samhain segfaults on startup in trixie on some configurations; to reproduce on fresh install from netinst: root@myhost:~# cat /etc/os-release PRETTY_NAME="Debian GNU/Linux 13 (trixie)" NAME="Debian GNU/Linux" VERSION_ID="13" VERSION="13 (trixie)" VERSION_CODENAME=trixie DEBIAN_VERSION_FULL=13.0 ID=debian HOME_URL="https://www.debian.org/" SUPPORT_URL="https://www.debian.org/support" BUG_REPORT_URL="https://bugs.debian.org/" root@myhost:~# apt-get update root@myhost:~# apt-get install samhain Reading package lists... Done Building dependency tree... Done Reading state information... Done The following additional packages will be installed: libauparse0t64 The following NEW packages will be installed: libauparse0t64 samhain 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. Need to get 1,233 kB of archives. After this operation, 3,104 kB of additional disk space will be used. Do you want to continue? [Y/n] y Get:1 http://deb.debian.org/debian trixie/main amd64 libauparse0t64 amd64 1:4.0.2-2+b2 [68.6 kB] Get:2 http://deb.debian.org/debian trixie/main amd64 samhain amd64 4.1.4-6 [1,165 kB] Fetched 1,233 kB in 1s (2,153 kB/s) Preconfiguring packages ... Selecting previously unselected package libauparse0t64:amd64. (Reading database ... 26493 files and directories currently installed.) Preparing to unpack .../libauparse0t64_1%3a4.0.2-2+b2_amd64.deb ... Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0 to /lib/x86_64-linux-gnu/libauparse.so.0.usr-is-merged by libauparse0t64' Adding 'diversion of /lib/x86_64-linux-gnu/libauparse.so.0.0.0 to /lib/x86_64-linux-gnu/libauparse.so.0.0.0.usr-is-merged by libauparse0t64' Unpacking libauparse0t64:amd64 (1:4.0.2-2+b2) ... Selecting previously unselected package samhain. Preparing to unpack .../samhain_4.1.4-6_amd64.deb ... Unpacking samhain (4.1.4-6) ... Setting up libauparse0t64:amd64 (1:4.0.2-2+b2) ... Setting up samhain (4.1.4-6) ... Created symlink '/etc/systemd/system/multi-user.target.wants/samhain.service' → '/usr/lib/systemd/system/samhain.service'. Could not execute systemctl: at /usr/bin/deb-systemd-invoke line 148. Processing triggers for libc-bin (2.41-12) ... root@myhost:~# cat > /etc/samhain/samhainrc <<\EOF [Misc] IgnoreAdded=/dev IgnoreMissing=/dev IgnoreAdded=/etc/abcdef IgnoreMissing=/etc/abcdef IgnoreAdded=/etc/abcdefghij IgnoreMissing=/etc/abcdefghij [EOF] EOF root@myhost:~# cat /etc/samhain/samhainrc [Misc] IgnoreAdded=/dev IgnoreMissing=/dev IgnoreAdded=/etc/abcdef IgnoreMissing=/etc/abcdef IgnoreAdded=/etc/abcdefghij IgnoreMissing=/etc/abcdefghij [EOF] root@myhost:~# samhain -t init Segmentation fault root@myhost:~# dpkg -s samhain | grep Version Version: 4.1.4-6 root@myhost:~# journalctl | tail -n 2 Aug 20 11:07:16 myhost kernel: show_signal: 93 callbacks suppressed Aug 20 11:07:16 myhost kernel: traps: samhain[953] general protection fault ip:7f07e46f58e0 sp:7fff7cbbce00 error:0 in libc.so.6[ed8e0,7f07e4630000+165000]
Hi, It seems to be an issue with dnmalloc. Indeed building dnmalloc.c with -O0 or with gcc-10 (the version in bookworm was built with gcc-9), is enough to get it working. Therefore a workaround is to rebuild samhain without dnmalloc on amd64, as done in the following patch:--- samhain-4.1.4/debian/rules +++ samhain-4.1.4/debian/rules @@ -15,9 +15,7 @@ # For more information see: # http://www.la-samhna.de/samhain/manual/dnmalloc.html ifeq (linux,$(DEB_HOST_ARCH_OS)) -ifeq (amd64,$(DEB_HOST_ARCH)) -DNMALLOC = --enable-dnmalloc -else ifeq (i386,$(DEB_HOST_ARCH)) +ifeq (i386,$(DEB_HOST_ARCH)) DNMALLOC = --enable-dnmalloc else DNMALLOC = --disable-dnmalloc Regards Aurelien
control: tag -1 + patch
I found the issue to be a pointer aliasing issue in the rEALLOc
function:
|
| /* allocate, copy, free */
| else {
|
| newmem = mALLOc(nb - MALLOC_ALIGN_MASK);
Here newmem is allocated.
| if (newmem == 0)
| return 0; /* propagate failure */
|
| newp = hashtable_lookup(newmem);
It's transformed into a chunk id.
| newsize = chunksize(newp);
|
|
| /* next = next_chunkinfo(oldp); *//* 'next' never used rw 19.05.2008 */
| /*
| Avoid copy if newp is next chunk after oldp.
| */
| if (UNLIKELY(is_next_chunk(oldp, newp))) {
| newsize += oldsize;
| set_head_size(oldp, newsize);
| hashtable_skiprm(oldp, newp);
| freecilst_add(newp);
| newp = oldp;
| }
| else {
| /*
| Unroll copy of <= 40 bytes (80 if 8byte sizes)
| We know that contents have an even number of
| INTERNAL_SIZE_T-sized words; minimally 4 (2 on amd64).
| */
|
| VALGRIND_MALLOCLIKE_BLOCK(chunk(oldp), chunksize(oldp), 0, 0);
|
| copysize = oldsize;
| s = (INTERNAL_SIZE_T*)(oldmem);
| d = (INTERNAL_SIZE_T*)(newmem);
d points to newmem
| ncopies = copysize / sizeof(INTERNAL_SIZE_T);
| assert(ncopies >= 2);
|
| if (ncopies > 10)
| MALLOC_COPY(d, s, copysize);
and is used to the copy. But it is never used latter, so GCC optimizes
that out.
|
| else {
| *(d+0) = *(s+0);
| *(d+1) = *(s+1);
| if (ncopies > 2) {
| *(d+2) = *(s+2);
| *(d+3) = *(s+3);
| if (ncopies > 4) {
| *(d+4) = *(s+4);
| *(d+5) = *(s+5);
| if (ncopies > 6) {
| *(d+6) = *(s+6);
| *(d+7) = *(s+7);
| if (ncopies > 8) {
| *(d+8) = *(s+8);
| *(d+9) = *(s+9);
| }
| }
| }
| }
| }
|
| fREe(oldmem);
| check_inuse_chunk(newp);
| guard_set(av->guard_stored, newp, bytes, nb);
| return chunk(newp);
Here newmem is accessed again though the chunk id, not directly.
| }
| }
| }
Therefore the following patch fixes the issue:
--- samhain-4.1.4.orig/src/dnmalloc.c
+++ samhain-4.1.4/src/dnmalloc.c
@@ -4872,7 +4872,7 @@ DL_STATIC Void_t* rEALLOc(oldmem, bytes)
fREe(oldmem);
check_inuse_chunk(newp);
guard_set(av->guard_stored, newp, bytes, nb);
- return chunk(newp);
+ return newmem;
}
}
}
That said, it seems the dnmalloc code is old, unmaintained and subject
to similar issues in other locations. Therefore I would suggest to just
disable dnmalloc for all architectures. This is what the attached patch
does.
Sven, as you did the latest uploads, would it be possible to schedule an
upload with a fix? Thanks in advance
Regards
Aurelien
Hello, Bug #1111631 in samhain reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/pkg-security-team/samhain/-/commit/54a75ae70d8dabc7ee688b9b9d0775019f775058 ------------------------------------------------------------------------ d/rules: quick fix preventing potential segfaults (Closes: #1111631) Thanks to Aurelien Jarno <aurel32@debian.org> for debugging and providing a patch. ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1111631
Hi Aurelien, Just uploaded a 4.1.4-7 containing the fix you proposed. Sven
We believe that the bug you reported is fixed in the latest version of
samhain, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1111631@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sven Geuer <sge@debian.org> (supplier of updated samhain package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 06 Sep 2025 21:05:45 +0200
Source: samhain
Architecture: source
Version: 4.1.4-7
Distribution: unstable
Urgency: medium
Maintainer: Debian Security Tools <team+pkg-security@tracker.debian.org>
Changed-By: Sven Geuer <sge@debian.org>
Closes: 868158 1097839 1099415 1107458 1111631
Changes:
samhain (4.1.4-7) unstable; urgency=medium
.
* Team upload.
.
[ Javier Fernández-Sanguino Peña ]
* Add build conflict on autoconf-archive to prevent FTBFS (Closes: #1099415)
* debian/samhain.init: Instead of using hard-coded path of
/var/lib/samhain/samhain_file for the location of the database, check the
configuration file. This prevents samhain from failing in case the
administrator has changed its location (Closes: #868158)
.
[ Sven Geuer ]
* d/rules:
- Quick fix to make samhain 4.1.4 buildable using GCC-15 (Closes: #1097839)
- Quick fix preventing potential segfaults (Closes: #1111631)
Thanks to Aurelien Jarno <aurel32@debian.org> for debugging and
providing a patch.
* Update Portuguese debconf template translations (Closes: #1107458)
Thanks to Américo Monteiro <a_monteiro@gmx.com> for providing it.
Checksums-Sha1:
5085daa599fd8eab9fff795188a709ea82edf05f 2087 samhain_4.1.4-7.dsc
09b9348e6d240d41e63db49d798391a6e5936a11 105212 samhain_4.1.4-7.debian.tar.xz
5c52eb06cc34ff3be574919f82ebca71634563c5 6354 samhain_4.1.4-7_amd64.buildinfo
Checksums-Sha256:
305cc20ee8c19c500178c7e0ef0e4c92d964fc4f8d662e507ae031146dd42c15 2087 samhain_4.1.4-7.dsc
c59a9082cd25453c22f0fa169657f81bfc89262f014c10a07d1a732c9bfb26b7 105212 samhain_4.1.4-7.debian.tar.xz
4214f86d15dc0e96d09cbb5c7512fab056da0f16ec2b3cee06223c85dcb5a491 6354 samhain_4.1.4-7_amd64.buildinfo
Files:
4d14822501be1ee4532d4fd14cb703ad 2087 admin optional samhain_4.1.4-7.dsc
6efbd8ff4223382640428864d6710736 105212 admin optional samhain_4.1.4-7.debian.tar.xz
5685418dd5881da8f875b36101fe4dd4 6354 admin optional samhain_4.1.4-7_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJDBAEBCgAtFiEEPfXoqkP8n9/QhvGVrfUO2vit1YUFAmi8h3QPHHNnZUBkZWJp
YW4ub3JnAAoJEK31Dtr4rdWFyUQQAKvCsC+O+U6l+m5MKsRRxukFlO6nh/h2zbna
X6L3m88qhCUOM/tfT7XRh95vU3YDTdvWCIOBoqzdHXoNaGY19lUE1ujMppsHuz+O
q+Tuo3ssvOhCL4CLWe/MRhdQVG5PXTElOvQmBwIWMemtqav7Bldr3DjADDkQekpi
tyVTPwuGccqBeG+W0wJmP5k+ogBD6mLQukGMrkTkLVzCYk0vNx0P2t6hv70xnSJE
zjGzqnpn9+9C1/zhkjDeiYcOPG39ugh9pWU3VAfgP4hvY9UoJVWEdbezKmth52wO
WA8NhkzLMImnJEvWi489KPuKZvpUZRHzT4jkDbjhcsauyWgGsZPkrMIALJ+LyYEp
ECiSwA/yypTo93p/19Y5WoaFUaKLUpmqn6Oz5oECyuxlTKezNuuYnm9m4FL0h4Sh
AouXirYnZNauWaBx3OzC8RuJREQadUlIkAW3vcMxmU8Xh7P05D7jwTA9a3H4B1yn
yE7Vqw4mNoLGNrwPpNeOiiaiCOrVktRxlwSwdQ1QkqXkNZFeMDP3WlFb23oviGmi
rUI3vR7Tki0sRLcArdfsSHiGLt4ELNaOH+/Ekm1ohxREjMfTpY8nVJxJPhP+Jslj
aCBrFyFi16M6oHiVfI/DzGAaXDkmPoOpwUl6H0PyQo83jZ7/u5i9V1JMVWmzP6wP
bm8m06jZ
=EbdG
-----END PGP SIGNATURE-----