Bug#887860: tracker-extract: repeated SIGSYS in execve()

[Mike Kupfer]

Package: tracker-extract
Version: 1.10.5-1
Severity: normal

Dear Maintainer,

Every few days I find a core file in $HOME. file(1) tells me they're
coming from tracker-extract. I've taken a quick look at a couple with
gdb, and (IIRC), gdb has said each time that tracker-extract died with
SIGSYS in execve().

I haven't been able to determine if a particular file is causing the
crashes or if it's a more general problem.

Today I finally got around to getting a stack trace:

alto$ ls -l core
-rw------- 1 kupfer kupfer 192376832 Jan 20 07:29 core
alto$ file core
core: ELF 64-bit LSB core file x86-64, version 1 (SYSV), SVR4-style, from '/usr/lib/tracker/tracker-extract', real uid: 1000, effective uid: 1000, real gid: 1000, effective gid: 1000, execfn: '/usr/lib/tracker/tracker-extract', platform: 'x86_64'
alto$ gdb /usr/lib/tracker/tracker-extract core
GNU gdb (Debian 7.12-6) 7.12.0.20161007-git
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/lib/tracker/tracker-extract...(no debugging symbols found)...done.

warning: core file may not match specified executable file.
[New LWP 11353]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/usr/lib/tracker/tracker-extract'.
Program terminated with signal SIGSYS, Bad system call.
#0 0x00007fde9d6c3677 in execve () at ../sysdeps/unix/syscall-template.S:84
84 ../sysdeps/unix/syscall-template.S: No such file or directory.
(gdb) bt
#0 0x00007fde9d6c3677 in execve () at ../sysdeps/unix/syscall-template.S:84
#1 0x00007fde9d6c376f in execv (path=<optimized out>, argv=<optimized out>)
at execv.c:25
#2 0x00007fde9dc5c31e in g_execute (search_path_from_envp=0, search_path=0, envp=0x0, argv=0x7fde6bb198b0, file=0x7fde641bb000 "/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-plugin-scanner") at ././glib/gspawn.c:1680
#3 0x00007fde9dc5c31e in do_exec (child_err_report_fd=18, stdin_fd=<optimized out>, stdout_fd=22, stderr_fd=-1, working_directory=working_directory@entry=0x0, argv=argv@entry=0x7fde6bb198b0, envp=0x0, close_descriptors=1, search_path=0, search_path_from_envp=0, stdout_to_null=0, stderr_to_null=0, child_inherits_stdin=0, file_and_argv_zero=0, child_setup=0x0, user_data=0x0)
at ././glib/gspawn.c:1229
#4 0x00007fde9dc5cb01 in fork_exec_with_pipes (intermediate_child=intermediate_child@entry=0, working_directory=working_directory@entry=0x0, argv=argv@entry=0x7fde6bb198b0, envp=envp@entry=0x0, close_descriptors=close_descriptors@entry=1, search_path=search_path@entry=0, search_path_from_envp=0, stdout_to_null=0, stderr_to_null=0, child_inherits_stdin=0, file_and_argv_zero=0, cloexec_pipes=0, child_setup=0x0, user_data=0x0, child_pid=0x7fde6400a6d4, standard_input=0x7fde6400a6d8, standard_output=0x7fde6400a6e0, standard_error=0x0, error=0x0)
at ././glib/gspawn.c:1426
#5 0x00007fde9dc5d545 in g_spawn_async_with_pipes (working_directory=working_directory@entry=0x0, argv=argv@entry=0x7fde6bb198b0, envp=envp@entry=0x0, flags=flags@entry=G_SPAWN_DO_NOT_REAP_CHILD, child_setup=child_setup@entry=0x0, user_dat---Type <return> to continue, or q <return> to quit---
a=user_data@entry=0x0, child_pid=0x7fde6400a6d4, standard_input=0x7fde6400a6d8, standard_output=0x7fde6400a6e0, standard_error=0x0, error=0x0)
at ././glib/gspawn.c:656
#6 0x00007fde70930ea9 in gst_plugin_loader_try_helper (loader=loader@entry=0x7fde6400a6c0, location=location@entry=0x7fde641bb000 "/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-plugin-scanner") at gstpluginloader.c:431
#7 0x00007fde70930fd1 in gst_plugin_loader_spawn (loader=0x7fde6400a6c0)
at gstpluginloader.c:494
#8 0x00007fde70931555 in gst_plugin_loader_spawn (loader=0x7fde6400a6c0)
at gstpluginloader.c:258
#9 0x00007fde70931555 in plugin_loader_load (loader=0x7fde6400a6c0, filename=0x7fde641b92c0 "/usr/lib/x86_64-linux-gnu/gstreamer-1.0/libgstvaapi.so", file_size=732184, file_mtime=1487860804) at gstpluginloader.c:228
#10 0x00007fde7093a73c in gst_registry_scan_plugin_file (context=context@entry=0x7fde6bb19b00, filename=filename@entry=0x7fde641b92c0 "/usr/lib/x86_64-linux-gnu/gstreamer-1.0/libgstvaapi.so", file_size=732184, file_mtime=1487860804)
at gstregistry.c:1176
#11 0x00007fde7093b8a1 in gst_registry_scan_path_level (context=context@entry=0x7fde6bb19b00, path=path@entry=0x7fde70994928 "/usr/lib/x86_64-linux-gnu/gstreamer-1.0", level=level@entry=10) at gstregistry.c:1352
#12 0x00007fde7093ba76 in gst_registry_scan_path_internal (context=context@entry=0x7fde6bb19b00, path=path@entry=0x7fde70994928 "/usr/lib/x86_64-linux-gnu/gstreamer-1.0") at gstregistry.c:1379
---Type <return> to continue, or q <return> to quit---
#13 0x00007fde7093d6c4 in scan_and_update_registry (write_changes=1, error=0x7fde6bb19af8, registry_file=0x7fde6400dd80 "/home/kupfer/.cache/gstreamer-1.0/registry.x86_64.bin", default_registry=0x55a9e1195f40 [GstRegistry])
at gstregistry.c:1675
#14 0x00007fde7093d6c4 in ensure_current_registry (error=0x7fde6bb19af8)
at gstregistry.c:1767
#15 0x00007fde7093d6c4 in gst_update_registry () at gstregistry.c:1843
#16 0x00007fde708d820e in init_post (context=<optimized out>, group=<optimized out>, data=<optimized out>, error=<optimized out>) at gst.c:716
#17 0x00007fde9dc21b08 in g_option_context_parse (context=context@entry=0x7fde64008d10, argc=argc@entry=0x0, argv=argv@entry=0x0, error=error@entry=0x7fde6bb19c70) at ././glib/goption.c:2165
#18 0x00007fde708d8bdf in gst_init_check (argc=0x0, argv=0x0, err=0x7fde6bb19c70) at gst.c:353
#19 0x00007fde708d8c34 in gst_init (argc=<optimized out>, argv=<optimized out>)
at gst.c:399
#20 0x00007fde7103f916 in ()
at /usr/lib/x86_64-linux-gnu/tracker-1.0/extract-modules/libextract-gstreamer.so
#21 0x00007fde71040e80 in tracker_extract_get_metadata ()
at /usr/lib/x86_64-linux-gnu/tracker-1.0/extract-modules/libextract-gstreamer.so
#22 0x000055a9df11578c in ()
---Type <return> to continue, or q <return> to quit---
#23 0x000055a9df115df3 in ()
#24 0x000055a9df115e50 in ()
#25 0x00007fde9dc3d3d5 in g_thread_proxy (data=0x55a9e11894a0)
at ././glib/gthread.c:784
#26 0x00007fde9d9b2494 in start_thread (arg=0x7fde6bb1a700)
at pthread_create.c:333
#27 0x00007fde9d6f3aff in clone ()
at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97


-- System Information:
Debian Release: 9.3
APT prefers stable
APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-5-amd64 (SMP w/6 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8), LANGUAGE=en_US.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages tracker-extract depends on:
ii libc6 2.24-11+deb9u1
ii libcue1 1.4.0-1
ii libflac8 1.3.2-1
ii libgif7 5.1.4-0.4
ii libglib2.0-0 2.50.3-2
ii libgsf-1-114 1.14.41-1
ii libgstreamer-plugins-base1.0-0 1.10.4-1
ii libgstreamer1.0-0 1.10.4-1
ii libgxps2 0.2.4-1+b1
ii libjpeg62-turbo 1:1.5.1-2
ii libosinfo-1.0-0 1.0.0-2
ii libpng16-16 1.6.28-1
ii libpoppler-glib8 0.48.0-2+deb9u1
ii libtiff5 4.0.8-2+deb9u1
ii libtotem-plparser18 3.10.7-1+b1
ii libtracker-miner-1.0-0 1.10.5-1
ii libtracker-sparql-1.0-0 1.10.5-1
ii libvorbisfile3 1.3.5-4
ii libxml2 2.9.4+dfsg1-2.2+deb9u2
ii tracker 1.10.5-1

tracker-extract recommends no packages.

tracker-extract suggests no packages.

-- no debconf information

[Simon McVittie]

On Sat, 20 Jan 2018 at 15:08:18 -0800, Mike Kupfer wrote:
> Every few days I find a core file in $HOME. file(1) tells me they're
> coming from tracker-extract. I've taken a quick look at a couple with
> gdb, and (IIRC), gdb has said each time that tracker-extract died with
> SIGSYS in execve().

tracker-extract runs under seccomp sandboxing that kills it with SIGSYS
when it tries to do a system call that isn't on a whitelist, to make sure
an attacker wouldn't be able to use a vulnerability in its file parsing
to execute arbitrary code. Executing a different binary (execve())
is not on the whitelist.

> #2 0x00007fde9dc5c31e in g_execute (search_path_from_envp=0, search_path=0, envp=0x0, argv=0x7fde6bb198b0, file=0x7fde641bb000 "/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-plugin-scanner") at ././glib/gspawn.c:1680

This is a GStreamer library used by tracker-extract refreshing its
list of available GStreamer plugins. tracker-extract should configure
GStreamer to not do this: either it currently doesn't, or it tries to
but has been unsuccessful. Before applying seccomp filters or making
use of GStreamer, tracker-extract should set the environment variables
GST_REGISTRY_UPDATE and GST_REGISTRY_FORK to "no" to prevent this.

I'm not sure under what circumstances GStreamer runs gst-plugin-scanner:
it must be something slightly unusual about your system, perhaps a
locally-installed GStreamer plugin with a timestamp newer than the
registry of available plugins, otherwise other people would see this
bug all the time.

smcv

[Simon McVittie]

On Sat, 20 Jan 2018 at 23:33:52 +0000, Simon McVittie wrote:
> Before applying seccomp filters or making
> use of GStreamer, tracker-extract should set the environment variables
> GST_REGISTRY_UPDATE and GST_REGISTRY_FORK to "no" to prevent this.

I *thought* this sounded familiar. Looks like I suggested that before as
a solution to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=853723
but that bug was solved differently in the end.

smcv

[Mike Kupfer]

Simon McVittie wrote:

> I'm not sure under what circumstances GStreamer runs gst-plugin-scanner:
> it must be something slightly unusual about your system, perhaps a
> locally-installed GStreamer plugin with a timestamp newer than the
> registry of available plugins, otherwise other people would see this
> bug all the time.

Hmm. Synaptic reports 4 locally installed gstreamer packages:

gstreamer0.10-fluendo-mp3
gstreamer0.10-plugins-base
libgstreamer0.10-0
libgstreamer-plugins-base0.10

I suspect these are left over from when the system was upgraded from
Jessie to Stretch.

I've removed the packages and will report back if any new core files
appear.

thanks,
mike

[Simon McVittie]

On Sat, 20 Jan 2018 at 15:58:38 -0800, Mike Kupfer wrote:
> Simon McVittie wrote:
> > I'm not sure under what circumstances GStreamer runs gst-plugin-scanner
>

> Hmm. Synaptic reports 4 locally installed gstreamer packages:
>
> gstreamer0.10-fluendo-mp3
> gstreamer0.10-plugins-base
> libgstreamer0.10-0
> libgstreamer-plugins-base0.10

It's good to have removed these, but GStreamer 0.10 and 1.0 are separate
(and any modern version of tracker-extract uses 1.0), so these shouldn't
affect anything.

smcv

[Mike Kupfer]

Indeed, tracker-extract (well, GStreamer) still tries on occasion to run
gst-plugin-scanner, with tracker-extract dying as a result.

regards,
mike