SUSE-RU-2024:0606-1: Recommended update for pacemaker

Q: Are Pacemaker Remote and command-line installations included in this update?

Yes. The listed software includes pacemaker-remote, pacemaker-cli, pacemaker, pacemaker-libs, and their associated debug and debuginfo packages.

Q: What operational symptoms could point to one of the corrected issues?

Reported symptoms include crm_mon crashing when the fencer connection is lost, crm_attribute producing garbage for --node localhost or auto, and incorrect or error output from the HealthSmart check_temperature agent. The update also addresses IPC file-descriptor and memory leaks.

Q: Are the fixes limited to use-after-free and double-free conditions?

No. In addition to use-after-free and double-free fixes, the update corrects NULL dereference handling, XML escaping and output behavior, scheduler validation and logging, remote-node attribute handling, and resource waiting behavior.

Published Feb 23, 2024

Updated

This update for pacemaker fixes the following issues: libcrmcommon: Avoid file descriptor leak in IPC client with async connection (bsc#1219323) libcrmcommon: Always output request= in XML output libcrmcommon: crmxmlescape() shouldn't stop on Unicode characters tools: crmattribute emits garbage for --node localhost or auto tools: Fix memory leak in crmmon with HTML output tools: crmmon segfaults when fencer connection is lost (bsc#1219220) attrd: Write Pacemaker Remote node attributes even if not in cache agents: Use attrdupdater dampen delay in SysInfo libcrmcommon: Check correct env vars in pcmknodeattrtarget() scheduler: Restore nvpair behavior without id-ref scheduler: Reject expression without op sooner libcrmcommon: Fix NULL dereference in expandidref() scheduler: Improve logs for invalid id-ref's pacemaker-attrd,libcrmcluster: Avoid use-after-free when remote node in cluster node cache libcrmcluster: Avoid use-after-free in trace log HealthSmart: Check the parameter values of checktemperature to avoid error output agents: Handle dampening parameter consistently and correctly crmresource: Make --wait wait for pending actions in CIB scheduler: Avoid double free with disabled recurring actions agents: HealthCPU - fix the validation of input controller: Don't try to execute agent action at shutdown tools: The dampen parameter is disabled when setting values with attrdupdater.

Affected Software

26 affected componentsFixes available

All of the following

SUSE openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586)

Any of the following

suse/pacemaker-debugsource<2.1.5

2.1.5

suse/pacemaker-cli<2.1.5

2.1.5

suse/pacemaker<2.1.5

2.1.5

suse/pacemaker-cli-debuginfo<2.1.5

2.1.5

suse/pacemaker-remote-debuginfo<2.1.5

2.1.5

suse/pacemaker-debuginfo<2.1.5

2.1.5

suse/pacemaker-libs<2.1.5

2.1.5

suse/pacemaker-remote<2.1.5

2.1.5

suse/pacemaker-libs-debuginfo<2.1.5

2.1.5

suse/pacemaker-devel<2.1.5

2.1.5

All of the following

SUSE openSUSE Leap 15.5 (noarch)

suse/pacemaker-cts<2.1.5

2.1.5

All of the following

SUSE SUSE Linux Enterprise High Availability Extension 15 SP5 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/pacemaker-debugsource<2.1.5

2.1.5

suse/pacemaker-cli<2.1.5

2.1.5

suse/pacemaker<2.1.5

2.1.5

suse/pacemaker-cli-debuginfo<2.1.5

2.1.5

suse/pacemaker-remote-debuginfo<2.1.5

2.1.5

suse/pacemaker-debuginfo<2.1.5

2.1.5

suse/pacemaker-libs<2.1.5

2.1.5

suse/pacemaker-remote<2.1.5

2.1.5

suse/pacemaker-libs-debuginfo<2.1.5

2.1.5

suse/pacemaker-devel<2.1.5

2.1.5

All of the following

SUSE SUSE Linux Enterprise High Availability Extension 15 SP5 (noarch)

suse/pacemaker-cts<2.1.5

2.1.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/pacemaker-debugsource to a version that resolves this vulnerability.
Fixed in 2.1.5
Upgrade
Upgrade suse/pacemaker-cli to a version that resolves this vulnerability.
Fixed in 2.1.5
Upgrade
Upgrade suse/pacemaker to a version that resolves this vulnerability.
Fixed in 2.1.5
Upgrade
Upgrade suse/pacemaker-cli-debuginfo to a version that resolves this vulnerability.
Fixed in 2.1.5
Upgrade
Upgrade suse/pacemaker-remote-debuginfo to a version that resolves this vulnerability.
Fixed in 2.1.5
Upgrade
Upgrade suse/pacemaker-debuginfo to a version that resolves this vulnerability.
Fixed in 2.1.5
Upgrade
Upgrade suse/pacemaker-libs to a version that resolves this vulnerability.
Fixed in 2.1.5
Upgrade
Upgrade suse/pacemaker-remote to a version that resolves this vulnerability.
Fixed in 2.1.5
Upgrade
Upgrade suse/pacemaker-libs-debuginfo to a version that resolves this vulnerability.
Fixed in 2.1.5
Upgrade
Upgrade suse/pacemaker-devel to a version that resolves this vulnerability.
Fixed in 2.1.5
Upgrade
Upgrade suse/pacemaker-cts to a version that resolves this vulnerability.
Fixed in 2.1.5
Upgrade
Upgrade pacemaker to a version that resolves this vulnerability.
Patch SUSE-2024-606=1
Upgrade
Upgrade pacemaker to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.5-2024-606=1
Upgrade
Upgrade pacemaker to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HA-15-SP5-2024-606=1

Event History

Feb 23, 2024

Advisory Published

via SUSE·04:30 PM

Frequently Asked Questions

Are Pacemaker Remote and command-line installations included in this update?

Yes. The listed software includes pacemaker-remote, pacemaker-cli, pacemaker, pacemaker-libs, and their associated debug and debuginfo packages.

What operational symptoms could point to one of the corrected issues?

Reported symptoms include crm_mon crashing when the fencer connection is lost, crm_attribute producing garbage for --node localhost or auto, and incorrect or error output from the HealthSmart check_temperature agent. The update also addresses IPC file-descriptor and memory leaks.

Are the fixes limited to use-after-free and double-free conditions?

No. In addition to use-after-free and double-free fixes, the update corrects NULL dereference handling, XML escaping and output behavior, scheduler validation and logging, remote-node attribute handling, and resource waiting behavior.

SUSE-RU-2024:0606-1: Recommended update for pacemaker

Affected Software

Remediation

Event History

Frequently Asked Questions

Are Pacemaker Remote and command-line installations included in this update?

What operational symptoms could point to one of the corrected issues?

Are the fixes limited to use-after-free and double-free conditions?

Company

Resources

Contact

Frequently Asked Questions

Are Pacemaker Remote and command-line installations included in this update?

What operational symptoms could point to one of the corrected issues?

Are the fixes limited to use-after-free and double-free conditions?