Disable greeters from loading KDE's debug hander

Bug #1511286 reported by Philip Muškovac
260
This bug affects 2 people
Affects Status Importance Assigned to Milestone
sddm (Debian)
Fix Released
Unknown
sddm (Gentoo Linux)
Unknown
Unknown
sddm (Ubuntu)
Fix Released
Low
Philip Muškovac
Wily
Confirmed
Low
Unassigned

Bug Description

Some themes may use KDE components which will automatically load KDE's
crash handler.

If the greeter were to then somehow crash, that would leave a crash
handler allowing other actions, albeit as the locked down SDDM user.

Only SDDM users using the breeze theme from plasma-workspace are
affected. Safest and simplest fix is to handle this inside SDDM
disabling kcrash via an environment variable for all future themes that
may use these libraries.

See https://github.com/sddm/sddm/commit/4cfed6b0a625593

ProblemType: Bug
DistroRelease: Ubuntu 15.10
Package: sddm 0.11.0-0ubuntu11
ProcVersionSignature: Ubuntu 4.2.0-17.21-generic 4.2.3
Uname: Linux 4.2.0-17-generic x86_64
ApportVersion: 2.19.1-0ubuntu4
Architecture: amd64
Date: Thu Oct 29 10:28:55 2015
EcryptfsInUse: Yes
InstallationDate: Installed on 2015-07-26 (94 days ago)
InstallationMedia: Kubuntu 15.04 "Vivid Vervet" - Release amd64 (20150422)
SourcePackage: sddm
UpgradeStatus: No upgrade log present (probably fresh install)

CVE References

Revision history for this message
Philip Muškovac (yofel) wrote :
Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

Changed in sddm (Ubuntu):
status: New → Incomplete
Philip Muškovac (yofel)
Changed in sddm (Ubuntu):
assignee: nobody → Philip Muškovac (yofel)
Changed in sddm (Ubuntu):
status: Incomplete → Confirmed
Changed in sddm (Ubuntu):
importance: Undecided → Low
tags: added: vivid xenial
Changed in sddm (Debian):
status: Unknown → Fix Released
Philip Muškovac (yofel)
Changed in sddm (Ubuntu Wily):
importance: Undecided → Low
assignee: nobody → Philip Muškovac (yofel)
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (3.9 KiB)

This bug was fixed in the package sddm - 0.13.0-1ubuntu1

---------------
sddm (0.13.0-1ubuntu1) xenial; urgency=medium

  * Merge with debian unstable (LP: #1519564, #1516837, #1511286)
    remaining changes:
    - keep the default-display-manager file logic in sddm.postinst
    - keep kubuntu specific patches:
      + kubuntu_nvidia-prime.diff
      + kubuntu_minimum_vt.diff instead of 03_vt7-minimum-vt.diff

sddm (0.13.0-1) unstable; urgency=medium

  * Team Upload
  [ Diane Trout ]
  * New upstream release.
  * Remove CVE-2015-0856.patch applied upstream.
  * Refresh patches.
  * Build man pages
    - Add python-docutils to Build-Depends
    - Add built man pages to sddm.install

  [ Scott Kitterman ]
  * Add missing debian/changelog entry from previous revision
  * Apply sddm.pam.diff (provided by Alf Gaida - Thanks!) and add
    libpam-systemd to sddm Recommends to fix session problems while using
    systemd while still allowing non-systemd installations (Closes: #799837,
    #806758)

sddm (0.12.0-5) unstable; urgency=medium

  * Team upload.

  [ Maximiliano Curia ]
  * Delete the sddm.log file on purge. (Closes: #793679)
  * The themes shipped with sddm need the latest version, using breaks
    instead of depends to avoid circular deps. (Closes: #800462) Thanks
    to Max Görner

  [ Matthias Klumpp ]
  * Fix deadlock in sddm.service when waiting for Plymouth to quit

  [ Scott Kitterman ]
  * Add debian/patches/CVE-2015-0856.patch to fix potential issue if an SDDM
    theme crashes while running the KDE debug handler (Closes: #803338)

sddm (0.12.0-4) unstable; urgency=medium

  * Fix indep build. (Closes: #799142) Thanks to Boris Pek

sddm (0.12.0-3) unstable; urgency=medium

  * Update service file, run after plymouth-quit-wait.
  * Re add patch: 04_set_default_path.diff

sddm (0.12.0-2) unstable; urgency=medium

  * Team upload
  * Ensure SDDM waits for Plymouth and getty to quit before starting
    (Closes: #793637)
  * Drop some unnecessary patches
  * Suggest libpam-kwallet5 instead of pam-kwallet5

sddm (0.12.0-1) unstable; urgency=medium

  * Team upload
  * New upstream release: 0.12.0
  * Drop patches which are applied upstream
  * Refresh and reorganize remaining patches
  * debian/rules: Compile with DBUS_CONFIG_FILENAME set to non-conflicting name
  * Ensure Xsession script is marked as executable
  * Don't fail when purging sddm

sddm (0.11.0-4) unstable; urgency=medium

  [ Scott Kitterman ]
  * Team upload.
  * Add Provides: x-display-manager for sddm (Closes: 795006)

  [ Maximiliano Curia ]
  * Add the Xsession script. (Closes: #794419)
  * New patch: default_path

sddm (0.11.0-3) unstable; urgency=medium

  * Transition to libsystemd-dev. (Closes: #792400) Thanks to Michael
    Biebl
  * New patch: libsystemd.diff
  * Fix systemctl path. (Closes: #792401) Thanks to Michael Biebl
  * New patch: sddm_systemctl.diff
  * Update debian/po files. (Closes: #792085) Thanks to Christian
    Perrier

sddm (0.11.0-2) unstable; urgency=medium

  [ Maximiliano Curia ]
  * Re-enable patches kubuntu_use_breeze.diff, kubuntu_minimum_vt.diff,
    upstream_add-graphical.target.diff.
  * Re-enable libpam-gnome-keyring.

  [ Pino To...

Read more...

Changed in sddm (Ubuntu):
status: Confirmed → Fix Released
Changed in sddm (Ubuntu Wily):
status: New → Confirmed
tags: added: bitesize
Philip Muškovac (yofel)
Changed in sddm (Ubuntu Wily):
assignee: Philip Muškovac (yofel) → nobody
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.