Bug 1448223
| Summary: | [abrt] kpartx: set_delimiter(): kpartx killed by SIGSEGV | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Ben Marzinski <bmarzins> |
| Component: | device-mapper-multipath | Assignee: | Ben Marzinski <bmarzins> |
| Status: | CLOSED ERRATA | QA Contact: | Lin Li <lilin> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.4 | CC: | agk, bmarzins, extras-qa, fedora, heinzm, jbrassow, lilin, lvm-team, msnitzer, prajnoha, prockai |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| URL: | https://retrace.fedoraproject.org/faf/reports/bthash/8b9900d9e87e18787862f46c43aa3157f4d72907 | ||
| Whiteboard: | abrt_hash:7c9aeaa942cbac975a8c77735b31c10d5f628205; | ||
| Fixed In Version: | device-mapper-multipath-0.4.9-112.el7 | Doc Type: | Bug Fix |
| Doc Text: |
Cause: If kpartx was passes something other than a file or a block device or a badly formed pathname, it could read off the end of the device string, and crash.
Consequence: kpartx was crashing instead of failing gracefully, when it was called with invalid options
Fix: kpartx now is more careful with it's string processing, and it also simply exits if not passed a file or a block device.
Result: kpartx no longer crashes when called with invalid options.
|
Story Points: | --- |
| Clone Of: | 1447832 | Environment: | |
| Last Closed: | 2018-04-10 16:10:28 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1447832 | ||
| Bug Blocks: | 1469559 | ||
|
Description
Ben Marzinski
2017-05-04 20:58:04 UTC
kpartx was crashing when it was run on something that was not a block device or regular file. It now fails gracefully in these situations. If you write
> it could read off the end of the device string, and crash.
do you think it is possible to exploit this bug? Is it worth for a CVE?
(In reply to sedrubal from comment #4) > If you write > > > it could read off the end of the device string, and crash. > > do you think it is possible to exploit this bug? Is it worth for a CVE? Not that I can think of. In the first place, you can only call kpartx as root. There's no possibility of writing any data to this memory. kpartx doesn't have information in memory that would be dangerous to reveal, and if it tries to access something outside its memory, it will crash. I don't think this is any more dangerous than any other bug with a program deferencing an invalid pointer. Reproduced on device-mapper-multipath-0.4.9-111.el7 1, # rpm -qa | grep multipath device-mapper-multipath-0.4.9-111.el7.x86_64 device-mapper-multipath-libs-0.4.9-111.el7.x86_64 2, # kpartx -l / Missing major number for persistent device. Couldn't create ioctl argument. Missing major number for persistent device. Couldn't create ioctl argument. Segmentation fault <------------------------- 3, # dmesg [83221.401992] kpartx[513]: segfault at 7ffe00000001 ip 0000000000402b33 sp 00007ffe116823f0 error 4 in kpartx[400000+8000] 4, check /var/log/messages: Dec 22 03:46:43 localhost kernel: kpartx[513]: segfault at 7ffe00000001 ip 0000000000402b33 sp 00007ffe116823f0 error 4 in kpartx[400000+8000] Verified on device-mapper-multipath-0.4.9-118.el7 1, # rpm -qa | grep multipath device-mapper-multipath-debuginfo-0.4.9-118.el7.x86_64 device-mapper-multipath-libs-0.4.9-118.el7.x86_64 device-mapper-multipath-devel-0.4.9-118.el7.x86_64 device-mapper-multipath-sysvinit-0.4.9-118.el7.x86_64 device-mapper-multipath-0.4.9-118.el7.x86_64 2, # kpartx -l / invalid device: / <-----------tips invalid device: / 3, # dmesg No Segmentation fault 4, check /var/log/messages: No Segmentation fault Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2018:0884 |