Bugzilla – Bug 1216199
VUL-0: CVE-2023-5557: tracker-miners: sandbox escape
Last modified: 2024-02-21 08:22:43 UTC
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-5557 https://access.redhat.com/security/cve/CVE-2023-5557
further references: https://bugzilla.redhat.com/show_bug.cgi?id=2243096 https://github.blog/2023-10-09-coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641/#tracker-miners-seccomp-sandbox-escape https://gitlab.gnome.org/GNOME/tracker-miners/-/issues/277 https://gitlab.gnome.org/GNOME/tracker-miners/-/merge_requests/480
FTR: RH bug states that 3.2.2 is fixed, this is incorrect. > tag 3.2.2 > Tagger: Carlos Garnacho <carlosg@gnome.org> > Date: Sun Mar 6 23:27:49 2022 +0100 > > Release 3.2.2
I'll handle this, thanks.
https://build.opensuse.org/request/show/1132037 For GNOME:STABLE:41 GNOME:STALE:3.34 needs more time because it needs to backport from Tracker3 to Tracker2, that requires a lot of file and interface change.
https://build.opensuse.org/request/show/1132039 For GNOME:STABLE:41
Hi security team, While this bug is easy to fix on SLE-15-SP4, it is hard to deal with on SLE-15-SP2. That is because we have Tracker 2 in SLE-15-SP2 and Tracker 3 in SLE-15-SP4. The fix itself is generally moving all file system related operations out of the sandboxed process and do them in the miner daemon via DBus requests, so all fs related syscalls could be blocked by the sandbox. From Tracker 2 to Tracker 3 a lot of files changed, to achieve this in current version of our tracker-miners package, I already create a patch with more than 3000 lines, and things are still not finised yet, the dbus object we need in miners for sparql does not exist in current version of our tracker package, it will be hard to maintain thousands lines of patches in two packages. And for this bug itself, the origin is because CVE-2023-43641 in libcue, I found that we don't have fix for libcue yet, it's a 1-line fix (<https://github.com/lipnitsk/libcue/commit/fdf72c8bded8d24cfa0608b8e97f2eed210a920e>), so I think maybe we should fix libcue first. I really want to hear your opinion on this, we need to fix libcue first, then I doubt is it worthy to introduce such big changes to tracker and tracker-miners.
(In reply to Alynx Zhou from comment #12) > And for this bug itself, the origin is because CVE-2023-43641 in libcue, I > found that we don't have fix for libcue yet, it's a 1-line fix > (<https://github.com/lipnitsk/libcue/commit/ > fdf72c8bded8d24cfa0608b8e97f2eed210a920e>), so I think maybe we should fix > libcue first. The libcue CVE is bsc#1215728. I submitted a fix for SUSE:SLE-15:Update a while ago. The version in factory already has the fix. Let me know if anything else is missing.
After create 2 patches with nearly 4200 lines, it still doesn't work correctly on my Leap 15.2. Nearly all things changed between Tracker 2 and Tracker 3, library interfaces are renamed, source files are moved, and DBus interface is different, I think it is not worthy to do such a big change to Tracker 2.
(In reply to Michael Gorse from comment #13) > The libcue CVE is bsc#1215728. I submitted a fix for SUSE:SLE-15:Update a > while ago. The version in factory already has the fix. Let me know if > anything else is missing. Great, thanks!
SUSE-SU-2023:4868-1: An update that solves one vulnerability and contains one feature can now be installed. Category: security (important) Bug References: 1216199 CVE References: CVE-2023-5557 Jira References: PED-6193 Sources used: openSUSE Leap 15.4 (src): tracker-miners-3.2.2-150400.3.7.1 openSUSE Leap 15.5 (src): tracker-miners-3.2.2-150400.3.7.1 Desktop Applications Module 15-SP4 (src): tracker-miners-3.2.2-150400.3.7.1 Desktop Applications Module 15-SP5 (src): tracker-miners-3.2.2-150400.3.7.1 SUSE Linux Enterprise Workstation Extension 15 SP4 (src): tracker-miners-3.2.2-150400.3.7.1 SUSE Linux Enterprise Workstation Extension 15 SP5 (src): tracker-miners-3.2.2-150400.3.7.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
This is an autogenerated message for OBS integration: This bug (1216199) was mentioned in https://build.opensuse.org/request/show/1138128 Factory / tracker-miners
Assign back to security team, finished fixing from GNOME side.