Bug 2083699
| Summary: | Segfault due to FIPS restriction of MD5 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Julien Rische <jrische> |
| Component: | freeradius | Assignee: | Antonio Torres <antorres> |
| Status: | CLOSED ERRATA | QA Contact: | Filip Dvorak <fdvorak> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 9.1 | CC: | fdvorak, nikolai.kondrashov |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | freeradius-3.0.21-32.el9 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-11-15 10:19:20 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 2068458 | ||
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (freeradius bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:8089 |
FreeIPA's RADIUS OTP setup is causing a segmentation fault in FIPS mode: Thread 2 "radiusd" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7f531ea54640 (LWP 27144)] 0x0000000000000000 in ?? () (gdb) bt #0 0x0000000000000000 in ?? () #1 0x00007f5324c068d0 in rad_pwdecode (passwd=passwd@entry=0x7f531ea539f0 "Secret123456", pwlen=<optimized out>, pwlen@entry=16, secret=secret@entry=0x556361bf7cb0 "testing123", vector=vector@entry=0x556361d3fb58 "#&zb\375\253\206+\026!\217\371{\fdj#&zb") at src/lib/radius.c:4655 #2 0x00007f5324c0c281 in data2vp (ctx=ctx@entry=0x556361d3fb10, packet=packet@entry=0x556361d3fb10, original=original@entry=0x0, secret=<optimized out>, da=da@entry=0x5563619a3430, start=start@entry=0x556361d3fc44 "Secret123456", attrlen=16, packetlen=16, pvp=0x7f531ea53d10) at src/lib/radius.c:3887 #3 0x00007f5324c0cb1b in rad_attr2vp (ctx=ctx@entry=0x556361d3fb10, packet=packet@entry=0x556361d3fb10, original=original@entry=0x0, secret=secret@entry=0x556361bf7cb0 "testing123", data=data@entry=0x556361d3fc42 "\002\022Secret123456", length=length@entry=18, pvp=0x7f531ea53d10) at src/lib/radius.c:4327 #4 0x00007f5324c0f2e1 in rad_decode (packet=0x556361d3fb10, original=0x0, secret=0x556361bf7cb0 "testing123") at src/lib/radius.c:4492 #5 0x000055636076391d in request_pre_handler (action=1, action=1, request=0x556361d3fcc0) at src/main/process.c:1323 #6 request_running (request=0x556361d3fcc0, action=<optimized out>) at src/main/process.c:1616 #7 0x000055636075d282 in request_handler_thread (arg=0x556361d0bf00) at src/main/threads.c:826 #8 0x00007f53245a26ca in start_thread (arg=<optimized out>) at pthread_create.c:443 #9 0x00007f53245423f0 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81 The test setup is described in bug 2068458. This seems to be caused by the current OpenSSL integration[1] relying on the "EVP_MD_CTX_FLAG_NON_FIPS_ALLOW" flag which has no effect any more[2]. The same error is probably occurring for MD4. [1] https://gitlab.com/redhat/centos-stream/rpms/freeradius/-/blob/c9s/freeradius-Backport-OpenSSL3-fixes.patch#L483 [2] https://github.com/openssl/openssl/blob/openssl-3.0.3/include/openssl/evp.h#L208-L209