-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-EN-15:03.freebsd-update Errata Notice The FreeBSD Project Topic: freebsd-update updates libraries in suboptimal order Category: base Module: freebsd-update Announced: 2015-02-25 Credits: Brooks Davis Affects: All supported versions of FreeBSD. Corrected: 2015-02-09 09:22:47 UTC (stable/10, 10.1-STABLE) 2015-02-25 05:56:16 UTC (releng/10.1, 10.1-RELEASE-p6) 2015-02-25 05:56:16 UTC (releng/10.0, 10.0-RELEASE-p18) 2015-02-09 09:45:58 UTC (stable/9, 9.3-STABLE) 2015-02-25 05:56:54 UTC (releng/9.3, 9.3-RELEASE-p10) 2015-02-09 10:09:46 UTC (stable/8, 8.4-STABLE) 2015-02-25 05:56:54 UTC (releng/8.4, 8.4-RELEASE-p24) For general information regarding FreeBSD Errata Notices and Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background The freebsd-update(8) utility is used to apply binary patches to FreeBSD systems installed from official release images, as an alternative to rebuilding from source. A freebsd-update(8) build server generates the signed update packages, consisting of an index of files and directories with checksums before the update, a set of binary patches, and an index of files and directories with checksums after the update. The client downloads the indexes, verifies the signatures and checksums, then downloads and applies the required patches. II. Problem Description In general, the runtime linker needs to be updated before all other libraries, including the standard C library (libc) and the threading library (libthr), because these libraries depend on functionality of the runtime linker. Before this update, the freebsd-update(8) utility did not enforce this ordering requirement and would replace libthr (and all other libraries) before updating the runtime linker. A recent change to the FreeBSD threading library that would prevent a deadlock in a child process requires a NULL pointer test in the runtime linker (/libexec/ld-elf.so.1) be in place. Since previous versions of the runtime linker do not have this test, processes will crash due to a NULL pointer deference. III. Impact If a name-service switch module linked to the threading library -- such as ldap or winbind -- was configured to provide passwd or group services in /etc/nsswitch.conf, then all attempts to look up a user or group by name after the threading library was updated would result in a crash. Most obviously, all further install(1) invocations by freebsd-update(8) will crash, leaving the system partially updated and largely unusable. IV. Workaround Disabling any name-service switch modules linked to libthr prior to running the freebsd-update(8) 'upgrade' command works around the issue. These modules include, but are not limited to, ldap and winbind. V. Solution The freebsd-update(8) utility has been updated to install the runtime linker before any libraries. You MUST upgrade systems prior to 10.1 to address this errata notice before updating to 10.1 or later using freebsd-update(8). Perform one of the following: 1) Upgrade your system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. 2) To update your present system via a binary patch: Systems running a RELEASE version of FreeBSD on the i386 or amd64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install 3) To update your present system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [FreeBSD 9.3] # fetch https://security.FreeBSD.org/patches/EN-15:03/freebsd-update.patch # fetch https://security.FreeBSD.org/patches/EN-15:03/freebsd-update.patch.asc # gpg --verify freebsd-update.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in . VI. Correction details The following list contains the correction revision numbers for each affected branch. Branch/path Revision - ------------------------------------------------------------------------- stable/8/ r278446 releng/8.4/ r279265 stable/9/ r278444 releng/9.3/ r279265 stable/10/ r278443 releng/10.0/ r279264 releng/10.1/ r279264 - ------------------------------------------------------------------------- To see which files were modified by a particular revision, run the following command, replacing NNNNNN with the revision number, on a machine with Subversion installed: # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base Or visit the following URL, replacing NNNNNN with the revision number: VII. References The latest revision of this Errata Notice is available at https://security.FreeBSD.org/advisories/FreeBSD-EN-15:03.freebsd-update.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.1.1 (FreeBSD) iQIcBAEBCgAGBQJU7WjDAAoJEO1n7NZdz2rnkNkQAOJU6l5aKWWwvxU+Bxwc/zV5 DcmGnL+7b/dN2zKdRVz6N54vuFnoUsXMd5EobxdC5MX31Yn/GnL5dQMbJDNAEL8D I6jYdqf7PQL3v+EBiOFNazjeRbx5EM2gNLfwozv5LHKxER5ggmalmmf168Se4cRX V+v2i28lCvAgOu3hXLd5gKQ3s8dNh2t/uxWI+fS3Sl6bitC0xVsXFEpTc8qIaJEu cbVmedRQEoSnQPLdpoSgbmQpjp6/45l/UtLZpK7Cr7h8BHS9wtKdWjjkNL/wyF5j 3p2yanr6koT3P1iAhBJFE/3Dw4h5PlvWH56LP4PJmACuxU02AYrjc/ZVX1IL6bLt 9AuO8W28DTi6q9q8xy+XHcYXuDS4PF3oCDZ92m2iZMHcO747q8UQdKkgCEUfIZ2n L79Dfkkx0uSmp4FIc1f/T6gDiBkZFRfs4stHRrm9K6nbyvFCAczj8wTUQPDjDUGw zGH1jN9r/I3mHi3FREd0+w++BYZproepf4yfv5c/UJN9P88vCBAZZqlS1kkxYGUz jOwzsF/MkpMWW16Xp58f7uwGTVZNTLzoq0r2GTln2R9fQAoQNrJYcBiW48MPSlQe wef9nRhC8BPOSI70dl5r16/lOu4IuBqwBFiY8QzzDc/DABmaDUQrhLRp+VDHqFeL taJCUogXb0n1CFub4f9P =J5C+ -----END PGP SIGNATURE-----