Hi Nick and the SRU team, I did the verification of the bug on a fresh noble installation on the machine with the YubiHSM 2 device and with the version of the libengine-pkcs11-openssl (built from the libp11 source) in the noble release pocket, verified the segfault. Then I installed the proposed version of the same package, repeated the same tests and verified that the segfault does not happen and the issue is fixed.
Here is the command and output log from my testing session. ``` guruprasad@precious:~/Downloads/yubihsm2-sdk/work$ bash -x command-0x7cee.txt ++ pwd + cat /home/guruprasad/Downloads/yubihsm2-sdk/work/pkcs11-home/pkcs11/modules/yubihsm2.module module: /usr/lib/x86_64-linux-gnu/pkcs11/yubihsm_pkcs11.so ++ pwd + cat /home/guruprasad/Downloads/yubihsm2-sdk/work/yubihsm_pkcs11.conf connector = http://127.0.0.1:12345 + file keys/leaf.crt keys/leaf.crt: PEM certificate + file test-input.efi test-input.efi: PE32+ executable (EFI application) x86-64 (stripped to external PDB), for MS Windows, 5 sections ++ pwd + XDG_CONFIG_HOME=/home/guruprasad/Downloads/yubihsm2-sdk/work/pkcs11-home ++ pwd + YUBIHSM_PKCS11_CONF=/home/guruprasad/Downloads/yubihsm2-sdk/work/yubihsm_pkcs11.conf + sbsign --engine pkcs11 --key 'pkcs11:id=%7c%ee;type=private;pin-value=0001password' --cert keys/leaf.crt --output /dev/null test-input.efi command-0x7cee.txt: line 16: 6716 Segmentation fault (core dumped) XDG_CONFIG_HOME=$(pwd)/pkcs11-home YUBIHSM_PKCS11_CONF=$(pwd)/yubihsm_pkcs11.conf sbsign --engine pkcs11 --key "pkcs11:id=%7c%ee;type=private;pin-value=0001password" --cert keys/leaf.crt --output /dev/null test-input.efi guruprasad@precious:~/Downloads/yubihsm2-sdk/work$ sudo apt install -t noble-proposed libengine-pkcs11-openssl Reading package lists... Done Building dependency tree... Done Reading state information... Done The following packages will be upgraded: libengine-pkcs11-openssl 1 upgraded, 0 newly installed, 0 to remove and 41 not upgraded. Need to get 33.9 kB of archives. After this operation, 1,024 B of additional disk space will be used. Get:1 http://in.archive.ubuntu.com/ubuntu noble-proposed/universe amd64 libengine-pkcs11-openssl amd64 0.4.12-1.1ubuntu1 [33.9 kB] Fetched 33.9 kB in 1s (32.9 kB/s) (Reading database ... 153125 files and directories currently installed.) Preparing to unpack .../libengine-pkcs11-openssl_0.4.12-1.1ubuntu1_amd64.deb ... Unpacking libengine-pkcs11-openssl:amd64 (0.4.12-1.1ubuntu1) over (0.4.12-1.1build2) ... Setting up libengine-pkcs11-openssl:amd64 (0.4.12-1.1ubuntu1) ... guruprasad@precious:~/Downloads/yubihsm2-sdk/work$ bash -x command-0x7cee.txt ++ pwd + cat /home/guruprasad/Downloads/yubihsm2-sdk/work/pkcs11-home/pkcs11/modules/yubihsm2.module module: /usr/lib/x86_64-linux-gnu/pkcs11/yubihsm_pkcs11.so ++ pwd + cat /home/guruprasad/Downloads/yubihsm2-sdk/work/yubihsm_pkcs11.conf connector = http://127.0.0.1:12345 + file keys/leaf.crt keys/leaf.crt: PEM certificate + file test-input.efi test-input.efi: PE32+ executable (EFI application) x86-64 (stripped to external PDB), for MS Windows, 5 sections ++ pwd + XDG_CONFIG_HOME=/home/guruprasad/Downloads/yubihsm2-sdk/work/pkcs11-home ++ pwd + YUBIHSM_PKCS11_CONF=/home/guruprasad/Downloads/yubihsm2-sdk/work/yubihsm_pkcs11.conf + sbsign --engine pkcs11 --key 'pkcs11:id=%7c%ee;type=private;pin-value=0001password' --cert keys/leaf.crt --output /dev/null test-input.efi Workaround for OpenSSL 3.0.13 30 Jan 2024 enabled Image was already signed; adding additional signature guruprasad@precious:~/Downloads/yubihsm2-sdk/work$ ``` The fix has been verified to work correctly and not segfault with the libengine-pkcs11-openssl binary package (built from the the libp11 source) version 0.4.12-1.1ubuntu1 from the noble proposed pocket. ** Tags removed: patch verification-needed-noble ** Tags added: verification-done-noble -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2158304 Title: [SRU] sbsign (and any tool using the OpenSSL PKCS#11 engine) segfaults when signing via a PKCS#11 token on OpenSSL 3.0.13 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/libp11/+bug/2158304/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
