[ANNOUNCE] procps-ng release 4.0.4

"Craig Small" <[email protected]> ("csmall") Thu, 31 Aug 2023 20:55:49 +1000
Newsgroups gmane.linux.procps.devel
Message-ID <CALy8Cw6vaXHRTkohUm4dkswp+c8diyyNxrwzj4i2_oPMmA1qfw@mail.gmail.com>
--000000000000b817c4060435e383
Content-Type: text/plain; charset="UTF-8"

Hello All,
  The procps maintainers are pleased to announce the release of version
4.0.4 of the procps-ng package.

This release fixes CVE-2023-4016, a buffer overflow with the -C command.
If you have *very* **very** long command line options (as in you've
probably recompiled your kernel to increase the ARG_MAX value) then there
can be an overflow in malloc and overwriting unallocated memory from
whatever you put on the -C option. You'll need to write about INT_MAX / 84
command lines to do it.

The release can be found at:
https://gitlab.com/procps-ng/procps/-/releases/v4.0.4
or
https://sourceforge.net/projects/procps-ng/files/Production/
or git and the v4.0.4 tag.

Besides the security fix, NEWS tells us this:
  * library (API & ABI unchanged)
    -   tolerates all potential 'cpuinfo' formats              issue #272
    - restore the proper main thread tics valuations         issue #280
    - Remove myself from proc count                          merge #193
    - Refactor the escape code                               Debian #1035649
  * free: -L one line output                               issue #156
  * pgrep: Use only --signal option for signal             Debian #1031765
  * pgrep: suppress >15 warning if using regex             Debian #1037450
  * pidof: Add -t option to show threads                   merge #190
  * pmap: Reset totals between processes                   issue #298
  * ps: fixed missing or corrupted fields with -m option   Debian #1036631,
issue #279
  * ps: Add --signames to show signal names in masks       merge #98
  * sysctl: -N show names                                  merge #198, RH
#2222056
  * tests: dont compare floats with ==                     issue #271
  * tests: skips tests if maps missing                     merge #197,
Gentoo #583036
  * top: bad command line arguments yield EXIT_FAILURE     issue #273
  * top: avoids keystroke induced '%Cpu' distortions
  * top: includes VM (guest) tics in 'system' overhead     issue #274
  * top: includes VM (guest) tics with '!' toggle          merge #179
  * top: lessen summary CPU distortions on first display   merge #180
  * top: better backspace handling with line edits         issue #278
  * vmstat: Print guest time in non-wide mode
  * w: Fix musl UT_HOSTSIZE issue
  * watch: Add color support at compile time               issue #296

My favourite change is the --signames option for ps. Try it with ps s
--signames! Life is too short to know that 0x80a0006 means TRAP, BUS.

What about Release 4.0.5? The next release will have some library API
changes as there is some new kernel proc information we would like to
expose.

 - Craig


-- 

Craig Small             https://dropbear.xyz/  csmall at : dropbear.xyz
Debian GNU/Linux        https://www.debian.org/
<http://www.debian.org/>  csmall at : debian.org
GPG fingerprint:     5D2F B320 B825 D939 04D2  0519 3938 F96B DF50 FEA5

--000000000000b817c4060435e383
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hello All,</div><div>=C2=A0 The procps maintainers ar=
e pleased to announce the release of version 4.0.4 of the procps-ng package=
.</div><div><br></div><div>This release fixes CVE-2023-4016, a buffer overf=
low with the -C command.=C2=A0 If you have *very* **very** long command lin=
e options (as in you&#39;ve probably recompiled your kernel to increase the=
 ARG_MAX value) then there can be an overflow in malloc and overwriting una=
llocated memory from whatever you put on the -C option. You&#39;ll need to =
write about INT_MAX / 84 command lines to do it.</div><div><br></div><div>T=
he release can be found at:</div><div><a href=3D"https://gitlab.com/procps-=
ng/procps/-/releases/v4.0.4">https://gitlab.com/procps-ng/procps/-/releases=
/v4.0.4</a></div><div>or</div><div><a href=3D"https://sourceforge.net/proje=
cts/procps-ng/files/Production/">https://sourceforge.net/projects/procps-ng=
/files/Production/</a></div><div>or git and the v4.0.4 tag.</div><div><br><=
/div><div>Besides the security fix, NEWS tells us this:</div><div>=C2=A0 * =
library (API &amp; ABI unchanged)<br>=C2=A0 =C2=A0 - =C2=A0 tolerates all p=
otential &#39;cpuinfo&#39; formats =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0issue #272<br>=C2=A0 =C2=A0 - restore the proper main thread tics=
 valuations =C2=A0 =C2=A0 =C2=A0 =C2=A0 issue #280<br>=C2=A0 =C2=A0 - Remov=
e myself from proc count =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0merge #193<br>=C2=A0 =C2=A0 - Refa=
ctor the escape code =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Debian #1035649<br>=C2=
=A0 * free: -L one line output =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 issue #156<b=
r>=C2=A0 * pgrep: Use only --signal option for signal =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 Debian #1031765<br>=C2=A0 * pgrep: suppress &gt;15 war=
ning if using regex =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Debian #10374=
50<br>=C2=A0 * pidof: Add -t option to show threads =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 merge #190<br>=C2=A0 * pmap: Rese=
t totals between processes =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
 =C2=A0 =C2=A0 issue #298<br>=C2=A0 * ps: fixed missing or corrupted fields=
 with -m option =C2=A0 Debian #1036631, issue #279<br>=C2=A0 * ps: Add --si=
gnames to show signal names in masks =C2=A0 =C2=A0 =C2=A0 merge #98<br>=C2=
=A0 * sysctl: -N show names =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0me=
rge #198, RH #2222056<br>=C2=A0 * tests: dont compare floats with =3D=3D =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 issue=
 #271<br>=C2=A0 * tests: skips tests if maps missing =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 merge #197, Gentoo #583036=
<br>=C2=A0 * top: bad command line arguments yield EXIT_FAILURE =C2=A0 =C2=
=A0 issue #273<br>=C2=A0 * top: avoids keystroke induced &#39;%Cpu&#39; dis=
tortions<br>=C2=A0 * top: includes VM (guest) tics in &#39;system&#39; over=
head =C2=A0 =C2=A0 issue #274<br>=C2=A0 * top: includes VM (guest) tics wit=
h &#39;!&#39; toggle =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0merge #179<br>=C2=A0=
 * top: lessen summary CPU distortions on first display =C2=A0 merge #180<b=
r>=C2=A0 * top: better backspace handling with line edits =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 issue #278<br>=C2=A0 * vmstat: Print guest time in non-wide mode=
<br>=C2=A0 * w: Fix musl UT_HOSTSIZE issue<br>=C2=A0 * watch: Add color sup=
port at compile time =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 issue=
 #296<br></div><div><br></div><div>My favourite change is the --signames op=
tion for ps. Try it with ps s --signames! Life is too short to know that 0x=
80a0006 means TRAP, BUS.</div><div></div><div><br></div><div>What about Rel=
ease 4.0.5? The next release will have some library API changes as there is=
 some new kernel proc information we would like to expose.</div><div><br></=
div><div>=C2=A0- Craig</div><div><br></div><br><span class=3D"gmail_signatu=
re_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature" data-sm=
artmail=3D"gmail_signature"><div dir=3D"ltr"><pre>Craig Small             <=
a href=3D"https://dropbear.xyz" target=3D"_blank">https://dropbear.xyz/</a>=
  csmall at : <a href=3D"http://dropbear.xyz" target=3D"_blank">dropbear.xy=
z</a>
Debian GNU/Linux        <a href=3D"http://www.debian.org/" target=3D"_blank=
">https://www.debian.org/</a>  csmall at : <a href=3D"http://debian.org" ta=
rget=3D"_blank">debian.org</a>
GPG fingerprint:     5D2F B320 B825 D939 04D2  0519 3938 F96B DF50 FEA5</pr=
e></div></div></div>

--000000000000b817c4060435e383--