Package: release.debian.org
User: [email protected]
Usertags: transition
Dear Release Team,
I would like to request a transition slot for libcec, which I just
dput.
Upstream 8.1.6 bumps SONAME from libcec.so.7 to libcec.so.8, so shared
library package is renamed libcec7 -> libcec8. No API changes that
affect the reverse dependencies. (The ABI change is just the addition
of three fields at the end of libcec_configuration.)
unstable now: libcec 7.1.1-2 (libcec7)
to be uploaded: libcec 8.1.6+dfsg-1 (libcec8)
Reverse dependencies of libcec7, and what they need:
kodi (kodi-bin)
vdr-plugin-xineliboutput (xineliboutput-fbfe, xineliboutput-sxfe,
xineliboutput-wlfe)
Both need only a binNMU. The development package is libcec-dev,
unversioned.
Notes:
* This has to clear NEW before the transition can start. It introduces
libcec8, and also new binary packages for rust and nodejs bindings.
* Upstream fixed a handful of buffer overflows in 8.0.0, and 7.1.1-2
in the archive still has them. No CVEs have been assigned, there is no
entry for src:libcec in the security tracker, and I am not requesting
that this be handled as a security upload. But still...
The four (4) security issues are:
1. CCECCommandHandler::HandleSetOSDName copies the whole CEC
datapacket into a 17-byte stack buffer with no bound. A datapacket
is up to 64 bytes, so any device on the HDMI bus can overflow it
by about 47 attacker-chosen bytes by sending a long SET_OSD_NAME.
This is reachable in kodi-bin. Fixed in upstream commit f65762b9.
The rest need either a hostile/broken display or a hostile USB adapter:
2. CUSBCECAdapterCommands::RequestSetting memcpy()s a reply length
taken from the adapter into a fixed cec_datapacket. Fixed in
upstream commit 16c1e13d.
3. The EDID readers (nvidia, drm) read an unbounded fgetc loop into a
4096-byte buffer, and the shared parser underflows (size - 4) for
sizes 1..4 and reads out of bounds. EDID comes from the connected
display via sysfs/procfs. Fixed in upstream commit 94e37582.
4. String copy sizes in the cecc-client example, upstream issue #708.
Fixed in upstream commit 01769988.
Ben file:
title = "libcec";
is_affected = .depends ~ "libcec7" | .depends ~ "libcec8";
is_good = .depends ~ "libcec8";
is_bad = .depends ~ "libcec7";
Cheers,
--Barak
