lkml.org 
[lkml]   [1999]   [Jan]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: 2.2.0 SECURITY
    Date
    David S. Miller writes the following:
    >What it should be doing is:
    >
    >1) Exec'ing /lib/ld-linux.so.2
    >2) That reads in the ELF header of the core file
    >3) Next it mmap's all of the segments
    >4) Next it jumps into lala-land in on of the final mmaps
    > is got, and dies with an illegal instruction on Sparc
    >
    >I think something hokey is happening at step #4 on Intel if the timing
    >is right as the process is being killed...

    Well, here's a strace -i -f ldd notcore:

    [pid 378] [2aab1127] geteuid() = 500
    [pid 378] [2aab11a7] getegid() = 500
    [pid 378] [2aab13ec] brk(0) = 0x2aab49f8
    [pid 378] [2aab13ec] brk(0x2aab59f8) = 0x2aab59f8
    [pid 378] [2aab1304] open("./notcore", O_RDONLY) = 3
    [pid 378] [2aab14dd] mmap(0, 4096, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40000000
    [pid 378] [2aab1521] munmap(0x40000000, 4096) = 0
    [pid 378] [2aab14dd] mmap(0x8048000, 4096, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x8048000
    [pid 378] [2aab14dd] mmap(0x8049000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x1000) = 0x8049000
    [pid 378] [2aab14dd] mmap(0x40000000, 40960, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x40000000
    [pid 378] [2aab14dd] mmap(0x4000a000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x2000) = 0x4000a000
    [pid 378] [2aab14dd] mmap(0x4000e000, 593920, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x4000e000
    [pid 378] [2aab14dd] mmap(0x4009f000, 32768, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x3000) = 0x4009f000
    [pid 378] [2aab14dd] mmap(0x400a7000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0xb000) = 0x400a7000
    [pid 378] [2aab14dd] mmap(0xbffff000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0x17000free_one_pmd: bad directory entry 000001e3
    ) = 0xbffff000
    afterwards, it's not dead, but the ldd is hung, and ps shows:
    tmpguy 377 0.0 0.2 1212 676 1 T 19:54 0:00 sh /usr/bin/ldd notcore
    tmpguy 378 0.0 0.0 764 44 1 R 19:54 0:00 \37777777777\37777777773 \017 \37777777666\37777777776\37777777777\37777777677
    /proc/378/maps is:
    08048000-08049000 r-xp 00000000 00:00 0
    08049000-0804a000 rw-p 00001000 08:09 17 /tmp/notcore
    2aaaa000-2aab4000 r-xp 00000000 08:01 1997 /lib/ld-2.0.7.so
    2aab4000-2aab5000 rw-p 00009000 08:01 1997 /lib/ld-2.0.7.so
    2aab5000-2aab6000 rwxp 00000000 00:00 0
    40000000-4000a000 r-xp 00000000 00:00 0
    4000a000-4000b000 rw-p 00002000 08:09 17 /tmp/notcore
    4000e000-4009f000 r-xp 00000000 00:00 0
    4009f000-400b3000 rw-p 00003000 08:09 17 /tmp/notcore
    bffff000-c0000000 rwxp 00017000 08:09 17 /tmp/notcore
    Everything degenerates pretty quickly after that though, with the pc speaker
    going into continuous-beep to signal when it's time to hit the big red
    button.

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:50    [from the cache]
    ©2003-2014 Jasper Spaans. hosted at Digital Ocean