Public bug reported:
Hardware:
- Dell XPS 13 9310
- Goodix fingerprint reader USB ID 27c6:533c
System:
- Arch Linux / Omarchy 4.0.4-1
- Kernel 7.2.5-3-omarchy
- fprintd 1.94.5-2
- libfprint-tod 1.95.2+tod1-1
- libfprint-goodix-53xc 0.0.6-2
- glibc 2.44+r24+g16be1518495f-1
- libusb 1.0.30-1
- libgusb 0.4.9-2
After installing the Dell/Goodix TOD driver, fprintd crashed five times
across two boots during ordinary fingerprint use:
- SIGABRT at 12:37:36
- SIGSEGV at 13:06:01
- SIGABRT at 13:29:46
- SIGSEGV at 18:11:18
- SIGABRT at 18:11:25
The crashes began shortly after installing libfprint-goodix-53xc
0.0.6-2.
Observed backtraces:
- The SIGSEGV crashes occur during fp_device_open(), with numerous frames
inside libfprint-tod-goodix-53xc-0.0.6.so before the allocator crashes.
- One SIGABRT occurs around fclose(), followed by frames in the Goodix TOD
module during fp_device_open().
- Another abort has the main thread inside the Goodix module during
fp_device_close_sync(), while a second thread is inside the module performing
libusb_bulk_transfer().
- The journal reports: "double free or corruption (out)".
The machine had abundant available memory and no OOM event occurred.
Expected result:
A failed or cancelled fingerprint operation should return an error without
crashing fprintd.
Actual result:
The root-running fprintd daemon repeatedly aborts or segfaults, apparently due
to heap corruption in or around the proprietary Goodix TOD module.
I am not claiming demonstrated exploitability, but recurring memory corruption
in an authentication daemon seems security-sensitive.
Could you confirm whether driver 0.0.6 is compatible with current
libfprint-tod 1.95.2 and glibc 2.44, or provide a newer driver?
Sanitized coredump metadata and backtrace output can be supplied.
** Affects: libfprint (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167761
Title:
Goodix TOD 0.0.6 repeatedly corrupts memory and crashes fprintd on
27c6:533c
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libfprint/+bug/2167761/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
