Messages in this thread | | | From | "pacman" <> | Subject | Re: 2.2.0 SECURITY | Date | Wed, 27 Jan 1999 03:32:12 -0500 (EST) |
| |
David S. Miller writes the following: >What it should be doing is: > >1) Exec'ing /lib/ld-linux.so.2 >2) That reads in the ELF header of the core file >3) Next it mmap's all of the segments >4) Next it jumps into lala-land in on of the final mmaps > is got, and dies with an illegal instruction on Sparc > >I think something hokey is happening at step #4 on Intel if the timing >is right as the process is being killed...
Well, here's a strace -i -f ldd notcore:
[pid 378] [2aab1127] geteuid() = 500 [pid 378] [2aab11a7] getegid() = 500 [pid 378] [2aab13ec] brk(0) = 0x2aab49f8 [pid 378] [2aab13ec] brk(0x2aab59f8) = 0x2aab59f8 [pid 378] [2aab1304] open("./notcore", O_RDONLY) = 3 [pid 378] [2aab14dd] mmap(0, 4096, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40000000 [pid 378] [2aab1521] munmap(0x40000000, 4096) = 0 [pid 378] [2aab14dd] mmap(0x8048000, 4096, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x8048000 [pid 378] [2aab14dd] mmap(0x8049000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x1000) = 0x8049000 [pid 378] [2aab14dd] mmap(0x40000000, 40960, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x40000000 [pid 378] [2aab14dd] mmap(0x4000a000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x2000) = 0x4000a000 [pid 378] [2aab14dd] mmap(0x4000e000, 593920, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x4000e000 [pid 378] [2aab14dd] mmap(0x4009f000, 32768, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x3000) = 0x4009f000 [pid 378] [2aab14dd] mmap(0x400a7000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0xb000) = 0x400a7000 [pid 378] [2aab14dd] mmap(0xbffff000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0x17000free_one_pmd: bad directory entry 000001e3 ) = 0xbffff000
afterwards, it's not dead, but the ldd is hung, and ps shows: tmpguy 377 0.0 0.2 1212 676 1 T 19:54 0:00 sh /usr/bin/ldd notcore tmpguy 378 0.0 0.0 764 44 1 R 19:54 0:00 \37777777777\37777777773 \017 \37777777666\37777777776\37777777777\37777777677
/proc/378/maps is: 08048000-08049000 r-xp 00000000 00:00 0 08049000-0804a000 rw-p 00001000 08:09 17 /tmp/notcore 2aaaa000-2aab4000 r-xp 00000000 08:01 1997 /lib/ld-2.0.7.so 2aab4000-2aab5000 rw-p 00009000 08:01 1997 /lib/ld-2.0.7.so 2aab5000-2aab6000 rwxp 00000000 00:00 0 40000000-4000a000 r-xp 00000000 00:00 0 4000a000-4000b000 rw-p 00002000 08:09 17 /tmp/notcore 4000e000-4009f000 r-xp 00000000 00:00 0 4009f000-400b3000 rw-p 00003000 08:09 17 /tmp/notcore bffff000-c0000000 rwxp 00017000 08:09 17 /tmp/notcore
Everything degenerates pretty quickly after that though, with the pc speaker going into continuous-beep to signal when it's time to hit the big red button.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |