Gentoo Linux — dev-python/thrift — multiple vulnerabilities (3 CVEs) — patch and remediation guide

📖 ~4 min read  •  Source: Gentoo GLSA GLSA-202107-32

Related CVEs: CVE-2019-0205 CVE-2019-0210 CVE-2020-13949

Upstream summary: Multiple vulnerabilities have been discovered in Apache Thrift. Please review the CVE identifiers referenced below for details.

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Nothing executes dev-python/thrift on its own; its code runs inside whatever links against or imports it, so the exposed surface on a Gentoo Linux host is the union of every process that has loaded it — web workers, cron jobs, mail handlers, backup agents. The package manager replaces the files on disk, but processes already running keep the old build mapped, and virtualenvs, vendored copies and container images each carry their own copy, so a host can report itself patched while still running vulnerable code. dev-python/thrift is a library — code loaded by other programs rather than a daemon — so there is no service to restart and rc-service dev-python/thrift will simply report no such service; restart its consumers instead.

Environment & Reproduction

Reproduction targets Gentoo Linux (rolling release; Portage). Confirm release, profile, and the installed package via Portage tooling:

cat /etc/gentoo-release
cat /etc/os-release
eselect profile show
equery list dev-python/thrift
equery files dev-python/thrift | head -40
eix dev-python/thrift 2>/dev/null || qlist -I dev-python/thrift

Exercise the workload that uses dev-python/thrift while collecting:

# Branch on init system: systemd vs OpenRC
if [ -d /run/systemd/system ]; then 
  sudo journalctl -u thrift -b --no-pager | tail -200; 
else 
  sudo tail -200 /var/log/rc.log; sudo rc-status --all; 
fi
sudo tail -200 /var/log/emerge.log
sudo tail -200 /var/log/messages 2>/dev/null || sudo journalctl -xe --no-pager | tail -200
# Hardened/SELinux profiles only:

Root Cause Analysis

Root cause is documented in Gentoo GLSA GLSA-202107-32. Gentoo maintainers shipped fixed ebuilds for dev-python/thrift; running an outdated build leaves the host exposed to the failure modes described in the advisory. Because Gentoo is source-based, the relevant change is a SLOT bump or a USE-flag-conditional patch — correlate Portage history with system logs:

sudo tail -200 /var/log/emerge.log
genlop -t dev-python/thrift 2>/dev/null | tail -40   # if app-portage/genlop is merged
equery changes dev-python/thrift 2>/dev/null | tail -40
equery uses dev-python/thrift                         # USE flags that affect the build
sudo glsa-check -l affected | head
cat /proc/sys/kernel/tainted              # non-zero = tainted kernel / out-of-tree modules

Quick Triage

Run these on Gentoo Linux to capture the current state of dev-python/thrift:

qlist -Iv dev-python/thrift                                   # installed version(s)
equery list dev-python/thrift                                 # all installed SLOTs
equery check dev-python/thrift 2>/dev/null || qcheck dev-python/thrift    # verify shipped files
sudo glsa-check -l affected
sudo glsa-check -p GLSA-202107-32            # preview this advisory fix
# Init system aware service / firewall checks:
if [ -d /run/systemd/system ]; then 
  systemctl --failed --no-pager; 
else 
  sudo rc-status --servicelist 2>&1 | grep -E 'crashed|stopped' || sudo rc-status --all; 
fi
sudo nft list ruleset 2>/dev/null | head -50 || sudo iptables -S 2>/dev/null | head -50
# Hardened/SELinux profile only:
# If thrift ships a service unit (unit name may differ from pkg name, e.g.
systemctl list-unit-files 2>/dev/null | grep -i thrift | head || 
  ls /etc/init.d/ | grep -i thrift | head

Step-by-Step Diagnosis

1. Enumerate failed services across either init system.

   if [ -d /run/systemd/system ]; then systemctl --failed --no-pager; 
   else sudo rc-status --servicelist | grep -E 'crashed|stopped'; fi

2. Tail logs for dev-python/thrift on the host’s init system.

   if [ -d /run/systemd/system ]; then 
     sudo journalctl -u thrift -f --no-pager; 
   else 
     sudo tail -F /var/log/thrift/*.log 2>/dev/null; sudo tail -F /var/log/messages; 
   fi

3. Inspect firewall posture (nftables / iptables).

   sudo nft list ruleset 2>/dev/null | head -80
   sudo iptables -S 2>/dev/null | head -80
   sudo ip6tables -S 2>/dev/null | head -40

4. On hardened/SELinux profiles, surface denials and author a local policy module.

   command -v ausearch >/dev/null || { echo 'no audit (default profile)'; exit 0; }

5. Verify dev-python/thrift integrity and re-merge if anything is altered.

   sudo equery check dev-python/thrift 2>/dev/null || sudo qcheck dev-python/thrift
   sudo emerge -1 dev-python/thrift                       # one-shot rebuild
   sudo revdep-rebuild -i -- -av dev-python/thrift        # rebuild reverse-deps if ABI shifted

6. Correlate findings with /var/log/emerge.log, genlop -t dev-python/thrift, and Gentoo GLSA GLSA-202107-32 to pin the change that introduced the regression.

Solution – Primary Fix

Apply the corrective Portage transaction referenced by Gentoo GLSA GLSA-202107-32, then reload affected services on whichever init system this host uses:

sudo emerge --sync                                 # or: sudo emaint --auto sync
sudo emerge -avuDN @world                          # deep, --newuse, --update
# Or fix just this advisory:
sudo glsa-check -p GLSA-202107-32             # preview what will change
sudo glsa-check -f GLSA-202107-32             # apply the GLSA fix
# Or target just the affected package (oneshot avoids world-set churn):
sudo emerge --update --oneshot dev-python/thrift
sudo emerge --depclean -a                          # drop now-orphaned deps
# Restart the affected service via the host's init system:
if [ -d /run/systemd/system ]; then 
  sudo systemctl daemon-reload; 
  systemctl list-unit-files | grep -i thrift | head; 
  sudo systemctl restart thrift; 
  systemctl is-active thrift 2>/dev/null; 
else 
  ls /etc/init.d/ | grep -i thrift | head; 
  sudo rc-service thrift restart; 
  sudo rc-status | grep -i thrift; 
fi
qlist -Iv dev-python/thrift                                    # confirm new version

For kernel advisories on sys-kernel/gentoo-sources, sys-kernel/gentoo-kernel, or sys-kernel/gentoo-kernel-bin, rebuild the kernel and reboot:

sudo emerge --update --oneshot sys-kernel/gentoo-kernel-bin   # binary path (no rebuild)
# OR rebuild a source-based kernel after eselect-pinning the new sources:
sudo eselect kernel list
sudo eselect kernel set 1
sudo emerge --config sys-kernel/gentoo-kernel       # rebuild + install image/initramfs
sudo emerge --ask sys-kernel/dracut sys-kernel/installkernel
sudo grub-mkconfig -o /boot/grub/grub.cfg           # if using GRUB
sudo systemctl reboot 2>/dev/null || sudo shutdown -r now

Solution – Alternative Approaches

If the primary patch is not viable, choose from these:

• Toggle USE flags rather than upgrading (when the GLSA recommends disabling a vulnerable feature):

  equery uses dev-python/thrift
  sudo euse -E <flag>                              # gentoolkit: enable globally
  sudo euse -D <flag>                              # gentoolkit: disable globally
  # Or per-package in /etc/portage/package.use/thrift:
  echo 'dev-python/thrift -<flag>' | sudo tee -a /etc/portage/package.use/thrift
  sudo emerge -avuDN @world

• Roll back to a known-good ebuild version via package.mask and binhost cache:

  sudo tee -a /etc/portage/package.mask <<<'>=dev-python/thrift-<bad-ver>'
  sudo emerge --oneshot --update dev-python/thrift
  # Or pull a binary from your binhost (PORTAGE_BINHOST):
  sudo emerge --getbinpkgonly dev-python/thrift

• Unmask a higher-version fix from ~arch (testing) when stable is lagging:

  sudo tee -a /etc/portage/package.accept_keywords <<<'dev-python/thrift ~amd64'
  sudo emerge --update --oneshot dev-python/thrift

• On hardened / SELinux profiles, switch to permissive briefly to confirm policy is the cause, then re-enforce:

  # reproduce, capture denials, author a custom module:

• Take an LVM snapshot before a world upgrade for fast rollback:

  sudo lvs
  sudo lvcreate -s -n preupgrade -L 4G /dev/<vg>/<lv>
  # revert later via:
  sudo lvconvert --merge /dev/<vg>/preupgrade && sudo reboot

• Stage the upgrade on a non-prod chroot or use a binhost (binary package host) so production hosts pull a pre-built fixed ebuild:

  # On the build host:
  sudo emerge --buildpkg --oneshot dev-python/thrift
  # /etc/portage/make.conf on the build host:
  #   FEATURES="buildpkg"
  #   PKGDIR="/srv/binpkgs"
  # On consumer hosts, set PORTAGE_BINHOST and pull:
  sudo emerge --getbinpkgonly --update dev-python/thrift

Verification & Acceptance Criteria

All of these should pass after the fix:

qlist -Iv dev-python/thrift                                            # expected fixed version
sudo glsa-check -l affected                                # this GLSA no longer listed
sudo glsa-check -t all                                     # test ALL outstanding GLSAs
if [ -d /run/systemd/system ]; then 
  systemctl is-active thrift 2>/dev/null; 
  sudo journalctl -u thrift --since "5 minutes ago" --no-pager | grep -iE "error|fail" || echo OK; 
else 
  sudo rc-status | grep -i thrift; 
fi
sudo nft list ruleset 2>/dev/null | head -20 || sudo iptables -S | head -20
sudo emerge --info | head -20                              # profile + USE flags snapshot

The conditions described in the advisory must no longer be reported for dev-python/thrift across two consecutive runs.

Rollback Plan

Capture state before any change:

qlist -Iv > /root/portage-pre.txt
sudo cp -a /var/db/pkg /root/var-db-pkg-pre        # full package metadata snapshot
sudo cp -a /etc/portage /root/etc-portage-pre
# Optional LVM snapshot of the root LV:
sudo lvcreate -s -n preupgrade -L 4G /dev/<vg>/<lv>

To revert if the patch is bad:

# Pull the previous binpkg from your binhost (if FEATURES=buildpkg is enabled):
sudo emerge --getbinpkgonly --oneshot =dev-python/thrift-<older-ver>
# Or mask the bad version so emerge picks the older slot:
sudo tee -a /etc/portage/package.mask <<<'>=dev-python/thrift-<bad-ver>'
sudo emerge --oneshot dev-python/thrift
# Restart the service on whichever init system is in use:
if [ -d /run/systemd/system ]; then 
  sudo systemctl daemon-reload; 
  sudo systemctl restart thrift; 
else 
  sudo rc-service thrift restart; 
fi
# Or merge the LVM snapshot and reboot:
sudo lvconvert --merge /dev/<vg>/preupgrade && sudo reboot
# Custom SELinux policy cleanup (hardened profile only):

Prevention & Hardening

Reduce the chance of this recurring on Gentoo Linux:

• Automate GLSA + world checks (cron / systemd timer):

  sudo emerge -av app-portage/gentoolkit app-portage/eix
  # Cron example (daily 03:00):
  sudo tee /etc/cron.daily/gentoo-security <<'SH'
  #!/bin/sh
  set -e
  emaint --auto sync >/dev/null
  glsa-check -l affected | tee /var/log/glsa-affected.log
  SH
  sudo chmod +x /etc/cron.daily/gentoo-security

• Subscribe to security.gentoo.org/glsa and the Gentoo news feed for upstream advisories.

• Run a local binhost for controlled rollouts across a Gentoo fleet (one build host, many consumers):

  # On the build host /etc/portage/make.conf:
  FEATURES="${FEATURES} buildpkg"
  PKGDIR="/srv/binpkgs"
  # Then publish /srv/binpkgs over HTTPS and set on consumers:
  PORTAGE_BINHOST="https://binhost.example.com/binpkgs/"
  FEATURES="${FEATURES} getbinpkg"

• Mask sensitive packages so they cannot be auto-upgraded without review:

  sudo tee -a /etc/portage/package.mask <<<'>dev-python/thrift-<pinned-ver>'
  sudo tee -a /etc/portage/package.accept_keywords <<<'dev-python/thrift ~amd64'

• Monitor file integrity with AIDE:

  sudo emerge -av app-forensics/aide
  sudo aide --init && sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
  sudo aide --check

• Consider the hardened profile (or hardened/selinux) where threat model warrants it:

  sudo eselect profile list | grep -i hardened
  sudo eselect profile set <hardened-profile-number>
  sudo emerge -avuDN @world                          # rebuild world against new profile

• Keep revdep-rebuild clean after every world upgrade, and rebuild downstream consumers of upgraded libs.

• Apply CIS Linux Benchmark hardening (where applicable) and remove unused USE flags / packages.

Related Errors & Cross-Refs

Issues that commonly surface alongside a dev-python/thrift update: Portage lock contention, USE-flag dependency cycles (blockers), revdep ABI mismatches, OpenRC / systemd unit ordering issues, and kernel taint flags. Useful triage:

sudo emerge --info | head
sudo emerge -puDN @world | tail -40                # preview pending updates
sudo revdep-rebuild -i -- -p                       # show broken libraries
sudo eix-test-obsolete                             # repo / overlay drift
cat /proc/sys/kernel/tainted
sudo glsa-check -l affected

View all gentoo-linux tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Primary reference: Gentoo GLSA GLSA-202107-32. Manual pages useful on Gentoo Linux:

man emerge
man portage
man glsa-check
man equery
man eix
man rc-service
man rc-update
man systemctl
man journalctl
man dispatch-conf
man revdep-rebuild

Other resources: wiki.gentoo.org, Gentoo GLSA index, packages.gentoo.org, and per-package notes in /usr/share/doc/thrift/ for components implicated in this advisory.

View all Gentoo Linux tutorials on the Tutorials Hub →