DOTNET_ROOT is not set properly when upgrading

Bug #1997746 reported by Miriam España Acebal
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
dotnet6 (Ubuntu)
Fix Released
Medium
Unassigned
Jammy
Fix Released
Medium
Miriam España Acebal
Kinetic
Fix Released
Medium
Miriam España Acebal
Lunar
Fix Released
Medium
Unassigned

Bug Description

After the change in the layout installation, the DOTNET_ROOT env variable is still set with the old path. This makes that using the binary directly resulting from a built solution doesn't work unless you prepend the correct path to the execution.

The dotnet command is not affected (so `dotnet run` can be used perfectly).

The variable is set in the dotnet.sh file.

CVE References

Changed in dotnet6 (Ubuntu):
status: New → Triaged
importance: Undecided → Medium
Revision history for this message
Miriam España Acebal (mirespace) wrote :

The issue was reported upstream at https://github.com/dotnet/runtime/issues/79237

Changed in dotnet6 (Ubuntu Jammy):
assignee: nobody → Miriam España Acebal (mirespace)
Changed in dotnet6 (Ubuntu Kinetic):
assignee: nobody → Miriam España Acebal (mirespace)
Changed in dotnet6 (Ubuntu Jammy):
status: New → In Progress
Changed in dotnet6 (Ubuntu Kinetic):
status: New → In Progress
Changed in dotnet6 (Ubuntu Jammy):
importance: Undecided → Medium
Changed in dotnet6 (Ubuntu Kinetic):
importance: Undecided → Medium
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package dotnet6 - 6.0.112-0ubuntu1

---------------
dotnet6 (6.0.112-0ubuntu1) lunar; urgency=medium

  * New upstream release (LP: #1999549).
  * d/p/series: Removing patch
    73065-runtime-fix-definition-cpuid-clang-15.patch.
  * d/dotnet-host.install.in: Fix destination of install_location*
    files (LP: #1999266).
  * d/dotnet.sh.in: Eliminate the condition to force updating of
    DOTNET_ROOT variable (LP: #1997746).

 -- Miriam España Acebal <email address hidden> Tue, 13 Dec 2022 11:03:19 +0100

Changed in dotnet6 (Ubuntu Lunar):
status: Triaged → Fix Released
Revision history for this message
Łukasz Zemczak (sil2100) wrote : Please test proposed package

Hello Miriam, or anyone else affected,

Accepted dotnet6 into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/dotnet6/6.0.112-0ubuntu1~22.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in dotnet6 (Ubuntu Kinetic):
status: In Progress → Fix Committed
tags: added: verification-needed verification-needed-kinetic
Revision history for this message
Łukasz Zemczak (sil2100) wrote :

Hello Miriam, or anyone else affected,

Accepted dotnet6 into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/dotnet6/6.0.112-0ubuntu1~22.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in dotnet6 (Ubuntu Jammy):
status: In Progress → Fix Committed
tags: added: verification-needed-jammy
Revision history for this message
Miriam España Acebal (mirespace) wrote :

Verification on Jammy: OK

#Bad Case

#0.dotnet is properly installed

root@Jdotnet1983380:~# dotnet --info
.NET SDK (reflecting any global.json):
 Version: 6.0.111
 Commit: b3bb659a9d

Runtime Environment:
 OS Name: ubuntu
 OS Version: 22.04
 OS Platform: Linux
 RID: ubuntu.22.04-x64
 Base Path: /usr/lib/dotnet/sdk/6.0.111/

global.json file:
  Not found

Host:
  Version: 6.0.11
  Architecture: x64
  Commit: 943474ca16

.NET SDKs installed:
  6.0.111 [/usr/lib/dotnet/sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 6.0.11 [/usr/lib/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 6.0.11 [/usr/lib/dotnet/shared/Microsoft.NETCore.App]

Download .NET:
  https://aka.ms/dotnet-download

Learn about .NET Runtimes and SDKs:
  https://aka.ms/dotnet/runtimes-sdk-info

#1. The executable could not be directly called

root@Jdotnet1983380:~# TheTesting/bin/Debug/net6.0/TheTesting
You must install .NET to run this application.

App: /root/TheTesting/bin/Debug/net6.0/TheTesting
Architecture: x64
App host version: 6.0.11
.NET location: Not found

Learn about runtime installation:
https://aka.ms/dotnet/app-launch-failed

Download the .NET runtime:
https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=ubuntu.22.04-x64&apphost_version=6.0.11
root@Jdotnet1983380:~#

#Good case

#0. Updating to .112

User might face:

Setting up dotnet-host (6.0.112-0ubuntu1~22.04.1) ...

Configuration file '/etc/profile.d/dotnet.sh'
 ==> Modified (by you or by a script) since installation.
 ==> Package distributor has shipped an updated version.
   What would you like to do about it ? Your options are:
    Y or I : install the package maintainer's version
    N or O : keep your currently-installed version
      D : show the differences between the versions
      Z : start a shell to examine the situation
 The default action is to keep your current version.
*** dotnet.sh (Y/I/N/O/D/Z) [default=N] ? i

#1.Checking installation:

root@Jdotnet1983380:~# dotnet --info
.NET SDK (reflecting any global.json):
 Version: 6.0.112
 Commit: d311a58ee1

Runtime Environment:
 OS Name: ubuntu
 OS Version: 22.04
 OS Platform: Linux
 RID: ubuntu.22.04-x64
 Base Path: /usr/lib/dotnet/sdk/6.0.112/

global.json file:
  Not found

Host:
  Version: 6.0.12
  Architecture: x64
  Commit: 02e45a41b7

.NET SDKs installed:
  6.0.112 [/usr/lib/dotnet/sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 6.0.12 [/usr/lib/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 6.0.12 [/usr/lib/dotnet/shared/Microsoft.NETCore.App]

Download .NET:
  https://aka.ms/dotnet-download

Learn about .NET Runtimes and SDKs:
  https://aka.ms/dotnet/runtimes-sdk-info

#1. Checking DOTNET_ROOT variable is set:

root@Jdotnet1983380:~# logout
❯ lxc shell Jdotnet1983380
root@Jdotnet1983380:~# env | grep DOTNET
DOTNET_ROOT=/usr/lib/dotnet
DOTNET_BUNDLE_EXTRACT_BASE_DIR=/root/.cache/dotnet_bundle_extract

#2.Checking we can run the dotnet binary directly:

root@Jdotnet1983380:~# TheTesting/bin/Debug/net6.0/TheTesting
Hello, World!
root@Jdotnet1983380:~#

tags: added: verification-done-jammy
removed: verification-needed-jammy
Revision history for this message
Łukasz Zemczak (sil2100) wrote :

Hello Miriam, or anyone else affected,

Accepted dotnet6 into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/dotnet6/6.0.112-0ubuntu1~22.10.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Revision history for this message
Graham Inggs (ginggs) wrote :

#1. Checking DOTNET_ROOT variable is set:

$ env | grep DOTNET
DOTNET_ROOT=/usr/lib/dotnet
DOTNET_BUNDLE_EXTRACT_BASE_DIR=/home/ubuntu/.cache/dotnet_bundle_extract

#2. Checking we can run the dotnet binary directly:

$ TheTesting/bin/Debug/net6.0/TheTesting
Hello, World!

tags: added: verification-done verification-done-kinetic
removed: verification-needed verification-needed-kinetic
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package dotnet6 - 6.0.113-0ubuntu1~22.04.1

---------------
dotnet6 (6.0.113-0ubuntu1~22.04.1) jammy-security; urgency=medium

  * New upstream release.
  * SECURITY UPDATE: denial of service
    - CVE-2023-21538: Parsing an empty HTTP response as a JSON.NET JObject
      causes a stack overflow and crashes a process.

 -- Ian Constantin <email address hidden> Mon, 09 Jan 2023 22:04:18 +0200

Changed in dotnet6 (Ubuntu Jammy):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package dotnet6 - 6.0.113-0ubuntu1~22.10.1

---------------
dotnet6 (6.0.113-0ubuntu1~22.10.1) kinetic-security; urgency=medium

  * New upstream release.
  * SECURITY UPDATE: denial of service
    - CVE-2023-21538: Parsing an empty HTTP response as a JSON.NET JObject
      causes a stack overflow and crashes a process.

 -- Ian Constantin <email address hidden> Mon, 09 Jan 2023 22:08:22 +0200

Changed in dotnet6 (Ubuntu Kinetic):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.