** Description changed: + SRU Justification: + + [ Impact ] + + * When running on systems with newer IBM CCA host library or firmware versions, the `zkey` utility fails with an error message such as: + `zkey: CCA library version is invalid: <version>` + + * Cause: `zkey` parses the CCA version string returned by CCA host verbs + (`CSUACFV` / `CSUACFQ` with keyword `STATCCA`) expecting a strict + delimiter character 'z' after the version number (e.g. `%u.%u.%uz%s`). + Newer CCA host library versions use different indicator characters or + formats without 'z', causing `sscanf()` to fail. + + [ Fix ] + + * Fix: Upstream patch `33fc534a81b7c163936064c96f1fb902255f7ff1` adjusts + `zkey/cca.c` to parse version strings using `%u.%u.%u`, ignoring + trailing non-numeric indicator characters and suffixes, as only the + major, minor, and modification numbers are required. + + [ Test Plan ] + + * Requirements: An s390x system (LPAR or z/VM) with an active CEX + adapter in CCA coprocessor mode and the CCA host library installed. + + 1. Generate a test secure key file using `zkey`: + `zkey generate seckey.bin` + + 2. Run a `zkey` command that invokes CCA host library version detection, for example: + `zkey reencipher seckey.bin --to-new --output seckey2.bin` + (or `zkey validate seckey.bin`) + + 3. Verification (unpatched): With the current `s390-tools-zkey` package, step 2 fails with: + `zkey: CCA library version is invalid: <version>` + + 4. Verification (patched): Install the updated `s390-tools-zkey` package from proposed/PPA and re-run step 2: + `zkey reencipher seckey.bin --to-new --output seckey2.bin` + The command successfully detects the CCA host library version without error and completes the key re-encipher operation. + + [ Where problems could occur ] + + * The scope of this change is strictly limited to CCA version string + parsing in `zkey/cca.c` (`get_cca_version` and + `get_cca_adapter_version`). + + * If the new `%u.%u.%u` pattern fails to parse a CCA version string + (e.g., if a library returns a version string with fewer than three + integer components), `zkey` would fail to detect the version and return + `-EINVAL`, identical to the failure mode prior to this patch. + + * No other `s390-tools` utilities (such as `zipl`, `dasdfmt`, `chzdev`) + interact with this function or code path, so potential regressions are + restricted strictly to `zkey` operations using the CCA host library. + + [ Other Info ] + + * Included in s390-tools >= 2.38.0 (hence incl. in Resolute/26.04). + * Target SRU releases: Jammy (22.04 LTS) and Noble (24.04 LTS). + * Test build: https://launchpad.net/~fheimes/+archive/ubuntu/s390-tools + __________ + Description: zkey: Fix CCA host version detection for newer CCA versions - Symptom: The zkey tool fails with an error message like 'zkey: CCA - library version is invalid: <version>' when using newer CCA - host library versions. + Symptom: The zkey tool fails with an error message like 'zkey: CCA + library version is invalid: <version>' when using newer CCA + host library versions. Problem: The zkey tool parses the version string returned by CCA verbs - CSUACFV and CSUACFQ with keyword STATCCA and expects the - delimiter character 'z' at the end of the version string. - Newer CCA versions use different delimiter characters and thus - parsing the version string fails. + CSUACFV and CSUACFQ with keyword STATCCA and expects the + delimiter character 'z' at the end of the version string. + Newer CCA versions use different delimiter characters and thus + parsing the version string fails. Reproduction: Use a zkey command that requires the CCA host library, e.g. - 'zkey reencipher seckey.bin --to-new --output seckey2.bin'. + 'zkey reencipher seckey.bin --to-new --output seckey2.bin'. Solution: Fix the parsing code to allow any delimiter character. Upstream-ID: 33fc534a81b7c163936064c96f1fb902255f7ff1
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2163182 Title: [UBUNTU 22.04] zkey: Fix CCA host version detection for newer CCA versions (s390-tools) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-z-systems/+bug/2163182/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
