Vulnerability Development mailing list archives

Bug in linuxthreads-2.0.6


From: silvio.cesare () hushmail com
Date: Mon, 10 Jun 2002 19:15:01 -0700


There appears to be a 'simple bug in the semaphore implementation of
linuxthreads-2.0.6' (I quote this from the glibc bug archive - url is
below).

I think there are lots of people running this code, so i figure i should
conspire with the rest of the industry, to tell the public of this
d4nger0uz bug.  I did a bugtraq archive search and did n0t see any
reportz of this, so I am guessing "no-one knows about this".

umm, yah.. my postz to bugtraq were moderated last week, but you can find them
here at -->

www.big.net.au/~silvio/monkey-Bussines.txt
www.big.net.au/~silvio/gg.txt

pleaze send me your repliez.

# P4RT 1
--------

http://sources.redhat.com/ml/bug-glibc/2001-05/msg00109.html has some
information on thiz bug.

From the linuxthreads ChangeLog.

2001-05-25  Ulrich Drepper  <drepper () redhat com>

        * oldsemaphore.c (__old_sem_wait): Clear p_nextwaiting before
        returning successfully.
        Patch by Gene Cooperman <gene () ccs neu edu>.

yah.. this bug can crash your code in lotz of places, so I suggest you
use some conditional compilation or something.. oh yah, this leads to
part two of my advisory -->

# P4RT 2
--------

Redhat 7.0 incorrectly sets the glibc minor version in the include filez
etc.. It uses a modified glibc 2.1, but marks the minor version as
2, so you might still have this bug even if you try to work around it.
Redhat 7.1 moves over to glibc 2.2 for real this time, where the bug
is fixed.

--
Silvio

Communicate in total privacy.
Get your free encrypted email at https://www.hushmail.com/?l=2

Looking for a good deal on a domain name? http://www.hush.com/partners/offers.cgi?id=domainpeople


Current thread: