Red Hat Bugzilla – Bug 1448223
[abrt] kpartx: set_delimiter(): kpartx killed by SIGSEGV
Last modified: 2018-04-10 12:10:28 EDT
+++ This bug was initially created as a clone of Bug #1447832 +++ Version-Release number of selected component: kpartx-0.4.9-83.fc25 Additional info: reporter: libreport-2.8.0 backtrace_rating: 4 cmdline: kpartx -l / crash_function: set_delimiter executable: /usr/sbin/kpartx global_pid: 2449 kernel: 4.10.13-200.fc25.x86_64 pkg_fingerprint: 4089 D8F2 FDB1 9C98 pkg_vendor: Fedora Project runlevel: N 5 type: CCpp uid: 0 Truncated backtrace: Thread no. 1 (1 frames) #0 set_delimiter at kpartx.c:117 --- Additional comment from sedrubal on 2017-05-03 21:47:21 EDT --- --- Additional comment from sedrubal on 2017-05-03 21:47:23 EDT --- --- Additional comment from sedrubal on 2017-05-03 21:47:24 EDT --- --- Additional comment from sedrubal on 2017-05-03 21:47:26 EDT --- --- Additional comment from sedrubal on 2017-05-03 21:47:28 EDT --- --- Additional comment from sedrubal on 2017-05-03 21:47:29 EDT --- --- Additional comment from sedrubal on 2017-05-03 21:47:31 EDT --- --- Additional comment from sedrubal on 2017-05-03 21:47:34 EDT --- --- Additional comment from sedrubal on 2017-05-03 21:47:36 EDT --- --- Additional comment from sedrubal on 2017-05-03 21:47:38 EDT --- --- Additional comment from sedrubal on 2017-05-03 21:47:40 EDT --- --- Additional comment from sedrubal on 2017-05-03 21:47:41 EDT --- --- Additional comment from sedrubal on 2017-05-03 21:47:43 EDT --- --- Additional comment from Ben Marzinski on 2017-05-04 16:56:08 EDT --- Thanks for the report. This will only happen if you run kpartx on something other than a regular file or a block device. I'll fix it up so that it handles this gracefully.
kpartx was crashing when it was run on something that was not a block device or regular file. It now fails gracefully in these situations.
If you write > it could read off the end of the device string, and crash. do you think it is possible to exploit this bug? Is it worth for a CVE?
(In reply to sedrubal from comment #4) > If you write > > > it could read off the end of the device string, and crash. > > do you think it is possible to exploit this bug? Is it worth for a CVE? Not that I can think of. In the first place, you can only call kpartx as root. There's no possibility of writing any data to this memory. kpartx doesn't have information in memory that would be dangerous to reveal, and if it tries to access something outside its memory, it will crash. I don't think this is any more dangerous than any other bug with a program deferencing an invalid pointer.
Reproduced on device-mapper-multipath-0.4.9-111.el7 1, # rpm -qa | grep multipath device-mapper-multipath-0.4.9-111.el7.x86_64 device-mapper-multipath-libs-0.4.9-111.el7.x86_64 2, # kpartx -l / Missing major number for persistent device. Couldn't create ioctl argument. Missing major number for persistent device. Couldn't create ioctl argument. Segmentation fault <------------------------- 3, # dmesg [83221.401992] kpartx[513]: segfault at 7ffe00000001 ip 0000000000402b33 sp 00007ffe116823f0 error 4 in kpartx[400000+8000] 4, check /var/log/messages: Dec 22 03:46:43 localhost kernel: kpartx[513]: segfault at 7ffe00000001 ip 0000000000402b33 sp 00007ffe116823f0 error 4 in kpartx[400000+8000] Verified on device-mapper-multipath-0.4.9-118.el7 1, # rpm -qa | grep multipath device-mapper-multipath-debuginfo-0.4.9-118.el7.x86_64 device-mapper-multipath-libs-0.4.9-118.el7.x86_64 device-mapper-multipath-devel-0.4.9-118.el7.x86_64 device-mapper-multipath-sysvinit-0.4.9-118.el7.x86_64 device-mapper-multipath-0.4.9-118.el7.x86_64 2, # kpartx -l / invalid device: / <-----------tips invalid device: / 3, # dmesg No Segmentation fault 4, check /var/log/messages: No Segmentation fault
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2018:0884