Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-73217

An incorrect SUN disklabel can cause Anaconda to crash

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Undefined Undefined
    • rhel-9.6
    • rhel-9.4
    • parted
    • parted-3.5-3.el9
    • No
    • Low
    • image-builder-1
    • 0
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • All
    • None

      If a disk has a SUN disklabel with incorrect CHS values in it (either on purpose or because some random data looks like a SUN disklabel with correct checksum) it can cause a coredump in Anaconda. This isn't common, but is possible and has been seen in the related issue which was fixed by first wiping the disk being installed.

      In order to hit this it needs to looks like a SUN disklabel (correct magic value), have incorrect CHS values, they must be a size smaller than the disk, and the checksum on the disklabel must be correct (it's an XOR checksum so not very robust).

      This causes libparted to raise an exception, which is checked by blivet (via pyparted's exception handler code). Since it is a Warning with Ignore/Cancel as the response blivet returns an unhandled exception value. In libparted's sun disklabel code it incorrectly assumes that unhandled is the same as ignore (instead it should cancel the operation) and it continues on. Allowing Anaconda and blivet to try other operations on the disklabel (calling the duplicate() function) which results in a coredump because the disklabel is actually invalid.

      This effects Fedora, RHEL10, and RHEL9 so upstream parted needs a patch to fix it.

              brlane@redhat.com Brian Lane
              brlane@redhat.com Brian Lane
              Brian Lane Brian Lane
              Release Test Team Release Test Team
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: