lsb_release crashed with ValueError in <lambda>(): could not convert string to float: '6.06 LTS'

[lan1967]

[Description]

In some cases lsb_release script can crash with the following trace :

Traceback (most recent call last):
File "/usr/bin/lsb_release", line 95, in <module>
main()
File "/usr/bin/lsb_release", line 59, in main
distinfo = lsb_release.get_distro_information()
File "/usr/lib/python3/dist-packages/lsb_release.py", line 356, in
get_distro_information
distinfo = guess_debian_release()
File "/usr/lib/python3/dist-packages/lsb_release.py", line 246, in
guess_debian_release
get_distro_info(distinfo['ID'])
File "/usr/lib/python3/dist-packages/lsb_release.py", line 48, in
get_distro_info
RELEASES_ORDER.sort(key=lambda n: float(n[0]))
File "/usr/lib/python3/dist-packages/lsb_release.py", line 48, in <lambda>
RELEASES_ORDER.sort(key=lambda n: float(n[0]))
ValueError: could not convert string to float: '6.06 LTS

The root cause of this is that function get_distro_info() while parsing
the '/usr/share/distro-info/ubuntu.csv' and expects to find a float at the
beginning of each line, instead it find a string ("6.06 LTS").

There is a fix for this bug upstream:
https://salsa.debian.org/debian/lsb/-/commit/4b36f9d31c00233ea20415542633729ab3799e61
and is already in kinetic.

[Test Case]

The easier way to reproduce this bug is to hack /usr/share/pyshared/lsb_release.py file
change the get_distro_info definition from
def get_distro_info(origin='Debian'):
to
def get_distro_info(origin='Ubuntu'):
and run
$ lsb_release
Traceback (most recent call last):
  File "/usr/bin/lsb_release", line 25, in <module>
    import lsb_release
  File "/usr/lib/python3/dist-packages/lsb_release.py", line 58, in <module>
    get_distro_info()
  File "/usr/lib/python3/dist-packages/lsb_release.py", line 48, in get_distro_info
    RELEASES_ORDER.sort(key=lambda n: float(n[0]))
  File "/usr/lib/python3/dist-packages/lsb_release.py", line 48, in <lambda>
    RELEASES_ORDER.sort(key=lambda n: float(n[0]))
ValueError: could not convert string to float: '6.06 LTS'

A detailed analysis on how this bug can happen in a real life scenario
can be found in comment #3.

[Regression Potential]

The fix changes the way get_distro_info function parses the csv file and instead of expecting
a float at the beginning of the line, it now expects a string and isolates the numerical part.

The regression potential is small and would affect the behavior of lsb_release executable.

[Other]

Debian bug : https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=980566
Fix : https://salsa.debian.org/debian/lsb/-/commit/4b36f9d31c00233ea20415542633729ab3799e61
Affected releases : Jammy, Focal, Bionic

[Ioanna Alifieraki (joalif)]

@lan1967 Is there any reason for this bug to be private ?

[Ioanna Alifieraki (joalif)]

Here is a more detailed analysis of how the bug can occur (analysis based on the focal sources).

lsb_release.py crashes in get_distro_info() function, while parsing
'/usr/share/distro-info/ubuntu.csv' file on the 4th line because of the
'6.06 LTS'. get_distro_info() expects a float (6.06) but finds a string (6.06 LTS).

How do we end up in this code path:
For the crash to occur, get_distro_info should be called with arg 'Ubuntu',
get_distro_info('Ubuntu').

If we grep lsb source package, we can see that get_distro_info is called only in
two places.
The first in lsb_release.py:58 with no arguments and the second in lsb_release.py:288
in function
guess_debian_release():
...get_distro_info(distinfo['ID'])

The function guess_debian_release() is only called from get_distro_information(), lsb_release.py:393.
If we look into this function, it initially calls get_os_release(), which is reading the
'/usr/lib/os-release' file and returns a dictionary with the file contents.
After this, the only way to call guess_debian_release() is to pass through the guard
on line 397:
```if key not in lsbinfo:```
For this condition to be true, the /usr/lib/os-release should be empty or contain unexpected keys.

[Michael Hudson-Doyle (mwhudson)]

Ioanna are you going to take care of preparing patches for fixing the stable releases? I marked the overall/kinetic task as fix released as you say the bug is no longer present there.

[Ioanna Alifieraki (joalif)]

@mwhudson yes, I am working on the debdiffs and once ready I'll attach them here.