** Description changed:
+ SRU Justification:
+
+ [Impact]
+
+ * cca_get_version() in usr/lib/cca_stdll/cca_specific.c parses the CCA
+ host library version string (CSUACFV/STATCCA) with a strict sscanf()
+ format requiring a literal indicator character plus trailing data
+ after the version numbers (e.g. "%u.%u.%uz%s", must match 4 fields).
+ cca_get_adapter_version() has the same issue ("%d.%d.%02d*").
+
+ * CCA 8.4+ reports this string with a different trailing format, so
+ the sscanf() no longer matches, cca_get_version() returns
+ CKR_FUNCTION_FAILED, and the whole CCA PKCS#11 token fails to
+ initialize. Not a CVE (no memory-safety/code-exec issue), but a
+ functional regression that silently removes the CCA token as soon as
+ the host library is upgraded.
+
+ * Upstream fix (applies cleanly on v3.23.0, backport only, no other
+ changes): relaxes both sscanf() calls to only require the 3 numeric
+ version fields (unsigned), ignoring any trailing data.
+
+ [Fix]
+
+ * "CCA: Adjust CCA host library version detection for newer CCA versions"
+
https://github.com/opencryptoki/opencryptoki/commit/2596e37d6b7a64fc24b92fc308a671ca7a215f89
+
+ [Test Plan]
+
+ Requires a system with the CCA host library (CCA 8.4+) and a CCA
+ PKCS#11 slot configured (e.g. slot 1 = libpkcs11_cca.so in
+ /etc/opencryptoki/opencryptoki.conf); this can't be reproduced without
+ real CCA-backed hardware/simulator.
+
+ 0. Enable tracing so the failure/success is visible in the log:
+ export OPENCRYPTOKI_TRACE_LEVEL=4
+ Trace output goes to /var/log/opencryptoki/trace.<pkcsslotd-pid>.
+
+ A) Reproduce with the buggy package (3.23.0+dfsg-0ubuntu3):
+ 1. Confirm the CCA host library is 8.4+, e.g.:
+ dpkg -l | grep -i cca
+ 2. sudo systemctl restart pkcsslotd
+ 3. pkcsconf -t
+ Expected (broken): the CCA token is absent from the list, e.g.
+ only other configured tokens (SoftTok, ICA, ...) are shown, no
+ "IBM CCA Token" entry.
+ 4. Confirm the root cause in the trace log:
+ grep -i "CCA library version is invalid" \
+ /var/log/opencryptoki/trace.$(pgrep pkcsslotd)
+ Expected: a line such as
+ "CCA library version is invalid: 8.40..."
+
+ B) Verify the fix (3.23.0+dfsg-0ubuntu3.1 from -proposed):
+ 1. sudo apt install opencryptoki=3.23.0+dfsg-0ubuntu3.1
+ (from noble-proposed)
+ 2. sudo systemctl restart pkcsslotd
+ 3. pkcsconf -t
+ Expected: CCA token now listed, e.g.:
+ Token #1 Info:
+ Manufacturer: IBM Corp.
+ Model: IBM CCA Token
+ ...
+ 4. Confirm no parsing error in the trace log:
+ grep -i "CCA library version" \
+ /var/log/opencryptoki/trace.$(pgrep pkcsslotd)
+ Expected: "CCA Version string: 8.40..." with no "is invalid" line.
+
+ C) Regression check on an older, already-working CCA host library:
+ Repeat steps B) against an older CCA version that worked with
+ 3.23.0+dfsg-0ubuntu3 - expected: identical success.
+
+ [Where problems could occur]
+
+ * Change is limited to 2 sscanf() calls; no crypto/session code
+ touched, so any regression would only affect CCA token
+ detection/version reporting, not operations once the token is up.
+ * Parsing is relaxed (fewer required fields), so the main risk is the
+ downstream CCA_MIN_VERSION/CCA_MIN_RELEASE gate misjudging some
+ untested version string - covered by the regression-check step above.
+ * s390x/CCA-only; no effect on other tokens or architectures.
+
+ [Other Info]
+
+ * Only Noble (3.23.0+dfsg-0ubuntu3) is affected. Jammy (v3.17) doesn't
+ contain this code path (unaffected). Resolute (v3.26) already has
+ the fix, which went upstream in v3.25.0.
+
+ * Test build in PPA:
+
https://launchpad.net/~fheimes/+archive/ubuntu/lp2163181+lp2163253+lp2163254
+ __________
+
Description:
For supporting the new CCA 8.4 version, a fix is needed for the openCryptoki
package.
Without this fix, the version cannot be determined correctly and the CCA
host library version will be reported as invalid, potentially causing
security problems.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2163181
Title:
[UBUNTU 24.04] openCryptoki: Fix for supporting CCA 8.4
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu-z-systems/+bug/2163181/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
