[SUMMARY] libsafe broken by glibc-2.3.2?

On Fri, 2003-04-18 at 01:17, Warren Togami wrote:
> The following was posted to Red Hat's shrike-list when I discovered what
> I believe to be libsafe breakage due to changes in glibc-2.3.2.  Since
> this post I have confirmed that it also crashes useradd in Mandrake 9.1,
> further confirming my glibc cause suspicion rather than useradd.  My
> debugging skills are poor so I ask for your expert opinion on this
> question.  Thanks!
> 
[SNIP]
> 
> Could some change in glibc-2.3.2 have broken an assumption that libsafe
> makes (thus libsafe needs fixing) or is this exposing a potential flaw
> in useradd?  This seems to be the only 100% reproducible libsafe induced
> crash that I am able to find so far.

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=89145
Wow... within minutes of me posting, Enrico Scholz discovered use of
uninitialized memory in useradd.  A short while later he posted this
patch that seems to fix the problem.

Summary:
useradd had a flaw, but it wasn't exposed until this combination of
glibc-2.3.2 and libsafe.  glibc-2.3.2 alone didn't expose the segfault,
and older versions of glibc + libsafe didn't either.  Interesting.

If I understand the libsafe docs properly, it itself isn't supposed to
introduce SIGSEGV during runtime, instead SIGKILL when it detects a
buffer overflow or format string exploit.  Now that I think about it,
perhaps libsafe triggered some of the extremely rare random crashes of
Gnome components that I began seeing this past week... 

Perhaps libsafe still works as promised, and combined with the new glibc
it also helps you discover subtle bugs otherwised missed before?  This
seems interesting, I'd like to find out exactly what changed in glibc
that exposed this behavior in combination with libsafe.

In any case, I feel better about continuing to use libsafe to add some
exploit protection to my servers.

Warren Togami
warren-ZewH/[email protected]

p.s. 1 hour 20 minutes turnaround time for a bug fix.  Open Source
works!
_______________________________________________
LinuxManagers mailing list - http://www.linuxmanagers.org
submissions: LinuxManagers-35TzE1X9F6582KRnZfj+bdi2O/[email protected]
subscribe/unsubscribe: http://www.linuxmanagers.org/mailman/listinfo/linuxmanagers