[Full-Disclosure] more segfaults on Redhat 6.x when passing "/proc/misc" as a parameter

From: Dr. Peter Bieringer (pbieringer@aerasec.de)
Date: 10/29/02 

From: pbieringer@aerasec.de (Dr. Peter Bieringer)
Date: Tue, 29 Oct 2002 10:24:42 +0100

--==========02167080==========
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

--On Dienstag, 29. Oktober 2002 08:26 +0200 Pekka Savola
<pekkas@netcore.fi> wrote:

> On Mon, 28 Oct 2002, Day Jay wrote:
>> Hi, "more" segfaults when you pass "/proc/misc" to it
>> as a parameter. This happens on my Redhat 6.0 and my
>> Redhat 6.2 box. More is setuid root. See below:
> [...]
>=20
> This appears to be very bogus. 'more' is never setuid unless you made it =

> so...
>=20
> I didn't manage to segfaul 'more' on RHL62 box either..

But me here as "root" and as a normal user.
Using kernel-2.2.22-6.2.2 with openwall patch and libsafe-1.3
Tested on 2 systems.

BTW: cat and less are ok.

strace:

stat("/proc/misc", {st_mode=3DS_IFREG|0444, st_size=3D0, ...}) =3D 0
open("/proc/misc", O_RDONLY) =3D 3
read(3, "134 apm\n135 rtc\n", 2) =3D 16
read(3, "", 4294967282) =3D 0
fstat(3, {st_mode=3DS_IFREG|0444, st_size=3D0, ...}) =3D 0
old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) =3D 0x24a000
_llseek(3, 0, [0], SEEK_SET) =3D 0
--- SIGSEGV (Segmentation fault) ---
+++ killed by SIGSEGV +++

ltrace:

__xstat(3, "/proc/misc", 0xbffff9f0) =3D 0
fopen("/proc/misc", "r") =3D 0x08052570
fread(0xbffff9d6, 2, 1, 0x08052570) =3D 8
fseek(0x08052570, 0, 0, 0x08052570, 0xbffffc0c) =3D 0
--- SIGSEGV (Segmentation fault) ---
+++ killed by SIGSEGV +++

gdb/core doesn't show anything useful

Reading symbols from /lib/libdl.so.2...done.
Reading symbols from /lib/ld-linux.so.2...done.
#0 0x70612034 in ?? ()
(gdb) bt
#0 0x70612034 in ?? ()
(gdb) bt
#0 0x70612034 in ?? ()
(gdb) quit

        Peter 

--
Dr. Peter Bieringer                        Phone: +49-8102-895190
AERAsec Network Services and Security GmbH   Fax: +49-8102-895199
Wagenberger Stra=DFe 1                      Mobile: +49-174-9015046
D-85662 Hohenbrunn                   mailto:pbieringer@aerasec.de
Germany                           Internet: http://www.aerasec.de
PGP/GPG:  http://www.aerasec.de/wir/publickeys/PeterBieringer.asc
--==========02167080==========
Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (MingW32)
iD8DBQE9vlPfznfbvpHmKq4RAuGAAJ4jj2/mIO+rYo+uNLaMQ+QTEgOqlgCfef0Y
+Q1PTPXwgazKNPo7iWXQ4JI=
=3dm/
-----END PGP SIGNATURE-----
--==========02167080==========--

Relevant Pages