Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #75666 > unrolled thread

Bug#1013192: linux-image-5.10.0-15-amd64: ridiculously small entropy pool

Back to article view | Back to linux.debian.kernel

Contents

  Bug#1013192: linux-image-5.10.0-15-amd64: ridiculously small entropy pool Thorsten Glaser <tg@mirbsd.de> - 2022-06-18 22:00 +0200
    Processed: Re: Bug#1013192: linux-image-5.10.0-15-amd64:  ridiculously small entropy pool "Debian Bug Tracking System" <owner@bugs.debian.org> - 2022-06-18 22:40 +0200
    Bug#1013192: linux-image-5.10.0-15-amd64: ridiculously small entropy pool Bastian Blank <waldi@debian.org> - 2022-06-18 22:40 +0200
      Bug#1013192: linux-image-5.10.0-15-amd64: ridiculously small entropy pool Thorsten Glaser <tg@mirbsd.de> - 2022-06-18 23:00 +0200
    Bug#1013192: linux-image-5.10.0-15-amd64: ridiculously small entropy pool Diederik de Haas <didi.debian@cknow.org> - 2022-06-18 23:00 +0200
      Bug#1013192: linux-image-5.10.0-15-amd64: ridiculously small entropy pool Diederik de Haas <didi.debian@cknow.org> - 2022-06-18 23:00 +0200
    Processed: Re: Bug#1013192: linux-image-5.10.0-15-amd64:  ridiculously small entropy pool "Debian Bug Tracking System" <owner@bugs.debian.org> - 2022-06-18 23:00 +0200

#75666 — Bug#1013192: linux-image-5.10.0-15-amd64: ridiculously small entropy pool

Package: src:linux
Version: 5.10.120-1
Severity: serious
Tags: security
X-Debbugs-Cc: Debian Security Team <team@security.debian.org>


/proc/sys/kernel/random/poolsize is now 256 instead of 4096 bits,
which was already small before.

Why was such a change allowed into stable?

This also breaks rngd’s --fill-watermark option when not set to
percent values. Another reason this should not be changed within
a stable series.


-- Package-specific info:
** Version:
Linux version 5.10.0-15-amd64 (debian-kernel@lists.debian.org) (gcc-10 (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2) #1 SMP Debian 5.10.120-1 (2022-06-09)

** Command line:
root=UUID=078df9a0-34f7-4171-b531-0cb628963204 ro clocksource=acpi_pm verbose

** Not tainted

** Kernel log:
Unable to read kernel log; any relevant messages should be attached

** Model information

** Loaded modules:
binfmt_misc
nfsd
auth_rpcgss
nfs_acl
nfs
lockd
grace
nfs_ssc
fscache
sunrpc
joydev
evdev
serio_raw
virtio_rng
rng_core
pcspkr
virtio_balloon
cirrus
drm_kms_helper
cec
drm
button
ext4
crc16
mbcache
jbd2
crc32c_generic
hid_generic
usbhid
hid
virtio_blk
virtio_net
net_failover
failover
ata_generic
crc32c_intel
psmouse
virtio_pci
virtio_ring
virtio
i2c_piix4
ata_piix
uhci_hcd
libata
floppy
ehci_hcd
scsi_mod
usbcore
usb_common

** PCI devices:
00:00.0 Host bridge [0600]: Intel Corporation 440FX - 82441FX PMC [Natoma] [8086:1237] (rev 02)
	Subsystem: Red Hat, Inc. Qemu virtual machine [1af4:1100]
	Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx-
	Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

00:01.0 ISA bridge [0601]: Intel Corporation 82371SB PIIX3 ISA [Natoma/Triton II] [8086:7000]
	Subsystem: Red Hat, Inc. Qemu virtual machine [1af4:1100]
	Physical Slot: 1
	Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx-
	Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-

00:01.1 IDE interface [0101]: Intel Corporation 82371SB PIIX3 IDE [Natoma/Triton II] [8086:7010] (prog-if 80 [ISA Compatibility mode-only controller, supports bus mastering])
	Subsystem: Red Hat, Inc. Qemu virtual machine [1af4:1100]
	Physical Slot: 1
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx-
	Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Region 0: Memory at 000001f0 (32-bit, non-prefetchable) [virtual] [size=8]
	Region 1: Memory at 000003f0 (type 3, non-prefetchable) [virtual]
	Region 2: Memory at 00000170 (32-bit, non-prefetchable) [virtual] [size=8]
	Region 3: Memory at 00000370 (type 3, non-prefetchable) [virtual]
	Region 4: I/O ports at c0c0 [virtual] [size=16]
	Kernel driver in use: ata_piix
	Kernel modules: ata_piix, ata_generic

00:01.2 USB controller [0c03]: Intel Corporation 82371SB PIIX3 USB [Natoma/Triton II] [8086:7020] (rev 01) (prog-if 00 [UHCI])
	Subsystem: Red Hat, Inc. QEMU Virtual Machine [1af4:1100]
	Physical Slot: 1
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx-
	Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin D routed to IRQ 11
	Region 4: I/O ports at c040 [size=32]
	Kernel driver in use: uhci_hcd
	Kernel modules: uhci_hcd

00:01.3 Bridge [0680]: Intel Corporation 82371AB/EB/MB PIIX4 ACPI [8086:7113] (rev 03)
	Subsystem: Red Hat, Inc. Qemu virtual machine [1af4:1100]
	Physical Slot: 1
	Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx-
	Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Interrupt: pin A routed to IRQ 9
	Kernel driver in use: piix4_smbus
	Kernel modules: i2c_piix4

00:02.0 VGA compatible controller [0300]: Cirrus Logic GD 5446 [1013:00b8] (prog-if 00 [VGA controller])
	Subsystem: Red Hat, Inc. QEMU Virtual Machine [1af4:1100]
	Physical Slot: 2
	Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx-
	Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Region 0: Memory at fc000000 (32-bit, prefetchable) [size=32M]
	Region 1: Memory at febf0000 (32-bit, non-prefetchable) [size=4K]
	Expansion ROM at 000c0000 [disabled] [size=128K]
	Kernel driver in use: cirrus
	Kernel modules: cirrusfb, cirrus

00:03.0 Ethernet controller [0200]: Red Hat, Inc. Virtio network device [1af4:1000]
	Subsystem: Red Hat, Inc. Virtio network device [1af4:0001]
	Physical Slot: 3
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 10
	Region 0: I/O ports at c060 [size=32]
	Region 1: Memory at febf1000 (32-bit, non-prefetchable) [size=4K]
	Expansion ROM at febc0000 [disabled] [size=128K]
	Capabilities: [40] MSI-X: Enable+ Count=3 Masked-
		Vector table: BAR=1 offset=00000000
		PBA: BAR=1 offset=00000800
	Kernel driver in use: virtio-pci
	Kernel modules: virtio_pci

00:04.0 SCSI storage controller [0100]: Red Hat, Inc. Virtio block device [1af4:1001]
	Subsystem: Red Hat, Inc. Virtio block device [1af4:0002]
	Physical Slot: 4
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 11
	Region 0: I/O ports at c000 [size=64]
	Region 1: Memory at febf2000 (32-bit, non-prefetchable) [size=4K]
	Capabilities: [40] MSI-X: Enable+ Count=2 Masked-
		Vector table: BAR=1 offset=00000000
		PBA: BAR=1 offset=00000800
	Kernel driver in use: virtio-pci
	Kernel modules: virtio_pci

00:05.0 Unclassified device [00ff]: Red Hat, Inc. Virtio memory balloon [1af4:1002]
	Subsystem: Red Hat, Inc. Virtio memory balloon [1af4:0005]
	Physical Slot: 5
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx-
	Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 10
	Region 0: I/O ports at c080 [size=32]
	Kernel driver in use: virtio-pci
	Kernel modules: virtio_pci

00:06.0 Unclassified device [00ff]: Red Hat, Inc. Virtio RNG [1af4:1005]
	Subsystem: Red Hat, Inc. Virtio RNG [1af4:0004]
	Physical Slot: 6
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR+ FastB2B- DisINTx-
	Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 11
	Region 0: I/O ports at c0a0 [size=32]
	Kernel driver in use: virtio-pci
	Kernel modules: virtio_pci


** USB devices:
Bus 001 Device 002: ID 0627:0001 Adomax Technology Co., Ltd QEMU USB Tablet
Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub


-- System Information:
Debian Release: 11.3
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: i386 (i686)
Foreign Architectures: amd64

Kernel: Linux 5.10.0-15-amd64 (SMP w/1 CPU thread)
Locale: LANG=C, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/lksh
Init: sysvinit (via /sbin/init)

Versions of packages linux-image-5.10.0-15-amd64 depends on:
ii  initramfs-tools [linux-initramfs-tool]  0.140
ii  kmod                                    28-1
ii  linux-base                              4.6

Versions of packages linux-image-5.10.0-15-amd64 recommends:
pn  apparmor             <none>
ii  firmware-linux-free  20200122-1

Versions of packages linux-image-5.10.0-15-amd64 suggests:
pn  debian-kernel-handbook               <none>
pn  grub-pc | grub-efi-amd64 | extlinux  <none>
pn  linux-doc-5.10                       <none>

Versions of packages linux-image-5.10.0-15-amd64 is related to:
pn  firmware-amd-graphics     <none>
pn  firmware-atheros          <none>
pn  firmware-bnx2             <none>
pn  firmware-bnx2x            <none>
pn  firmware-brcm80211        <none>
pn  firmware-cavium           <none>
pn  firmware-intel-sound      <none>
pn  firmware-intelwimax       <none>
pn  firmware-ipw2x00          <none>
pn  firmware-ivtv             <none>
pn  firmware-iwlwifi          <none>
pn  firmware-libertas         <none>
pn  firmware-linux-nonfree    <none>
pn  firmware-misc-nonfree     <none>
pn  firmware-myricom          <none>
pn  firmware-netxen           <none>
pn  firmware-qlogic           <none>
pn  firmware-realtek          <none>
pn  firmware-samsung          <none>
pn  firmware-siano            <none>
pn  firmware-ti-connectivity  <none>
pn  xen-hypervisor            <none>

-- no debconf information

[toc] | [next] | [standalone]

#75667 — Processed: Re: Bug#1013192: linux-image-5.10.0-15-amd64: ridiculously small entropy pool

Processing control commands:

> severity -1 normal
Bug #1013192 [src:linux] linux-image-5.10.0-15-amd64: ridiculously small entropy pool
Severity set to 'normal' from 'serious'
> tags -1 wontfix
Bug #1013192 [src:linux] linux-image-5.10.0-15-amd64: ridiculously small entropy pool
Added tag(s) wontfix.

-- 
1013192: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1013192
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#75668

Control: severity -1 normal
Control: tags -1 wontfix

On Sat, Jun 18, 2022 at 09:52:41PM +0200, Thorsten Glaser wrote:
> /proc/sys/kernel/random/poolsize is now 256 instead of 4096 bits,
> which was already small before.

The pool size for an RPNG is only the size of the state, nothing else.
It does not in any way describe how much you could get out.

> Why was such a change allowed into stable?

Because upstream considered it important enough for their stable
release, aka it fixes something important.

> This also breaks rngd’s --fill-watermark option when not set to
> percent values. Another reason this should not be changed within
> a stable series.

The kernel does not longer provide a number that could be used here.  It
might not have had any value before anyway.  You just need to reseed on
a regular interval.

Bastian

-- 
Ahead warp factor one, Mr. Sulu.

[toc] | [prev] | [next] | [standalone]

#75670

Bastian Blank dixit:

>The pool size for an RPNG is only the size of the state, nothing else.

Yes, and that is the problem. It was small before, it’s ridiculous now.

>might not have had any value before anyway.  You just need to reseed on
>a regular interval.

Ugh. I recall reading something about this on LWN, but I thought I
had time until bookworm to invent something to deal with this…

bye,
//mirabilos
-- 
(gnutls can also be used, but if you are compiling lynx for your own use,
there is no reason to consider using that package)
	-- Thomas E. Dickey on the Lynx mailing list, about OpenSSL

[toc] | [prev] | [next] | [standalone]

#75669

[Multipart message — attachments visible in raw view] — view raw

Control: severity -1 normal
Control: merge -1 1012835

On Saturday, 18 June 2022 21:52:41 CEST Thorsten Glaser wrote:
> Version: 5.10.120-1
> Severity: serious
> Tags: security

There has been a HUGE changeset applied between 5.10.118 and 5.10.119 and while
not entirely certain, I'm quite confident that this change was intentional. 
That and the severity of the bug I'm merging it with has severity normal, is
the reason I'm downgrading the severity to normal.
I'll leave it up to the maintainer to adjust it if needed.

https://lore.kernel.org/all/20220317232804.931702-1-Jason@zx2c4.com/ is 
probably the closest match of the 'cause' of these changes, but there's a good
chance that several patch sets were involved.

Here are some more 'random' threads I have found:
https://lore.kernel.org/all/20211221175047.341782-1-Jason@zx2c4.com/
https://lore.kernel.org/all/20220201161342.154666-1-Jason@zx2c4.com/

And as already mentioned in the bug I'm merging it with, you're not the only
one who noticed:
https://forum.openwrt.org/t/low-entropy-22-03-snapshot-change-in-kernel-entropy-pool-logic/129573

[toc] | [prev] | [next] | [standalone]

#75672

[Multipart message — attachments visible in raw view] — view raw

On Saturday, 18 June 2022 22:47:01 CEST Diederik de Haas wrote:
> Here are some more 'random' threads I have found:

And this seems like an entire document explaining it:
https://www.zx2c4.com/projects/linux-rng-5.17-5.18/

[toc] | [prev] | [next] | [standalone]

#75671 — Processed: Re: Bug#1013192: linux-image-5.10.0-15-amd64: ridiculously small entropy pool

Processing control commands:

> severity -1 normal
Bug #1013192 [src:linux] linux-image-5.10.0-15-amd64: ridiculously small entropy pool
Ignoring request to change severity of Bug 1013192 to the same value.
> merge -1 1012835
Bug #1013192 [src:linux] linux-image-5.10.0-15-amd64: ridiculously small entropy pool
Bug #1012835 [src:linux] linux-image-5.10.0-15-amd64: entropy dropped to 256 from ~4k after 5.10.120-1 update
Added tag(s) security and wontfix.
Merged 1012835 1013192

-- 
1012835: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012835
1013192: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1013192
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web