Debian Bug report logs - #802487
aide crash (SIGSEGV) at beginning

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: jpp <jpp@jppozzi.dyndns.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: aide crash (SIGSEGV) at beginning

Date: Tue, 20 Oct 2015 15:49:51 +0200

Package: aide
Version: 0.16~a2.git20130520-3~bpo70+1
Severity: grave
Justification: renders package unusable

Dear Maintainer,

My version af "aide" crash at beginning with a SIGSEGV, even if I try "aide
--help'.
I launch "aide --help" with strace and the trace is very short :
-------------------------------------------------------------------------------------------------
execve("/usr/bin/aide", ["aide"], [/* 21 vars */]) = 0
uname({sys="Linux", node="filtre.jpp.fr", ...}) = 0
brk(0)                                  = 0x108b000
brk(0x108c1c0)                          = 0x108c1c0
arch_prctl(ARCH_SET_FS, 0x108b8a0)      = 0
brk(0x10ad1c0)                          = 0x10ad1c0
brk(0x10ae000)                          = 0x10ae000
statfs("/sys/fs/selinux", 0x7ffdb40382e0) = -1 ENOENT (No such file or
directory)
statfs("/selinux", 0x7ffdb40382e0)      = -1 ENOENT (No such file or directory)
open("/proc/filesystems", O_RDONLY)     = 3
fstat(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7effe0207000
read(3, "nodev\tsysfs\nnodev\trootfs\nnodev\tr"..., 1024) = 366
read(3, "", 1024)                       = 0
close(3)                                = 0
munmap(0x7effe0207000, 4096)            = 0
umask(0177)                             = 022
rt_sigaction(SIGBUS, {0x4120f0, [BUS], SA_RESTORER|SA_RESTART, 0x449fa0},
{SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGTERM, {0x4120f0, [TERM], SA_RESTORER|SA_RESTART, 0x449fa0},
{SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGUSR1, {0x4120f0, [USR1], SA_RESTORER|SA_RESTART, 0x449fa0},
{SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGUSR2, {0x4120f0, [USR2], SA_RESTORER|SA_RESTART, 0x449fa0},
{SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGHUP, {0x4120f0, [HUP], SA_RESTORER|SA_RESTART, 0x449fa0},
{SIG_DFL, [], 0}, 8) = 0
uname({sys="Linux", node="filtre.jpp.fr", ...}) = 0
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++
--------------------------------------------------------------------------------------------------------------------
System information :
CPU : corei3 4140
Mem: 16GB
System disk SSD Vertex
Raid 1 2 x 2GB seagate

Regards

JPPO



-- System Information:
Debian Release: 7.9
  APT prefers oldstable-updates
  APT policy: (500, 'oldstable-updates'), (500, 'oldstable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.2.3 (SMP w/4 CPU cores)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

aide depends on no packages.

Versions of packages aide recommends:
ii  aide-common  0.16~a2.git20130520-3~bpo70+1

aide suggests no packages.

-- no debconf information

Message #10 received at 802487@bugs.debian.org (full text, mbox, reply):

From: Hannes von Haugwitz <hannes@vonhaugwitz.com>

To: jpp <jpp@jppozzi.dyndns.org>, 802487@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: Bug#802487: aide crash (SIGSEGV) at beginning

Date: Wed, 21 Oct 2015 20:55:57 +0200

severity 802487 important
tags 802487 +unreproducible +moreinfo
forcemerge 802487 776001
thanks

On Tue, Oct 20, 2015 at 03:49:51PM +0200, jpp wrote:
> My version af "aide" crash at beginning with a SIGSEGV, even if I try "aide
> --help'.

I tried to reproduce this on a fresh minimal Debian wheezy installation
with no success. So I''m tagging this bug as unreproducible.

Please provide more info about how to reproduce this behaviour.

Best regards

Hannes

Message #23 received at 802487@bugs.debian.org (full text, mbox, reply):

From: Marc Haber <mh+debian-packages@zugschlus.de>

To: Hannes von Haugwitz <hannes@vonhaugwitz.com>, 802487@bugs.debian.org

Cc: jpp <jpp@jppozzi.dyndns.org>

Subject: Re: [Pkg-aide-maintainers] Bug#802487: aide crash (SIGSEGV) at beginning

Date: Thu, 22 Oct 2015 14:37:01 +0200

On Wed, Oct 21, 2015 at 08:55:57PM +0200, Hannes von Haugwitz wrote:
> I tried to reproduce this on a fresh minimal Debian wheezy installation
> with no success. So I''m tagging this bug as unreproducible.

As the complaint is against a bpo-oldstable package on oldstable, this
is not even "important", IMO. But since you do the majority on the work
anyway, it's of course your decision.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany    |  lose things."    Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421

Message #28 received at 802487@bugs.debian.org (full text, mbox, reply):

From: "jp.pozzi@izzop.net" <jp.pozzi@izzop.net>

To: 802487@bugs.debian.org

Subject: Aide crash

Date: Fri, 23 Oct 2015 16:54:45 +0200

Hello,

After reading the responses I verify some things on other Debian
systems (not Wheezy but Jessie) and I saw that the aide version which
crashed has a filesize very different from other :
On the Wheezy syste :
-rwxr-xr-x 1 root root 1429528 avril  7  2015 aide
On a Jessie system :
-rwxr-xr-x 1 root root 193144 oct.  24  2014 aide

I try to rename the "original" aide and copy the Jessie version on the
Wheezy system. 
After installing the right version of Libaudit aide works like a charm.

I can't imagine while sizes are so different, even if the file has been
corrupted.


Thanks

JPPO

PS :

file aide_crash (the crashing version) :
aide_crash: ELF 64-bit LSB executable, x86-64, version 1 (SYSV),
statically linked, for GNU/Linux 2.6.26,
BuildID[sha1]=173333c7b2c389f6da5f161b3db82d2668bcb7ce, stripped

file aide (the Jessie version)
aide: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV),
dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for
GNU/Linux 2.6.32,
BuildID[sha1]=0b14ddfefa397821dc117f4b9d0c55363c673bea, stripped

Message #33 received at 802487@bugs.debian.org (full text, mbox, reply):

From: Hannes von Haugwitz <hannes@vonhaugwitz.com>

To: jp.pozzi@izzop.net, 802487@bugs.debian.org

Subject: Re: Bug#802487: Aide crash

Date: Sun, 25 Oct 2015 21:01:13 +0100

Hi,

On Fri, Oct 23, 2015 at 04:54:45PM +0200, jp.pozzi@izzop.net wrote:
> On the Wheezy syste :
> -rwxr-xr-x 1 root root 1429528 avril  7  2015 aide
> 
> file aide_crash (the crashing version) :
> aide_crash: ELF 64-bit LSB executable, x86-64, version 1 (SYSV),
> statically linked, for GNU/Linux 2.6.26,
> BuildID[sha1]=173333c7b2c389f6da5f161b3db82d2668bcb7ce, stripped

For aide 0.16~a2.git20130520-3~bpo70+1 on wheezy (amd64) I got

root@wheezy:~# ls -l /usr/bin/aide
-rwxr-xr-x 1 root root 1429528 Apr  7  2015 /usr/bin/aide
root@wheezy:~# file /usr/bin/aide
/usr/bin/aide: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, for GNU/Linux 2.6.26, BuildID[sha1]=0xc7333317f689c3b21b165fda262db83dceb7bc68, stripped
root@wheezy:~# sha256sum /usr/bin/aide
32de26a6a75564f1e64677d958e5593f5a583ac0a40dd61714c0e397f0fac3e6  /usr/bin/aide

So the size seems to be correct.

Can you provide any other info about how to reproduce your issue?

Best regards

Hannes

Message #38 received at 802487@bugs.debian.org (full text, mbox, reply):

From: Carlos Pérez <carlos.perez@uv.es>

To: 802487@bugs.debian.org

Subject: Aide crash (SIGSEGV) solved by reinstalling

Date: Tue, 27 Sep 2016 09:42:08 +0200

Hi,

I came across this same problem (the same segmentation fault in the same
place) today and I was able to get a working Aide just by reinstalling
the package:

apt-get install aide --reinstall

I think that the segmentation fault was produced by a corrupt aide
binary, since the aide's SHA256 signature changes after reinstalling the
package (note that it is the same package version that is reinstalled).
In fact, the size in the corrupted file is the same that that of the
correct one.

I was able to detect this because I use two different Debian 8.5 virtual
machines and only in one of them aide crashed. The working system was
created using a standard Debian installation CD while the faulty one was
created using debootstrap (I don't know whether this is relevant or not).

I know it could be a security issue. But, I doubt it, because both
systems are virtual machines behind a NAT router, they don't offer any
service to the Internet and they don't use Internet services either
(apart from the Debian repositories).

The situation before reinstalling in the faulty system:

Working system:
# ls -l $(which aide)
-rwxr-xr-x 1 root root 1597208 Oct 24  2014 /usr/bin/aide
# sha256sum /usr/bin/aide
e382183d9f94e0325af0a8d235445a82f0aab9c3fc134b9219b9b290722db7e5
/usr/bin/aide
# aide
Couldn't open file
/var/lib/aide/please-dont-call-aide-without-parameters/aide.db for reading

Faulty system:
# ls -l $(which aide)
-rwxr-xr-x 1 root root 1597208 Oct 24  2014 /usr/bin/aide
# sha256sum /usr/bin/aide
c2ac6ddeb386376fa2f504e5471fb9880baffd15807060b37b28bcabb91466bd
/usr/bin/aide
# aide
Segmentation fault

After reinstalling aide in the faulty system, the SHA256 matches that of
the working one, and aide works OK.

Further information:
- Both system are Debian 8.5 x86_64
- Aide version: 0.16~a2.git20130520-3
- I upgraded the faulty system to Debian 8.6 (no aide upgrade, however)
and the segmentation fault was still there.
- The faulty one was a User-Mode Linux virtual machine running inside
the working one (a VMware Workstation virtual machine).

Hope it helps.

Sincerely,

-- 
Carlos Pérez

Message #43 received at 802487-done@bugs.debian.org (full text, mbox, reply):

From: Marc Haber <mh+debian-packages@zugschlus.de>

To: Carlos Pérez <carlos.perez@uv.es>, 802487-done@bugs.debian.org, 802487-submitter@bugs.debian.org

Subject: Re: Bug#802487: Aide crash (SIGSEGV) solved by reinstalling

Date: Sat, 21 Oct 2017 11:47:29 +0200

I am closing this since this has happened years ago, there were no
reference cases, and that we can be reasonably sure that the segfaults
vanished once the correct binary from the package was installed.

Feel free to re-open if you feel the need to have this still open.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany    |  lose things."    Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421

Send a report that this bug log contains spam.