (Ethernet), snapshot length 262144 bytes
^C0 packets captured
0 packets received by filter
0 packets dropped by kernel

Test successfully passes on plucky.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted tcpdump (4.99.4-3ubuntu4.24.04.1) for noble have finished running.
The following regressions have been reported in tests triggered by the package:

openvswitch/3.3.4-0ubuntu0.24.04.1 (ppc64el)
ovn/24.03.6-0ubuntu0.24.04.1 (amd64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/noble/update_excuses.html#tcpdump

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted tcpdump (4.99.4-3ubuntu4.25.04.1) for plucky have finished running.
The following regressions have been reported in tests triggered by the package:

openvswitch/3.5.1-0ubuntu0.1 (arm64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/plucky/update_excuses.html#tcpdump

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Launchpad Janitor (janitor)]

This bug was fixed in the package tcpdump - 4.99.4-3ubuntu4.25.04.1

---------------
tcpdump (4.99.4-3ubuntu4.25.04.1) plucky; urgency=medium

  * Fixes segfault when running as the root user. (LP: #2071891)
    - d/p/drop-privs-after-opening-savefile.diff

 -- Ghadi Elie Rahme <email address hidden> Wed, 10 Sep 2025 15:28:48 +0000

[Andreas Hasenack (ahasenack)]

The verification of the Stable Release Update for tcpdump has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package tcpdump - 4.99.4-3ubuntu4.24.04.1

---------------
tcpdump (4.99.4-3ubuntu4.24.04.1) noble; urgency=medium

  * Fixes segfault when running as the root user. (LP: #2071891)
    - d/p/drop-privs-after-opening-savefile.diff

 -- Ghadi Elie Rahme <email address hidden> Wed, 10 Sep 2025 15:28:48 +0000