5.7. Crashes

5.7.1. [Critical] Segmentation fault risk with concurrent updates of identity certificates*

There was the risk of a segmentation fault with concurrent updates of identity certificates. It was possible to cause a DomainParticipant crash when an identity certificate was updated via identity certificate file change and via the set_qos API.

[RTI Issue ID SEC-2676]

5.7.2. [Critical] NULL dereference when simultaneously changing certificate or CRL file while deleting DomainParticipant*

Suppose you had set files_poll_interval to a value other than 0. If you changed the contents of an identity certificate file or a CRL file while deleting the DomainParticipant, a race condition would have occurred because those two operations were not thread-safe with respect to each other. This race condition led to a NULL dereference in release libraries and a precondition failure in debug libraries in the internal function DDS_DomainParticipantGlobals_get_worker_per_threadI.

[RTI Issue ID SEC-2618]

5.7.3. [Critical] Log messages possibly corrupted or lost due to memory reordering on weak memory architectures

On weak memory architectures (such as Arm), memory reordering negatively impacted the logging queue used for distributing security events and logging over DDS.

If the queue became full (which can happen if your application generates many log messages, such as when debug verbosity is set), some log messages may have been lost or corrupted.

If the queue was empty and a new message was produced, it could have caused a crash or an incomplete message being published.

These issues have been resolved by adding memory barriers to the logging queue implementation.

[RTI Issue ID SEC-2587]

5.7.4. [Critical] Invalid read when simultaneously changing CRL file and validating remote DomainParticipant’s identity*

Suppose you had set files_poll_interval to a value other than 0. If you changed the contents of your CRL file while validating the identity of a remote DomainParticipant, a race condition would have occurred because those two operations were not thread-safe with respect to each other. This race condition led to the reading of invalid memory. A memory-checking tool such as Valgrind™ would have reported invalid reads in the function RTI_Security_CertHelper_verifyCertificate() due to accessing an address freed by a different function RTI_Security_Authentication_updateCrl().

[RTI Issue ID SEC-2479]

5.7.5. [Critical] Java: segmentation fault while enabling a DataWriter that protects payloads and enables batching*

Consider the following scenario:

You are using the Java API.
The Governance Document has <data_protection_kind> set to a value other than NONE for a given topic.
The DataWriterQos has batch.enable set to true.

Attempting to enable a DataWriter of that topic and with that QoS would fail with a segmentation fault in the internal function PRESTypePluginDefaultEndpointData_calculateBatchBufferSize. This problem only affected releases 7.0.0 to 7.3.0.

[RTI Issue ID SEC-2457]

5.7.6. [Critical] Parsing malformed protected RTPS packets may have caused bus error on some platforms

If rtps_protection_kind was set to a value other than NONE in the Governance Document, parsing malformed RTPS packets may have caused a bus error on some platforms, such as a QNX system running on an Arm v7 processor.

[RTI Issue ID SEC-2435]

5.7.7. [Critical] Invalid read when simultaneously changing identity certificate file and validating local DomainParticipant’s identity status*

Suppose you had set files_poll_interval to a value other than 0. If you changed the contents of your identity certificate file while validating the identity status of the local DomainParticipant, a race condition would have occurred because those two operations were not thread-safe with respect to each other.

The time to validate the local identity status depends on the dds.participant.trust_plugins.certificate_expiration_advance_notice_duration.sec property. If the property value is 0, validation takes place at the expiration date of the identity certificate. Otherwise, it occurs dds.participant.trust_plugins.certificate_expiration_advance_notice_duration.sec seconds in advance, and then once every dds.participant.trust_plugins.certificate_expiration_advance_notice_reminder_period.sec seconds (1 second by default).

This race condition led to the reading of invalid memory. A memory-checking tool such as Valgrind™ would have reported invalid reads in a function due to accessing an address freed by a different function.

Your application may have crashed with messages such as these:

[...]
ERROR [[...]|SET LISTENER] RTI_Security_Authentication_validateCertificateChain:{[[...],{"plugin_class":"DDS:Auth:PKI-DH"},{"plugin_method":"RTI_Security_Authentication_validateCertificateChain"}]}],"m":"Identity verification failed. Make sure it was signed by the right authority."}}
ERROR [[...]|SET LISTENER] RTI_Security_CertHelper_logMessageForEveryCa:{[[...],{"plugin_class":"RTI:Common"},{"plugin_method":"RTI_Security_CertHelper_logMessageForEveryCa"}]}],"m":"Failed to verify identity. Used authority: /C=US/ST=CA/[...]"}}
../crypto/asn1/tasn_utl.c:101: OpenSSL internal error: refcount error
fish: Job 1, '[...]' terminated by signal SIGABRT (Abort)

[RTI Issue ID SEC-2407]

5.7.8. [Major] Possible crash when using Python API due to collision with OpenSSL symbols when using certain Python releases*

A Python application loading the Security Plugins may have crashed with a segmentation fault during DomainParticipant creation. You would have seen a message similar to:

Thread 1 "python3" received signal SIGSEGV, Segmentation fault.
0x00007fcbc6ff19d5 in OPENSSL_sk_num () from third_party/libcrypto.so.3
[...]

The crash was due to a conflict between the OpenSSL symbols in the library shipped with Connext and those embedded in the Python executable itself. The Security Plugins now look up OpenSSL symbols first within the library, before looking in the global namespace.

To see if your Python release is affected, look for OpenSSL symbols in the Python executable. For example, run the following command on a Linux system:

$> nm -D <python_exe> | grep UI_create_method
0000000000377fe0 T UI_create_method

If the output is not empty, it means the Python executable contains OpenSSL symbols and they will collide with the ones shipped with Connext.

[RTI Issue ID SEC-2376]

* This bug did not affect you if you are upgrading from 6.1.x or earlier.