full-disclosure - Re: [FD] Anomaly in Fedora `dnf update`: md5 mismatch of result

Open Source and information security mailing list archives

Date: Tue, 15 Aug 2023 13:35:02 -0400
From: Michael Lazin <microlaser@...il.com>
To: fulldisclosure@...lists.org
Subject: Re: [FD] Anomaly in Fedora `dnf update`: md5 mismatch of result

I would test it using sha256 instead of md5 before you jump to conclusions
but dnf doesn't use https by default and you need to jump through hoops to
get it working.  I would say if you are a fedora user open a feature
request for https for dnf with the fedora team if you can repeat this with
sha256.

Peace,

Michael

On Tue, Aug 15, 2023, 1:25 PM Georgi Guninski <gguninski@...il.com> wrote:

> In short, I found anomaly in Fedora 37 and would like to
> know if it is vulnerability.
>
> As root type in terminal:
> dnf update
>
> If there is kernel update, watch stdout and stderr for:
>
> ##On Mon Aug 14 05:33:29 AM UTC 2023
> (2/6): kernel-6.4.10-100.fc37.x86_64.rpm        1.2 MB/s | 140 kB     00:00
>
> /var/cache/dnf/updates-fd4d3d0d1c34d49a/packages/kernel-modules-extra-6.4.9-100.fc37_6.4.10-100.fc37.x86_64.drpm:
> md5 mismatch of result
>
> ##$ md5sum
> /var/cache/dnf/updates-fd4d3d0d1c34d49a/packages/kernel-modules-extra-6.4.9-100.fc37_6.4.10-100.fc37.x86_64.drpm
> 356ea04e06bd58db4a15c64e64432f1a
>
> /var/cache/dnf/updates-fd4d3d0d1c34d49a/packages/kernel-modules-extra-6.4.9-100.fc37_6.4.10-100.fc37.x86_64.drpm
>
> Another possible approach:  install  Fedora 37 in VM without internet
> access and then do `dnf update` (haven't tested this yet).
>
> After second download, the kernel update passes, but I don't
> understand why the second download via http://mirror should pass.
>
> Examining the dnf source is option.
>
> Open problem:  Can this be vulnerability, possibly assuming
> hostile mirror or network?
>
> Also, isn't md5 deprecated and known to suck much?
>
> --
> guninski
> https://www.guninski.com/me.html
> _______________________________________________
> Sent through the Full Disclosure mailing list
> https://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: https://seclists.org/fulldisclosure/
>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives