https://bugs.kde.org/show_bug.cgi?id=524522
Vladi <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |[email protected] --- Comment #4 from Vladi <[email protected]> --- I can confirm this bug on Arch Linux with ksecretd 6.29.0, same backtrace. Summary: ksecretd crashes with SIGSEGV when encrypting a secret over a DH-AES Secret Service session. The crash is deterministic and reproducible, but only in the first instance of ksecretd started by SDDM with --pam-login. After the crash, when ksecretd is automatically restarted (without --pam-login), the crash never reproduces again for the rest of the session, regardless of how many times the same secret is requested. The practical impact is that the wallet gets locked after the crash (the restarted instance has no PAM credentials), causing all subsequent secret requests to prompt for a password — effectively breaking auto-unlock on login. Steps to Reproduce: Log in via SDDM (Plasma Wayland). ksecretd is started by PAM with --pam-login <fd> <fd>. Wait for the session to fully load. Launch Bitwarden Desktop (or possibly any application that reads a secret via the Secret Service API using a DH-AES session). Bitwarden calls GetSecret on a Secret Service item. Observed Result: ksecretd crashes with SIGSEGV inside EVP_CIPHER_CTX_set_key_length (libcrypto). The crash occurs during KWalletFreedesktopSessionAlgorithmDhAes::encrypt → QCA::Cipher::setup → QCA OpenSSL plugin → OpenSSL. After the crash, D-Bus activates a new ksecretd instance without --pam-login. This new instance reports: ksecretd: Lacking a socket, pipe: 0 env: 0 The wallet is now locked, and all applications prompt for the wallet password. Versions kwallet 6.29.0-1 qca-qt6 2.3.10-8 openssl 3.6.3-1 Plasma 6, Wayland session Arch Linux (EndeavourOS) Backtrace (gdb, with debug symbols): Thread 1 "ksecretd" received signal SIGSEGV, Segmentation fault. #0 EVP_CIPHER_CTX_set_key_length () from /usr/lib/libcrypto.so.3 #1 ?? () from /usr/lib/qt6/plugins/crypto/libqca-ossl.so #2 QCA::Cipher::setup(QCA::Direction, QCA::SymmetricKey const&, QCA::InitializationVector const&) () #3 QCA::Cipher::Cipher(...) () #4 KWalletFreedesktopSessionAlgorithmDhAes::encrypt (this=0x..., secret=...) #5 KWalletFreedesktopSession::encrypt (...) at kwallet-6.29.0/src/runtime/ksecretd/kwalletfreedesktopsession.cpp:78 #6 KWalletFreedesktopSession::encrypt (...) at kwallet-6.29.0/src/runtime/ksecretd/kwalletfreedesktopsession.cpp:72 #7 KWalletFreedesktopService::ensecret (...) at kwallet-6.29.0/src/runtime/ksecretd/kwalletfreedesktopservice.cpp:580 #8 KWalletFreedesktopItem::getSecret (...) at kwallet-6.29.0/src/runtime/ksecretd/kwalletfreedesktopitem.cpp:146 #9 KWalletFreedesktopItem::GetSecret (...) at kwallet-6.29.0/src/runtime/ksecretd/kwalletfreedesktopitem.cpp:156 ... #28 main (...) at kwallet-6.29.0/src/runtime/ksecretd/main.cpp:211 Registers at crash: rax 0x0 rcx 0x0 rdx 0x0 rsi 0x10 (keylen = 16, i.e. AES-128) rdi 0x7f45c0011290 (EVP_CIPHER_CTX*) rip EVP_CIPHER_CTX_set_key_length+40 I also have another computer with very similar envirinment - Ryzen 5 2500U-based laptop - no crash on it with neraly identical software setup. Desktop (crashes) Laptop (works) CPU Intel i3-AMD Ryzen 5 2500U kwallet 6.29.0-6.29.0-qca-qt2.3.10-2.3.10-openssl 3.6.3-3.6.3-ksecretd cmdline --pam-login 12 --pam-login 12 Session Plasma Wayland Plasma Wayland Crash Yes No -- You are receiving this mail because: You are watching all bug changes.
