This bug was fixed in the package bash - 5.2.21-2ubuntu4
---
bash (5.2.21-2ubuntu4) noble; urgency=medium
* No-change rebuild for CVE-2024-3094
-- Steve Langasek Sun, 31 Mar 2024
08:41:03 +
** Changed in: bash (Ubuntu)
Status: New => Fix Released
** CVE added:
I added an sssd task due to the workaround we had to add to it in
https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/2058576 (we don't
install faketime). Should faketime be fixed, then we can revert that
change in sssd.
** Also affects: sssd (Ubuntu)
Importance: Undecided
Status: New
** Changed in: faketime (Ubuntu)
Milestone: None => ubuntu-24.04-beta
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2059078
Title:
proposed-migration for faketime 0.9.10-2.1ubuntu1
To manage
What now remains to be done is to heavily patch faketime to, when on
armhf:
1/ use the proper symbols from glibc (e.g. __clock_gettime64 instead of
__clock_gettime)
2/ expose those symbols instead of the legacy 32-bit ones.
--
You received this bug notification because you are a member of
Oh, hang on. The bash build has apparently been uploaded just a day
after the t64 gcc, which means gcc was presumably still building when
the bash build started:
gcc-13 armhf 13.2.0-13ubuntu1 (from the bash build logs)
A bash rebuild should "fix" this somewhat. Well, at least a little bit.
**
The failure is because bash, for some reason, still links against
gettimeofday rather than __gettimeofday64, and calls that to seed its
internal random number generator. I still can't figure out why it's
using the old version, though.
ubuntu@noble-armhf:~$ readelf -W -s a.out | grep timeof # a
Unsurprisingly, there are some symbol differences.
# diff -u <(objdump -T /usr/lib/arm-linux-gnueabihf/faketime/libfaketime.so.1 |
grep '\.text' | cut -b34- | sort -u) <(objdump -T ./src/libfaketime.so.1 | grep
'\.text' | cut -b34- | sort -u)@@ -1,50 +1,51 @@
Base__clock_gettime
+Base
** Description changed:
- faketime 0.9.10-2.1ubuntu1 is stuck in -proposed.
+ faketime 0.9.10-2.1ubuntu1 is stuck in -proposed with build failures on
+ armhf.
+
+ On armhf, the testsuite confusingly fails with a stack smash error. But
+ this error happens in bash, which isn't even meant to be
