[ANNOUNCE] procps-ng release 4.0.4
"Craig Small" <[email protected]> ("csmall") Thu, 31 Aug 2023 20:55:49 +1000
| Newsgroups | gmane.linux.procps.devel |
|---|---|
| Message-ID | <CALy8Cw6vaXHRTkohUm4dkswp+c8diyyNxrwzj4i2_oPMmA1qfw@mail.gmail.com> |
--000000000000b817c4060435e383
Content-Type: text/plain; charset="UTF-8"
Hello All,
The procps maintainers are pleased to announce the release of version
4.0.4 of the procps-ng package.
This release fixes CVE-2023-4016, a buffer overflow with the -C command.
If you have *very* **very** long command line options (as in you've
probably recompiled your kernel to increase the ARG_MAX value) then there
can be an overflow in malloc and overwriting unallocated memory from
whatever you put on the -C option. You'll need to write about INT_MAX / 84
command lines to do it.
The release can be found at:
https://gitlab.com/procps-ng/procps/-/releases/v4.0.4
or
https://sourceforge.net/projects/procps-ng/files/Production/
or git and the v4.0.4 tag.
Besides the security fix, NEWS tells us this:
* library (API & ABI unchanged)
- tolerates all potential 'cpuinfo' formats issue #272
- restore the proper main thread tics valuations issue #280
- Remove myself from proc count merge #193
- Refactor the escape code Debian #1035649
* free: -L one line output issue #156
* pgrep: Use only --signal option for signal Debian #1031765
* pgrep: suppress >15 warning if using regex Debian #1037450
* pidof: Add -t option to show threads merge #190
* pmap: Reset totals between processes issue #298
* ps: fixed missing or corrupted fields with -m option Debian #1036631,
issue #279
* ps: Add --signames to show signal names in masks merge #98
* sysctl: -N show names merge #198, RH
#2222056
* tests: dont compare floats with == issue #271
* tests: skips tests if maps missing merge #197,
Gentoo #583036
* top: bad command line arguments yield EXIT_FAILURE issue #273
* top: avoids keystroke induced '%Cpu' distortions
* top: includes VM (guest) tics in 'system' overhead issue #274
* top: includes VM (guest) tics with '!' toggle merge #179
* top: lessen summary CPU distortions on first display merge #180
* top: better backspace handling with line edits issue #278
* vmstat: Print guest time in non-wide mode
* w: Fix musl UT_HOSTSIZE issue
* watch: Add color support at compile time issue #296
My favourite change is the --signames option for ps. Try it with ps s
--signames! Life is too short to know that 0x80a0006 means TRAP, BUS.
What about Release 4.0.5? The next release will have some library API
changes as there is some new kernel proc information we would like to
expose.
- Craig
--
Craig Small https://dropbear.xyz/ csmall at : dropbear.xyz
Debian GNU/Linux https://www.debian.org/
<http://www.debian.org/> csmall at : debian.org
GPG fingerprint: 5D2F B320 B825 D939 04D2 0519 3938 F96B DF50 FEA5
--000000000000b817c4060435e383
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div>Hello All,</div><div>=C2=A0 The procps maintainers ar=
e pleased to announce the release of version 4.0.4 of the procps-ng package=
.</div><div><br></div><div>This release fixes CVE-2023-4016, a buffer overf=
low with the -C command.=C2=A0 If you have *very* **very** long command lin=
e options (as in you've probably recompiled your kernel to increase the=
ARG_MAX value) then there can be an overflow in malloc and overwriting una=
llocated memory from whatever you put on the -C option. You'll need to =
write about INT_MAX / 84 command lines to do it.</div><div><br></div><div>T=
he release can be found at:</div><div><a href=3D"https://gitlab.com/procps-=
ng/procps/-/releases/v4.0.4">https://gitlab.com/procps-ng/procps/-/releases=
/v4.0.4</a></div><div>or</div><div><a href=3D"https://sourceforge.net/proje=
cts/procps-ng/files/Production/">https://sourceforge.net/projects/procps-ng=
/files/Production/</a></div><div>or git and the v4.0.4 tag.</div><div><br><=
/div><div>Besides the security fix, NEWS tells us this:</div><div>=C2=A0 * =
library (API & ABI unchanged)<br>=C2=A0 =C2=A0 - =C2=A0 tolerates all p=
otential 'cpuinfo' formats =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0issue #272<br>=C2=A0 =C2=A0 - restore the proper main thread tics=
valuations =C2=A0 =C2=A0 =C2=A0 =C2=A0 issue #280<br>=C2=A0 =C2=A0 - Remov=
e myself from proc count =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0merge #193<br>=C2=A0 =C2=A0 - Refa=
ctor the escape code =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Debian #1035649<br>=C2=
=A0 * free: -L one line output =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 issue #156<b=
r>=C2=A0 * pgrep: Use only --signal option for signal =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 Debian #1031765<br>=C2=A0 * pgrep: suppress >15 war=
ning if using regex =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Debian #10374=
50<br>=C2=A0 * pidof: Add -t option to show threads =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 merge #190<br>=C2=A0 * pmap: Rese=
t totals between processes =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
=C2=A0 =C2=A0 issue #298<br>=C2=A0 * ps: fixed missing or corrupted fields=
with -m option =C2=A0 Debian #1036631, issue #279<br>=C2=A0 * ps: Add --si=
gnames to show signal names in masks =C2=A0 =C2=A0 =C2=A0 merge #98<br>=C2=
=A0 * sysctl: -N show names =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0me=
rge #198, RH #2222056<br>=C2=A0 * tests: dont compare floats with =3D=3D =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 issue=
#271<br>=C2=A0 * tests: skips tests if maps missing =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 merge #197, Gentoo #583036=
<br>=C2=A0 * top: bad command line arguments yield EXIT_FAILURE =C2=A0 =C2=
=A0 issue #273<br>=C2=A0 * top: avoids keystroke induced '%Cpu' dis=
tortions<br>=C2=A0 * top: includes VM (guest) tics in 'system' over=
head =C2=A0 =C2=A0 issue #274<br>=C2=A0 * top: includes VM (guest) tics wit=
h '!' toggle =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0merge #179<br>=C2=A0=
* top: lessen summary CPU distortions on first display =C2=A0 merge #180<b=
r>=C2=A0 * top: better backspace handling with line edits =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 issue #278<br>=C2=A0 * vmstat: Print guest time in non-wide mode=
<br>=C2=A0 * w: Fix musl UT_HOSTSIZE issue<br>=C2=A0 * watch: Add color sup=
port at compile time =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 issue=
#296<br></div><div><br></div><div>My favourite change is the --signames op=
tion for ps. Try it with ps s --signames! Life is too short to know that 0x=
80a0006 means TRAP, BUS.</div><div></div><div><br></div><div>What about Rel=
ease 4.0.5? The next release will have some library API changes as there is=
some new kernel proc information we would like to expose.</div><div><br></=
div><div>=C2=A0- Craig</div><div><br></div><br><span class=3D"gmail_signatu=
re_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature" data-sm=
artmail=3D"gmail_signature"><div dir=3D"ltr"><pre>Craig Small <=
a href=3D"https://dropbear.xyz" target=3D"_blank">https://dropbear.xyz/</a>=
csmall at : <a href=3D"http://dropbear.xyz" target=3D"_blank">dropbear.xy=
z</a>
Debian GNU/Linux <a href=3D"http://www.debian.org/" target=3D"_blank=
">https://www.debian.org/</a> csmall at : <a href=3D"http://debian.org" ta=
rget=3D"_blank">debian.org</a>
GPG fingerprint: 5D2F B320 B825 D939 04D2 0519 3938 F96B DF50 FEA5</pr=
e></div></div></div>
--000000000000b817c4060435e383--