lkml.org 
[lkml]   [1998]   [Sep]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Subjectdevpts bug fix (2.1.121 is still affected)
Date
From

Looks like my previous attempts to get this to the right people failed. The
bug reads memory beyond the end of an array and might have dire conseuqneces
if you are really unlucky. 98% of the time in oopses and leaves a process in
permanent
uninteruptable sleep. The attachment is source for a silly demo program
(assumes <667 unix 98 ptys configured).

This patches fixes a bug that is present in 2.1.115 at least. To demonstrate
log into another terminal and type
cat /dev/pts/666 (WARNNIG: this locks the terminal)
and you get an oops. Switiching to the other terminal shows that command
in disk waiting state, so you can not kill it. Worse it says there for all
time. If you discover that /dev/pts/666 does not exist and no panic your system
is not affected by the bug this patch fixes.

If your system is affected this patch will fix it. The bug is a simple lack
of bounds checking on the size of entry. If entry is too big (normally this
means >= 256) then sbi->inodes[] is memory that has not been allocated for
that purpose. After applying the patch the oops goes away and you discover
that /dev/pts/666 does not exist.

Since this is a kernel exploit fancy fireworks might hit your system, of course
if you are really unlucky. The patch assumes you are in the
/usr/src/linux/fs/devpts directory. This will probably get fixed "officially"
soon. (2.1.117 seems to be still affected).

BTW The only method of freeing up the process table entry used by that cat
command is rebooting. Bad guys could write a program that forks off processes
that exploit this bug and then exploits itself to tie process table entries,
obviously. That could be bad news.


--- linux/fs/devpts/root.c.dist Thu Aug 13 17:54:17 1998
+++ linux/fs/devpts/root.c Thu Aug 13 20:33:50 1998
@@ -159,10 +159,12 @@
entry += (*p++ - '0');
}
}
-
- dentry->d_inode = sbi->inodes[entry];
- if ( dentry->d_inode )
- dentry->d_inode->i_count++;
+ if (entry<sbi->max_ptys) /* Check range of number */
+ {
+ dentry->d_inode = sbi->inodes[entry];
+ if ( dentry->d_inode )
+ dentry->d_inode->i_count++;
+ }

d_add(dentry, dentry->d_inode);


--
Duncan (-:
"software industry, the: unique industry where selling substandard goods is
legal and you can charge extra for fixing the problems."



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/faq.html

\
 
 \ /
  Last update: 2005-03-22 13:44    [from the cache]
©2003-2011 Jasper Spaans