Bug#1116070: lib-sieve segfaults

[Alexander Gerasiov]

Package: dovecot-sieve
Version: 1:2.4.1+dfsg1-6
Severity: important
Tags: patch upstream
X-Debbugs-Cc: a...@gerasiov.net

Hi there.


Just upgraded to trixie and found that there are several cases when
dovecot segfaults in lib-sieve.

1. In managesieved, when checking script syntax
2. In lda, when something goes wrong (may be compiled version of the
script is absent?)
3. In imapd, when moving mails, that trigers sieve script execution.

As the first scenario is the simplest one, I traced it and found an error
in error handling in lib-sieve. After fixing it all 3 problems goes
away.

I belive this problem should be classified as important:
1. possible (in rare scenarios when coredumps are enabled) DoS.
2. Some very common setup could be broken after bookworm->trixie
upgrade.

Upstream report and patch:
https://github.com/dovecot/pigeonhole/pull/17


Cheers.

-- Package-specific info:

dovecot configuration
---------------------
# 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf
# Pigeonhole version 2.4.1-4 (0a86619f)
# OS: Linux 6.12.43+deb13-cloud-amd64 x86_64 Debian 13.1 
# Hostname: mail
# 4 default setting changes since version 2.4.0
dovecot_config_version = 2.4.0
auth_username_format = %{user|username|lower}
dovecot_storage_version = 2.4.0
fts_autoindex = yes
fts_autoindex_max_recent_msgs = 999
fts_search_add_missing = yes
lda_mailbox_autosubscribe = yes
mail_driver = maildir
mail_path = ~/Maildir
protocols {
  imap = yes
  sieve = yes
}
sieve_extensions {
  fileinto = yes
  reject = yes
  envelope = yes
  encoded-character = yes
  vacation = yes
  subaddress = yes
  comparator-i;ascii-numeric = yes
  relational = yes
  regex = yes
  imap4flags = yes
  copy = yes
  include = yes
  body = yes
  variables = yes
  enotify = yes
  environment = yes
  mailbox = yes
  date = yes
  index = yes
  ihave = yes
  duplicate = yes
  mime = yes
  foreverypart = yes
  extracttext = yes
  vnd.dovecot.debug = yes
}
sieve_global_extensions {
  vnd.dovecot.pipe = yes
  vnd.dovecot.environment = yes
}
sieve_pipe_bin_dir = /var/lib/dovecot/sieve-pipe
sieve_plugins = sieve_imapsieve sieve_extprograms
passdb pam {
}
userdb passwd {
}
passdb passwd-file {
  auth_username_format = %{user}
  default_password_scheme = plain
  passwd_file_path = /etc/dovecot/private/users
}
userdb passwd-file {
  auth_username_format = %{user}
  passwd_file_path = /etc/dovecot/private/users
}
namespace inbox {
  inbox = yes
  mailbox Drafts {
    auto = subscribe
    special_use = "\\Drafts"
  }
  mailbox Junk {
    auto = subscribe
    autoexpunge = 30d
    special_use = "\\Junk"
  }
  mailbox Trash {
    auto = subscribe
    autoexpunge = 30d
    special_use = "\\Trash"
  }
  mailbox Sent {
    auto = subscribe
    special_use = "\\Sent"
  }
  mailbox "Sent Messages" {
    special_use = "\\Sent"
  }
}
service imap-login {
  inet_listener imap {
  }
  inet_listener imaps {
  }
}
service pop3-login {
  inet_listener pop3 {
  }
  inet_listener pop3s {
  }
}
service submission-login {
  inet_listener submission {
  }
  inet_listener submissions {
  }
}
service lmtp {
  unix_listener lmtp {
  }
}
service imap {
}
service pop3 {
}
service submission {
}
service auth {
  unix_listener auth-userdb {
  }
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0660
    user = postfix
  }
}
service auth-worker {
}
service dict {
  unix_listener dict {
  }
}
ssl_server {
  cert_file = /etc/dovecot/private/dovecot.pem
  key_file = /etc/dovecot/private/dovecot.key
}
protocol lda {
  mail_plugins {
    sieve = yes
  }
}
service managesieve-login {
  inet_listener sieve {
    port = 4190
  }
  inet_listener sieve_deprecated {
    port = 2000
  }
}
service managesieve {
}
sieve_script personal {
  active_path = ~/Maildir/dovecot.sieve
  driver = file
  path = ~/Maildir/sieve
}
sieve_script default {
  driver = file
  name = ServerDefault
  path = /var/lib/dovecot/sieve/default.sieve
  type = default
}
sieve_script global {
  driver = file
  path = /var/lib/dovecot/sieve
  type = global
}
mailbox Junk {
  sieve_script report-spam {
    cause = copy
    path = /var/lib/dovecot/sieve/report-spam.sieve
    type = before
  }
}
imapsieve_from Junk {
  sieve_script report-ham {
    cause = copy
    path = /var/lib/dovecot/sieve/report-ham.sieve
    type = before
  }
}

-- System Information:
Debian Release: 13.1
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 
'stable-debug'), (500, 'proposed-updates-debug'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.12.43+deb13-cloud-amd64 (SMP w/2 CPU threads; PREEMPT)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages dovecot-sieve depends on:
ii  dovecot-core  1:2.4.1+dfsg1-6
ii  libc6         2.41-12
ii  libldap2      2.6.10+dfsg-1
ii  ucf           3.0052

dovecot-sieve recommends no packages.

dovecot-sieve suggests no packages.

Versions of packages dovecot-sieve is related to:
ii  dovecot-core [dovecot-common]  1:2.4.1+dfsg1-6
pn  dovecot-dev                    <none>
pn  dovecot-gssapi                 <none>
ii  dovecot-imapd                  1:2.4.1+dfsg1-6
pn  dovecot-ldap                   <none>
pn  dovecot-lmtpd                  <none>
ii  dovecot-managesieved           1:2.4.1+dfsg1-6
pn  dovecot-mysql                  <none>
pn  dovecot-pgsql                  <none>
pn  dovecot-pop3d                  <none>
ii  dovecot-sieve                  1:2.4.1+dfsg1-6
pn  dovecot-sqlite                 <none>

-- no debconf information