Re: SuSE 7.3 : Kernel 2.4.10-4GB Bug

[Andrea Arcangeli <andrea () suse de>]

On Thu, Nov 22, 2001 at 12:04:58AM +0000, Luciano Miguel Ferreira Rocha wrote:
> I've been able to reproduce the results (instant reboot) by running the
> vmlinux as a normal user in a clean Linux 2.4.10 plus ext3,
> on Red Hat Linux system, Pentium 233 MMX processor.
>
> I coulnd't reproduce the reboot in a Piii 750, kernel 2.4.15-pre2, either
> normal or root user (good SIGSEGV :)).
>
> It looks like it is a problem within the original kernel, and that it
> has been fixed in later releases...

Correct. The bug is been fixed in 2.4.11pre3 (most of the credit for the
finding the bug and fixing it goes to Linus btw).

All 2.4 kernels before 2.4.12 are affected by such bug. It shouldn't be
expoitable, it should only lead to a local DoS.

A patch to fix vanilla 2.4.10 can be downloaded from here:

        ftp://ftp.us.kernel.org/pub/linux/kernel/people/andrea/patches/v2.4/2.4.10/binfmt_elf-checks-1

A patch to fix the 2.4.10.SuSE-7.3 kernel (both the original one in the
CDs, and also the first kernel security update) can be downloaded from
here:

        ftp://ftp.us.kernel.org/pub/linux/kernel/people/andrea/patches/v2.4/2.4.10.SuSE-7.3/binfmt_elf-checks-1

The above two fixes cures more than just the vmlinux crash, there were
further checks missing, and the above two patches just includes the
further checks as well. If you run a recent kernel (>=2.4.12) and you
want the further checks (even if not necessary just for the vmlinux
crash) this is the patch that you can apply:

        ftp://ftp.us.kernel.org/pub/linux/kernel/people/andrea/kernels/v2.4/2.4.15pre7aa1/00_binfmt-elf-checks-1

The crash is generated by the missing error checks for the mmap/brk
implicit calls while mapping the elf files during execve. The x86
vmlinux elf image claims to be mapped over 3G (that's the kernel image
and the kernel runs there), so the binfmt elf loader tries to map the
vmlinux elf image there, and the mapping fails (because that's kernel
space, not userspace) but the loader doesn't notice and crashes.

On the SuSE side, more about SuSE kernel update rpm packages is to be
announced soon.

Andrea