Description of problem: pam segfaults on bad input We have a typo in "/etc/pam.d/su", an 'i' has been left at line 6: ----------------- #%PAM-1.0 auth sufficient /lib/security/$ISA/pam_rootok.so # Uncomment the following line to implicitly trust users in the "wheel" group. auth sufficient /lib/security/$ISA/pam_wheel.so debug trust use_uid # Uncomment the following line to require a user to be in the "wheel" group. i# auth required /lib/security/$ISA/pam_wheel.so debug use_uid auth required /lib/security/$ISA/pam_stack.so service=system-auth account sufficient /lib/security/$ISA/pam_succeed_if.so uid=0 use_uid quiet account required /lib/security/$ISA/pam_stack.so service=system-auth password required /lib/security/$ISA/pam_stack.so service=system-auth # pam_selinux.so close must be first session rule session required /lib/security/$ISA/pam_selinux.so close session required /lib/security/$ISA/pam_stack.so service=system-auth # pam_selinux.so open and pam_xauth must be last two session rules session required /lib/security/$ISA/pam_selinux.so open session optional /lib/security/$ISA/pam_xauth.so ----------------- Executing 'su' then results in a segmentation fault. strace says: ------------- munmap(0xb7d23000, 4096) = 0 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1098, ...}) = 0 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1098, ...}) = 0 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1098, ...}) = 0 socket(PF_FILE, SOCK_DGRAM, 0) = 4 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 connect(4, {sa_family=AF_FILE, path="/dev/log"}, 16) = 0 send(4, "<11>Mar 11 00:01:41 su: PAM (su)"..., 55, MSG_NOSIGNAL) = 55 --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ ------------- A problem with instruction lines should be handled differently than with SIGSEGV. If the typo is removed, things are well. Version-Release number of selected component (if applicable): coreutils-5.2.1-31.7 How reproducible: Always See also bug #211756
Thanks for report... similar situation as in #211756. su is not seg faulting, libpam is ... gdb reports: Program received signal SIGSEGV, Segmentation fault. 0x006ec2cd in _pam_strCMP () from /lib/libpam.so.0 Same (or very similar) debian bug report seems to be in http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=330097 Can't reproduce on my Fedora and RHEL-4 coreutils, so the problem is most probably not in su. Redirecting component to pam (libpam) as almost certain cause of crash.
This is fixed in later Linux PAM releases (as of RHEL-5 and newer) by changes to the pam config file parser. The crash is not a security issue because it is only a NULL pointer dereference. It is also not a DoS because the error in config file would cause the authentication fail anyway (in the newer releases).