https://bugs.kde.org/show_bug.cgi?id=524522

Vladi <[email protected]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[email protected]

--- Comment #4 from Vladi <[email protected]> ---
I can confirm this bug on Arch Linux with ksecretd 6.29.0, same backtrace.
Summary:
ksecretd crashes with SIGSEGV when encrypting a secret over a DH-AES Secret
Service session. The crash is deterministic and reproducible, but only in the
first instance of ksecretd started by SDDM with --pam-login. After the crash,
when ksecretd is automatically restarted (without --pam-login), the crash never
reproduces again for the rest of the session, regardless of how many times the
same secret is requested.
The practical impact is that the wallet gets locked after the crash (the
restarted instance has no PAM credentials), causing all subsequent secret
requests to prompt for a password — effectively breaking auto-unlock on login.

Steps to Reproduce:
Log in via SDDM (Plasma Wayland). ksecretd is started by PAM with --pam-login
<fd> <fd>.
Wait for the session to fully load.
Launch Bitwarden Desktop (or possibly any application that reads a secret via
the Secret Service API using a DH-AES session).
Bitwarden calls GetSecret on a Secret Service item.

Observed Result:
ksecretd crashes with SIGSEGV inside EVP_CIPHER_CTX_set_key_length (libcrypto).
The crash occurs during KWalletFreedesktopSessionAlgorithmDhAes::encrypt →
QCA::Cipher::setup → QCA OpenSSL plugin → OpenSSL.
After the crash, D-Bus activates a new ksecretd instance without --pam-login.
This new instance reports:
ksecretd: Lacking a socket, pipe: 0 env: 0
The wallet is now locked, and all applications prompt for the wallet password.

Versions
kwallet 6.29.0-1
qca-qt6 2.3.10-8
openssl 3.6.3-1
Plasma 6, Wayland session
Arch Linux (EndeavourOS)

Backtrace (gdb, with debug symbols):
Thread 1 "ksecretd" received signal SIGSEGV, Segmentation fault.
#0  EVP_CIPHER_CTX_set_key_length () from /usr/lib/libcrypto.so.3
#1  ?? () from /usr/lib/qt6/plugins/crypto/libqca-ossl.so
#2  QCA::Cipher::setup(QCA::Direction, QCA::SymmetricKey const&,
QCA::InitializationVector const&) ()
#3  QCA::Cipher::Cipher(...) ()
#4  KWalletFreedesktopSessionAlgorithmDhAes::encrypt (this=0x..., secret=...)
#5  KWalletFreedesktopSession::encrypt (...)
    at kwallet-6.29.0/src/runtime/ksecretd/kwalletfreedesktopsession.cpp:78
#6  KWalletFreedesktopSession::encrypt (...)
    at kwallet-6.29.0/src/runtime/ksecretd/kwalletfreedesktopsession.cpp:72
#7  KWalletFreedesktopService::ensecret (...)
    at kwallet-6.29.0/src/runtime/ksecretd/kwalletfreedesktopservice.cpp:580
#8  KWalletFreedesktopItem::getSecret (...)
    at kwallet-6.29.0/src/runtime/ksecretd/kwalletfreedesktopitem.cpp:146
#9  KWalletFreedesktopItem::GetSecret (...)
    at kwallet-6.29.0/src/runtime/ksecretd/kwalletfreedesktopitem.cpp:156
...
#28 main (...) at kwallet-6.29.0/src/runtime/ksecretd/main.cpp:211

Registers at crash:
rax  0x0
rcx  0x0
rdx  0x0
rsi  0x10          (keylen = 16, i.e. AES-128)
rdi  0x7f45c0011290 (EVP_CIPHER_CTX*)
rip  EVP_CIPHER_CTX_set_key_length+40

I also have another computer with very similar envirinment - Ryzen 5
2500U-based laptop - no crash on it with neraly identical software setup.

Desktop (crashes)             Laptop (works)
CPU
Intel i3-AMD Ryzen 5 2500U
kwallet
6.29.0-6.29.0-qca-qt2.3.10-2.3.10-openssl
3.6.3-3.6.3-ksecretd cmdline
--pam-login 12 --pam-login 12 Session
Plasma Wayland
Plasma Wayland
Crash
Yes
No

-- 
You are receiving this mail because:
You are watching all bug changes.

Reply via email to