[lkml]   [1998]   [Sep]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subjectdevpts bug fix (2.1.121 is still affected)

    Looks like my previous attempts to get this to the right people failed. The
    bug reads memory beyond the end of an array and might have dire conseuqneces
    if you are really unlucky. 98% of the time in oopses and leaves a process in
    uninteruptable sleep. The attachment is source for a silly demo program
    (assumes <667 unix 98 ptys configured).

    This patches fixes a bug that is present in 2.1.115 at least. To demonstrate
    log into another terminal and type
    cat /dev/pts/666 (WARNNIG: this locks the terminal)
    and you get an oops. Switiching to the other terminal shows that command
    in disk waiting state, so you can not kill it. Worse it says there for all
    time. If you discover that /dev/pts/666 does not exist and no panic your system
    is not affected by the bug this patch fixes.

    If your system is affected this patch will fix it. The bug is a simple lack
    of bounds checking on the size of entry. If entry is too big (normally this
    means >= 256) then sbi->inodes[] is memory that has not been allocated for
    that purpose. After applying the patch the oops goes away and you discover
    that /dev/pts/666 does not exist.

    Since this is a kernel exploit fancy fireworks might hit your system, of course
    if you are really unlucky. The patch assumes you are in the
    /usr/src/linux/fs/devpts directory. This will probably get fixed "officially"
    soon. (2.1.117 seems to be still affected).

    BTW The only method of freeing up the process table entry used by that cat
    command is rebooting. Bad guys could write a program that forks off processes
    that exploit this bug and then exploits itself to tie process table entries,
    obviously. That could be bad news.

    --- linux/fs/devpts/root.c.dist Thu Aug 13 17:54:17 1998
    +++ linux/fs/devpts/root.c Thu Aug 13 20:33:50 1998
    @@ -159,10 +159,12 @@
    entry += (*p++ - '0');
    - dentry->d_inode = sbi->inodes[entry];
    - if ( dentry->d_inode )
    - dentry->d_inode->i_count++;
    + if (entry<sbi->max_ptys) /* Check range of number */
    + {
    + dentry->d_inode = sbi->inodes[entry];
    + if ( dentry->d_inode )
    + dentry->d_inode->i_count++;
    + }

    d_add(dentry, dentry->d_inode);

    Duncan (-:
    "software industry, the: unique industry where selling substandard goods is
    legal and you can charge extra for fixing the problems."

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:44    [W:0.021 / U:53.100 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site