| Summary: | php-fpm Segfault in libnss3.so | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Christian Becker <dabecka> | ||||
| Component: | nss | Assignee: | Elio Maldonado Batiz <emaldona> | ||||
| Status: | CLOSED INSUFFICIENT_DATA | QA Contact: | BaseOS QE Security Team <qe-baseos-security> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 6.4 | CC: | dabecka, eparis, hkario, ksrot, rrelyea | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2014-07-01 19:31:15 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Attachments: |
|
||||||
|
Description
Christian Becker
2013-09-27 15:03:30 UTC
This issue is not triggered with every request. If we do our test case on the command line it always works fine. As soon as we switch to php-fpm we have about a 50/50 chance to hit this issue. So we think there could be a memory corruption caused by nss which is also causing https://bugzilla.redhat.com/show_bug.cgi?id=1013014 since the segfault in php-fpm triggers the NMI with abrtd. The probability for a hardware issue is pretty low here, since this happens on two different physical machines. This request was not resolved in time for the current release. Red Hat invites you to ask your support representative to propose this request, if still desired, for consideration in the next release of Red Hat Enterprise Linux. Created attachment 907695 [details]
modified reproducer
Christian unfortunately I'm unable to reproduce this issue.
I obviously can't use the reproducer from CentOS bug tracker as I don't have request.xml, pem_AICCq3 or key_10IoMb.
I've modified the reproducer (see attachment 907695 [details]) to work with just openssl s_server working in -Verify mode with openssl generated certificates/keys.
As far as I can see from the stacktrace, those changes shouldn't affect the issue, but please double check.
Also, the current version of NSS is 3.16.1-2, could you please try reproducing it with newer NSS?
Hi, unfortunately we had to do a quick fix and compiled libcurl against OpenSSL because we dealt with a very important system. We suspect a broken SSL Certificate at one of the endpoints we're connecting here. We also did some tests in the last couple of months, but had no chance in reproducing it again. It might be even harder since we have no copy of the original SSL Certificate which caused this bug and their server admins weren't any help. I guess the only chance to fix this is the information from the stacktrace, but reproducing it is very difficult. Since i guess i can't help you any further with solving this, it's up to you to decide wether this thicket should be closed or not. |