Debian Bug report logs - #987168
fluidsynth: CVE-2021-28421

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: fluidsynth: CVE-2021-28421

Date: Sun, 18 Apr 2021 20:57:39 +0200

Source: fluidsynth
Version: 2.1.7-1
Severity: grave
Tags: security upstream
Forwarded: https://github.com/FluidSynth/fluidsynth/issues/808
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for fluidsynth, filling it
as grave to be on safe side because of the use after free aspect. Let
me know if you disagree and we can downgrade. Still ideally it is
fixed for bullseye. It was othrwise marked no-dsa for buster, deemed
enought to be fixed via a point release.

CVE-2021-28421[0]:
| FluidSynth 2.1.7 contains a use after free vulnerability in
| sfloader/fluid_sffile.c that can result in arbitrary code execution or
| a denial of service (DoS) if a malicious soundfont2 file is loaded
| into a fluidsynth library.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-28421
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28421
[1] https://github.com/FluidSynth/fluidsynth/issues/808
[2] https://github.com/FluidSynth/fluidsynth/pull/810

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #12 received at 987168@bugs.debian.org (full text, mbox, reply):

From: Reiner Herrmann <reiner@reiner-h.de>

To: 987168@bugs.debian.org

Subject: fluidsynth: diff for NMU version 2.1.7-1.1

Date: Sat, 24 Apr 2021 14:20:43 +0200

[Message part 1 (text/plain, inline)]

Control: tags 987168 + patch
Control: tags 987168 + pending

Dear maintainer,

I've prepared an NMU for fluidsynth (versioned as 2.1.7-1.1) and
uploaded it to DELAYED/3. Please feel free to tell me if I
should delay it longer.

Regards,
  Reiner

[fluidsynth-2.1.7-1.1-nmu.diff (text/x-diff, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #21 received at 987168@bugs.debian.org (full text, mbox, reply):

From: Sebastian Ramacher <sramacher@debian.org>

To: Reiner Herrmann <reiner@reiner-h.de>, 987168@bugs.debian.org

Subject: Re: Bug#987168: fluidsynth: diff for NMU version 2.1.7-1.1

Date: Sat, 24 Apr 2021 14:45:20 +0200

[Message part 1 (text/plain, inline)]

On 2021-04-24 14:20:43 +0200, Reiner Herrmann wrote:
> Control: tags 987168 + patch
> Control: tags 987168 + pending
> 
> Dear maintainer,
> 
> I've prepared an NMU for fluidsynth (versioned as 2.1.7-1.1) and
> uploaded it to DELAYED/3. Please feel free to tell me if I
> should delay it longer.

Please feel free to reschedule to DELAYED/0.

Cheers

> 
> Regards,
>   Reiner

> diff -Nru fluidsynth-2.1.7/debian/changelog fluidsynth-2.1.7/debian/changelog
> --- fluidsynth-2.1.7/debian/changelog	2021-02-09 21:43:23.000000000 +0100
> +++ fluidsynth-2.1.7/debian/changelog	2021-04-24 13:37:51.000000000 +0200
> @@ -1,3 +1,11 @@
> +fluidsynth (2.1.7-1.1) unstable; urgency=medium
> +
> +  * Non-maintainer upload.
> +  * Import patch that fixes use-after-free vulnerability. (CVE-2021-28421)
> +    (Closes: #987168)
> +
> + -- Reiner Herrmann <reiner@reiner-h.de>  Sat, 24 Apr 2021 13:37:51 +0200
> +
>  fluidsynth (2.1.7-1) unstable; urgency=medium
>  
>    * New upstream version 2.1.7
> diff -Nru fluidsynth-2.1.7/debian/patches/CVE-2021-28421.patch fluidsynth-2.1.7/debian/patches/CVE-2021-28421.patch
> --- fluidsynth-2.1.7/debian/patches/CVE-2021-28421.patch	1970-01-01 01:00:00.000000000 +0100
> +++ fluidsynth-2.1.7/debian/patches/CVE-2021-28421.patch	2021-04-24 13:35:20.000000000 +0200
> @@ -0,0 +1,84 @@
> +From 005719628aef0bd48dc7b2f860c7e4ca16b81044 Mon Sep 17 00:00:00 2001
> +From: Tom M <tom.mbrt@googlemail.com>
> +Date: Mon, 15 Mar 2021 20:12:51 +0100
> +Subject: [PATCH] Invalid generators were not removed from zone list (#810)
> +Bug: https://github.com/FluidSynth/fluidsynth/issues/808
> +Bug-Debian: https://bugs.debian.org/987168
> +
> +fluid_list_remove() should receive the beginning of a list, so it can adjust the predecessor of the element to be removed. Otherwise the element would remain in the list, which in this case led to a use-after-free afterwards.
> +---
> + src/sfloader/fluid_sffile.c | 20 ++++++++++++--------
> + 1 file changed, 12 insertions(+), 8 deletions(-)
> +
> +diff --git a/src/sfloader/fluid_sffile.c b/src/sfloader/fluid_sffile.c
> +index 001a0a0a4..47ab98d97 100644
> +--- a/src/sfloader/fluid_sffile.c
> ++++ b/src/sfloader/fluid_sffile.c
> +@@ -1355,7 +1355,7 @@ static int load_pmod(SFData *sf, int size)
> +  * ------------------------------------------------------------------- */
> + static int load_pgen(SFData *sf, int size)
> + {
> +-    fluid_list_t *p, *p2, *p3, *dup, **hz = NULL;
> ++    fluid_list_t *p, *p2, *p3, *dup, **hz = NULL, *start_of_zone_list;
> +     SFZone *z;
> +     SFGen *g;
> +     SFGenAmount genval;
> +@@ -1369,7 +1369,7 @@ static int load_pgen(SFData *sf, int size)
> +         /* traverse through all presets */
> +         gzone = FALSE;
> +         discarded = FALSE;
> +-        p2 = ((SFPreset *)(p->data))->zone;
> ++        start_of_zone_list = p2 = ((SFPreset *)(p->data))->zone;
> + 
> +         if(p2)
> +         {
> +@@ -1516,11 +1516,13 @@ static int load_pgen(SFData *sf, int size)
> +                 }
> +                 else
> +                 {
> ++                    p2 = fluid_list_next(p2); /* advance to next zone before deleting the current list element */
> +                     /* previous global zone exists, discard */
> +                     FLUID_LOG(FLUID_WARN, "Preset '%s': Discarding invalid global zone",
> +                               ((SFPreset *)(p->data))->name);
> +-                    *hz = fluid_list_remove(*hz, p2->data);
> +-                    delete_zone((SFZone *)fluid_list_get(p2));
> ++                    fluid_list_remove(start_of_zone_list, z);
> ++                    delete_zone(z);
> ++                    continue;
> +                 }
> +             }
> + 
> +@@ -1864,7 +1866,7 @@ static int load_imod(SFData *sf, int size)
> + /* load instrument generators (see load_pgen for loading rules) */
> + static int load_igen(SFData *sf, int size)
> + {
> +-    fluid_list_t *p, *p2, *p3, *dup, **hz = NULL;
> ++    fluid_list_t *p, *p2, *p3, *dup, **hz = NULL, *start_of_zone_list;
> +     SFZone *z;
> +     SFGen *g;
> +     SFGenAmount genval;
> +@@ -1878,7 +1880,7 @@ static int load_igen(SFData *sf, int size)
> +         /* traverse through all instruments */
> +         gzone = FALSE;
> +         discarded = FALSE;
> +-        p2 = ((SFInst *)(p->data))->zone;
> ++        start_of_zone_list = p2 = ((SFInst *)(p->data))->zone;
> + 
> +         if(p2)
> +         {
> +@@ -2024,11 +2026,13 @@ static int load_igen(SFData *sf, int size)
> +                 }
> +                 else
> +                 {
> ++                    p2 = fluid_list_next(p2); /* advance to next zone before deleting the current list element */
> +                     /* previous global zone exists, discard */
> +                     FLUID_LOG(FLUID_WARN, "Instrument '%s': Discarding invalid global zone",
> +                               ((SFInst *)(p->data))->name);
> +-                    *hz = fluid_list_remove(*hz, p2->data);
> +-                    delete_zone((SFZone *)fluid_list_get(p2));
> ++                    fluid_list_remove(start_of_zone_list, z);
> ++                    delete_zone(z);
> ++                    continue;
> +                 }
> +             }
> + 
> diff -Nru fluidsynth-2.1.7/debian/patches/series fluidsynth-2.1.7/debian/patches/series
> --- fluidsynth-2.1.7/debian/patches/series	1970-01-01 01:00:00.000000000 +0100
> +++ fluidsynth-2.1.7/debian/patches/series	2021-04-24 13:35:27.000000000 +0200
> @@ -0,0 +1 @@
> +CVE-2021-28421.patch




-- 
Sebastian Ramacher

[signature.asc (application/pgp-signature, inline)]

Message #26 received at 987168-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 987168-close@bugs.debian.org

Subject: Bug#987168: fixed in fluidsynth 2.1.7-1.1

Date: Sat, 24 Apr 2021 13:18:26 +0000

Source: fluidsynth
Source-Version: 2.1.7-1.1
Done: Reiner Herrmann <reiner@reiner-h.de>

We believe that the bug you reported is fixed in the latest version of
fluidsynth, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 987168@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Reiner Herrmann <reiner@reiner-h.de> (supplier of updated fluidsynth package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sat, 24 Apr 2021 13:37:51 +0200
Source: fluidsynth
Architecture: source
Version: 2.1.7-1.1
Distribution: unstable
Urgency: medium
Maintainer: Debian Multimedia Maintainers <debian-multimedia@lists.debian.org>
Changed-By: Reiner Herrmann <reiner@reiner-h.de>
Closes: 987168
Changes:
 fluidsynth (2.1.7-1.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Import patch that fixes use-after-free vulnerability. (CVE-2021-28421)
     (Closes: #987168)
Checksums-Sha1:
 d31bb49ee05444ef35da0cc42cf7b7672fae2a5d 2489 fluidsynth_2.1.7-1.1.dsc
 4e4eeac450f6ab54eb6d0cbe82410a0c85dec161 19684 fluidsynth_2.1.7-1.1.debian.tar.xz
 43a2551d323171fb5b27201cac1a1154459de9e4 12756 fluidsynth_2.1.7-1.1_amd64.buildinfo
Checksums-Sha256:
 037f2569926c28ccfa7eccdfd153f95e1551b68d6dcea88262ab84eff741dabd 2489 fluidsynth_2.1.7-1.1.dsc
 89e1c1c4533674d9e83a66ef4c75a61a298519c1be32aaf647924e5e0af86eee 19684 fluidsynth_2.1.7-1.1.debian.tar.xz
 2a6af3b9256b1e9a610c17cd2e3c28a057236b3f0f925998c9c22726855c9df9 12756 fluidsynth_2.1.7-1.1_amd64.buildinfo
Files:
 06b3ceca66d7d6de652498ae5263ec6b 2489 sound optional fluidsynth_2.1.7-1.1.dsc
 acf1c02cafb87e71f6775425e76bba33 19684 sound optional fluidsynth_2.1.7-1.1.debian.tar.xz
 7187352660a48b6dbb68460572f29c25 12756 sound optional fluidsynth_2.1.7-1.1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEbJ0QSEqa5Mw4X3xxgj6WdgbDS5YFAmCEDa0ACgkQgj6WdgbD
S5ar1g//Wj4qNqufKBJsDvxqldFlal0L532ZW3DybgVYzw9LBfcfaihtbVhE6+wW
cGBx1EJd5vhtv2CG/Qt4FtIr5rH7Nk5vkXwJO4ly2Ivb2y6xwIYEkPkIgZ12Jez3
XlGfjSi9QRFXWs+mFnYE+KArTHZhIAh9yp4FI8X8ac4JTkDI7N4JQ3C5vV1hBCJ5
wvGcV31GJb6VhPA9fqSaWXYN5MiFFJbI9WInTL587ipZNQgmKAcVBG5+aADopnNN
qke2UpiQQSdCtn+j+P6/cqXN5VBAcf82JKbCMuOrxOBTJQ29kslInFtnaZFBh50I
rmarHii7PVPDkXqeqxPUuKBO63v4DG8mhgAnvCjlVEJ2wDfnufWJhmsKivtrS0vu
owYI/BK95RItOV+4UKlAeIKSGrFNE8w8kDjMoGBI0yKq/vnSoLODhRGTmlc7wJgx
NatpPBh2kLlM7v0130YxpS87eh7I/86EjNnJv91931uEGC7e8NZQurQDRl/IOUwo
c40K0uAhlu1BssA7BsA2EZYadcK48yZBXwI+GTZqjnCXL8CQB8a+oDtEX3XOyygV
9n+iu/D9not68YzzABcSv2UCIozoJw3kwKVhOBvgqaaFcrrbSMgido91WigkQTl4
y1VTgDK2eo3M/b9veVSYh3P/HdJ/5EBwQ12VaKWphFW5i7poTU0=
=PuQ4
-----END PGP SIGNATURE-----

Message #31 received at 987168-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 987168-close@bugs.debian.org

Subject: Bug#987168: fixed in fluidsynth 1.1.11-1+deb10u1

Date: Mon, 03 May 2021 18:17:08 +0000

Source: fluidsynth
Source-Version: 1.1.11-1+deb10u1
Done: Reiner Herrmann <reiner@reiner-h.de>

We believe that the bug you reported is fixed in the latest version of
fluidsynth, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 987168@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Reiner Herrmann <reiner@reiner-h.de> (supplier of updated fluidsynth package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sat, 24 Apr 2021 18:46:20 +0200
Source: fluidsynth
Binary: fluidsynth fluidsynth-dbgsym libfluidsynth-dev libfluidsynth1 libfluidsynth1-dbgsym
Architecture: source amd64
Version: 1.1.11-1+deb10u1
Distribution: buster
Urgency: medium
Maintainer: Debian Multimedia Maintainers <debian-multimedia@lists.debian.org>
Changed-By: Reiner Herrmann <reiner@reiner-h.de>
Description:
 fluidsynth - Real-time MIDI software synthesizer
 libfluidsynth-dev - Real-time MIDI software synthesizer (development files)
 libfluidsynth1 - Real-time MIDI software synthesizer (runtime library)
Closes: 987168
Changes:
 fluidsynth (1.1.11-1+deb10u1) buster; urgency=medium
 .
   * Non-maintainer upload.
   * Backport fix for use-after-free vulnerability. (CVE-2021-28421)
     (Closes: #987168)
Checksums-Sha1:
 415d2ae898416ff2d24717dbdf967a223b124f98 2377 fluidsynth_1.1.11-1+deb10u1.dsc
 e86a98b7a09d60e29edcb10f87da6433b2d0c485 634566 fluidsynth_1.1.11.orig.tar.gz
 323dca1c57b9fb93455c1bdd8cae04bbecae61c7 14596 fluidsynth_1.1.11-1+deb10u1.debian.tar.xz
 2e03e367352b608ae5ca74de8c4c509a5debf6b0 21324 fluidsynth-dbgsym_1.1.11-1+deb10u1_amd64.deb
 b88aa31a0bfc20a803d9903b090f3fbd37beb063 9777 fluidsynth_1.1.11-1+deb10u1_amd64.buildinfo
 8b00257861b50f6d3ff9634f7736acc522b99665 50396 fluidsynth_1.1.11-1+deb10u1_amd64.deb
 0095ba0371a6c217dbe1941e4abcc8eb260b08be 48912 libfluidsynth-dev_1.1.11-1+deb10u1_amd64.deb
 2407e01ea0be418f5cd00223c8c7665a529dd339 508596 libfluidsynth1-dbgsym_1.1.11-1+deb10u1_amd64.deb
 8e56d77e9a7ffff12e3ee6336a1a82568d7ee752 167192 libfluidsynth1_1.1.11-1+deb10u1_amd64.deb
Checksums-Sha256:
 f9e1902e05e468ec439721d673f7543552ea4435ee241dcc53f083e29c566012 2377 fluidsynth_1.1.11-1+deb10u1.dsc
 da8878ff374d12392eecf87e96bad8711b8e76a154c25a571dd8614d1af80de8 634566 fluidsynth_1.1.11.orig.tar.gz
 db60ca3efe75b278992ca1d4231f9c67ab5647d019c9c43f1fb05cd6a70095e2 14596 fluidsynth_1.1.11-1+deb10u1.debian.tar.xz
 541f4582d72f980f9509151908cdee8fb615cb5c7a00645909c591298995d468 21324 fluidsynth-dbgsym_1.1.11-1+deb10u1_amd64.deb
 e24d31fde540faa476513fa248d40b361e33f7edfac27e132f1e850a8037261d 9777 fluidsynth_1.1.11-1+deb10u1_amd64.buildinfo
 57a7e89d3e7be61550c647e49c633074eaf66b4bada58663de5162178eab5202 50396 fluidsynth_1.1.11-1+deb10u1_amd64.deb
 82e9768eb6a950e7ebebe4a43b7f8aa794b0645c59857ec2d9ec933e1a056b84 48912 libfluidsynth-dev_1.1.11-1+deb10u1_amd64.deb
 7a40261edbe226e39a9915ca04c7934e3e60195cac78130adb878c43ab4fb29e 508596 libfluidsynth1-dbgsym_1.1.11-1+deb10u1_amd64.deb
 31a01aaca1270db9faab319c47a2ed6f667666b501660a2a15fdafd653c89738 167192 libfluidsynth1_1.1.11-1+deb10u1_amd64.deb
Files:
 56f7d93729f3d4bacd2035bc1b613673 2377 sound optional fluidsynth_1.1.11-1+deb10u1.dsc
 1d84d844b2f76df2292f31e7263d00db 634566 sound optional fluidsynth_1.1.11.orig.tar.gz
 2c616186ac85fdefdcc6fd8f0cd9b5d7 14596 sound optional fluidsynth_1.1.11-1+deb10u1.debian.tar.xz
 200323fb285e0e7788c739e9a8d0e574 21324 debug optional fluidsynth-dbgsym_1.1.11-1+deb10u1_amd64.deb
 78395b0be0cc3666ef56e5b9dc680305 9777 sound optional fluidsynth_1.1.11-1+deb10u1_amd64.buildinfo
 3b40c0e560572ecd14793d22463f423b 50396 sound optional fluidsynth_1.1.11-1+deb10u1_amd64.deb
 980867708023bb11b28122ff4588e50f 48912 libdevel optional libfluidsynth-dev_1.1.11-1+deb10u1_amd64.deb
 263b28cd097bafc51fd393dc6f83c4cf 508596 debug optional libfluidsynth1-dbgsym_1.1.11-1+deb10u1_amd64.deb
 7893f14af6e41ed2e22a3d445982cf08 167192 libs optional libfluidsynth1_1.1.11-1+deb10u1_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEbJ0QSEqa5Mw4X3xxgj6WdgbDS5YFAmCEVBEACgkQgj6WdgbD
S5ZlOxAAwZRqGjiqP6Swd1Tnk+8X8iEIx2oCRLl4+8xl5L4nqTgd3S0J4UPgSJsH
8jqS+z/sKk0sj0soemtc2WdlewoS53BZ08N0kQzQlNl96uxl+UoQ7mWgJvPHrBS2
bEy2elImvawODrWEDCu8IKDFODz6NYbIXINWi3TE+/YwJxAA+JfVAT9+9UYyXXXM
hxVfCpRCAzEpVKYarjnh7vI3tC//u7l25S2kvfm+BKZPscEgpDw/SpGutbn/rXV+
5EXIjgNXUlZMdZrwXmzLAPxhVYBzWsp81c5RobaaRzUIgrmar7tUm//evN26UXNA
0ikKifO5Vao/fomhOCuISSyQsOpQWPZU+qe+ritvYRGPx8w8jwyxYRxPvqOWkBIC
V9vo0FT60IfyDHWt3Lc7ctCjeXtaJ13HIa4HRKQNMspQDYyS1F4cJBDTFC8y8Ipy
MI77uDRU/WB5WzO71WbIYRdSZGxdL2+H17hmdIdfC9iwuqtfEWHFaOj15dDk5hPI
c2YTSkbO/Vsn1//oa3Nw+n0yEdarL1eoBAQ79U5tziljtyrFRpyi+KqoLmJzRC1a
WB68AXhl6NFCuspuK3gKv6HEM7nBf3ZWQJ9p5d0z8yF7I9oeDeAiPqHztSxK2GJJ
2/gcqgyt8zu6utsadDJAqu8sekC+pFw4R5yVWGhLXqxXi7OTBkE=
=MxkE
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.