Vulnerability Development mailing list archives

Re: is this a bug ?


From: Jonathan James <jonathan () SECURITO SE>
Date: Sun, 10 Dec 2000 13:35:27 +0100

Guy,
No this isn't a bug, you are forcing the CPU into an infinite loop..
First you jump to "start" where the "call doit" instruction is passed.
When the CPU has executed the instructions at label "doit" it will continue
to execute whatever follows, i.e label "start" again which
just jumps back to label "doit".

Kindest Regards
Jonathan James

Hello,

first i mast explain i am no programmer, i just read a few documents
on the web and try to play with stuff. If this is inappropriate here
please tell me and except my apologize.

anyhow,
i have this asm code:

.global id
.global end
.data
id:
        jmp start
doit:
        popl %esi
        movl %esi,0x08(%esi)
        xorl %eax,%eax
        movb %eax,0x07(%esi)
        movl %eax,0xc(%esi)

        movb $0xb,%eax
        movl %esi,%ebx
        leal 0x8(%esi),%ecx
        xorl %edx,%edx
        int  $0x80

start:
        call doit
        .string "/bin/idX"
end:

and the c to run it:
extern void id();
extern void end();
main()
{
  id();
}

both a ripof from Marc Blumenauer <marc () system-security net>

but what strikes me odd is that if i cange any of the length of the string
to a wrong lenght (0x09 for example)  my cpu get to 98.8 usage % after 5
seconds. (this is run by regular user)

Can any one explain/verify this on a computer with more the 133MHz and 48
RAM ?


Cheers,

Guy



Current thread: