Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: SIGSEGV in BIO_free Version-Release number of selected component (if applicable): osslsigncode-2.8-1.fc39.x86_64 2.7 does not crash. How reproducible: Always. Steps to Reproduce: Test with a copy of a recent kernel: $ file vmlinuz-1.bin vmlinuz-1.bin: Linux kernel x86 boot executable bzImage, version 6.8.7-200.fc39.x86_64 (mockbuild@45dd5688efad44f5b0bb641c76b5468d) #1 SMP PREEMPT_DYNAMIC Wed Apr 17 19:35:11 UTC 2024, RO-rootFS, swap_dev 0XE, Normal VGA $ osslsigncode extract-signature -in vmlinuz-1.bin -out vmlinuz-1.sig Current PE checksum : 00000000 Calculated PE checksum: 00E34572 Warning: invalid PE checksum Corrupted attribute certificate table Attribute certificate table size : 00000D48 Attribute certificate entry length: 00000762 Unable to extract existing signature Segmentation fault (core dumped) Actual results: Program received signal SIGSEGV, Segmentation fault. Expected results: No SIGSEGV. Additional info:
$ gdb --args osslsigncode extract-signature -in vmlinuz-1.bin -out vmlinuz-1.sig GNU gdb (Fedora Linux) 14.2-1.fc39 ... (gdb) run Starting program: /usr/bin/osslsigncode extract-signature -in vmlinuz-1.bin -out vmlinuz-1.sig [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Current PE checksum : 00000000 Calculated PE checksum: 00E34572 Warning: invalid PE checksum Corrupted attribute certificate table Attribute certificate table size : 00000D48 Attribute certificate entry length: 00000762 Unable to extract existing signature Program received signal SIGSEGV, Segmentation fault. 0x00007ffff7ad75b1 in BIO_free (a=a@entry=0x5555555a9ef0) at crypto/bio/bio_lib.c:147 147 if ((a->method != NULL) && (a->method->destroy != NULL)) (gdb)
Artem: Thanks for opening the upstream issue.
FEDORA-2024-0f11edc3fc (osslsigncode-2.8-3.fc41) has been submitted as an update to Fedora 41. https://bodhi.fedoraproject.org/updates/FEDORA-2024-0f11edc3fc
Please test build with upstream patch fix. Build for other branches will be available soon: https://bodhi.fedoraproject.org/updates/?search=osslsigncode
FEDORA-2024-0f11edc3fc (osslsigncode-2.8-3.fc41) has been pushed to the Fedora 41 stable repository. If problem still persists, please make note of it in this bug report.
Thanks for the test build. This bug appears to be fixed, however osslsigncode still fails to extract a signature. Will open a separate bug for that problem. $ osslsigncode extract-signature -in /boot/vmlinuz-6.8.7-200.fc39.x86_64 -out vmlinuz-2.sig Current PE checksum : 00000000 Calculated PE checksum: 00E34572 Warning: invalid PE checksum Corrupted attribute certificate table Attribute certificate table size : 00000D48 Attribute certificate entry length: 00000762 Unable to extract existing signature Failed -- osslsigncode-2.8-3.fc39.x86_64
Maybe we should try latest master branch.
(In reply to Artem from comment #7) > Maybe we should try latest master branch. OK. For the record, osslsigncode-2.7-1.fc39.x86_64 extracts the signature: $ osslsigncode extract-signature -in /boot/vmlinuz-6.8.7-200.fc39.x86_64 -out vmlinuz-1.sig Succeeded With openssl-3.1.1-4.fc39.x86_64: $ openssl pkcs7 -in vmlinuz-1.sig -inform DER -print_certs -noout subject=C = US, ST = Massachusetts, L = Cambridge, O = "Red Hat, Inc.", OU = Fedora Secure Boot Signer, OU = bkernel01 kernel, CN = kernel-signer issuer=C = US, ST = Massachusetts, L = Cambridge, O = "Red Hat, Inc.", OU = Fedora Secure Boot CA 20200709, CN = fedoraca
FEDORA-2024-e2f35bd20c (osslsigncode-2.8-4.20240501gita53bd2b.fc41) has been submitted as an update to Fedora 41. https://bodhi.fedoraproject.org/updates/FEDORA-2024-e2f35bd20c
$ rpm -q osslsigncode osslsigncode-2.8-4.20240501gita53bd2b.fc39.x86_64 $ osslsigncode extract-signature -in /boot/vmlinuz-6.8.7-200.fc39.x86_64 -out vmlinuz-2.sig Current PE checksum : 00000000 Calculated PE checksum: 00E34572 Warning: invalid PE checksum Corrupted attribute certificate table Attribute certificate table size : 00000D48 Attribute certificate entry length: 00000762 Unable to extract existing signature Failed
Interesting. Can you please provide this feedback in upstream bug that bug is not completely fixed? Or open new one upstream issue.
FEDORA-2024-e2f35bd20c (osslsigncode-2.8-4.20240501gita53bd2b.fc41) has been pushed to the Fedora 41 stable repository. If problem still persists, please make note of it in this bug report.