Bug 1868996

Summary:	ssh-agent segfaults during ssh-add -s pkcs11
Product:	Red Hat Enterprise Linux 8	Reporter:	Orion Poplawski <orion>
Component:	openssh	Assignee:	Dmitry Belyavskiy <dbelyavs>
Status:	CLOSED ERRATA	QA Contact:	Marek Havrila <mhavrila>
Severity:	low	Docs Contact:
Priority:	low
Version:	8.2	CC:	asosedki, dbelyavs, jjelen, mhavrila
Target Milestone:	rc	Keywords:	Patch, Triaged
Target Release:	8.4
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	openssh-8.0p1-7.el8	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-09 19:32:04 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Orion Poplawski 2020-08-15 01:42:16 UTC

Description of problem:

Insert yubikey 5C

$ eval $(ssh-agent)
$ ssh-add -l pkcs11
Enter passphrase for PKCS#11: 

ssh-agent is now dead

Version-Release number of selected component (if applicable):
openssh-8.0p1-4.el8_1.x86_64


How reproducible:
Everytime

Program received signal SIGSEGV, Segmentation fault.
0x000055cda64bd28d in pkcs11_uri_cleanup (pkcs11=0x0) at ssh-pkcs11-uri.c:252
252             free(pkcs11->id);

so pkcs11 is NULL here which doesn't seem good.

Comment 1 Orion Poplawski 2020-08-15 02:42:24 UTC

Well, I guess this isn't a big deal since pkcs11 isn't a valid URL - but it definitely shouldn't segfault.

Comment 2 Jakub Jelen 2020-08-17 07:38:27 UTC

Thank you for the report. Simple checking for null in pkcs11_uri_cleanup() handles this case. I pushed update to fedora [1] and I will fix it in RHEL as we will do update.


[1] https://src.fedoraproject.org/rpms/openssh/c/4c85eb3

Comment 14 errata-xmlrpc 2021-11-09 19:32:04 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: openssh security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:4368