[Bug libc/12492] New: dl: RELRO handling crashes when PaX kernel enforces MPROTECT restrictions

[Bug libc/12492] New: dl: RELRO handling crashes when PaX kernel enforces MPROTECT restrictions

[linkfanel at yahoo dot fr]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

           Summary: dl: RELRO handling crashes when PaX kernel enforces
                    MPROTECT restrictions
           Product: glibc
           Version: 2.11
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper.fsp@gmail.com
        ReportedBy: linkfanel@yahoo.fr


Created attachment 5242
  --> http://sourceware.org/bugzilla/attachment.cgi?id=5242
Proposed fix

See Debian bug http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=611195

When dlopen'ing a library that needs to make the stack executable, the RELRO
section is made writable again to modify the __stack_prot variable. However,
the return value of the mprotect() call is not checked; so if mprotect() fails,
instead of gracefully handling the error, the dynamic loader tries to write to
__stack_prot anyway, which results in a segmentation fault. And this mprotect()
call *will* fail on PaX kernels that enforce restrictions on it.

The simple fix is to check the return value and simply fail to load the
problematic library, instead of crashing the whole process. And it's just good
programming practice.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12492] dl: RELRO handling crashes when PaX kernel enforces MPROTECT restrictions

[drepper.fsp at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

Ulrich Drepper <drepper.fsp at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |WONTFIX

--- Comment #1 from Ulrich Drepper <drepper.fsp at gmail dot com> 2011-02-15 19:30:30 UTC ---
Just use a supported kernel.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12492] dl: RELRO handling crashes when PaX kernel enforces MPROTECT restrictions

[pageexec at freemail dot hu]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

PaX Team <pageexec at freemail dot hu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
                 CC|                            |pageexec at freemail dot hu
         Resolution|WONTFIX                     |

--- Comment #2 from PaX Team <pageexec at freemail dot hu> 2011-02-15 20:03:46 UTC ---
mprotect() can fail on supported kernels (what are they anyway?), so it is
simply bad programming practice to not check the return value.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12492] dl: RELRO handling crashes when PaX kernel enforces MPROTECT restrictions

[drepper.fsp at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

Ulrich Drepper <drepper.fsp at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
         Resolution|                            |WONTFIX

--- Comment #3 from Ulrich Drepper <drepper.fsp at gmail dot com> 2011-02-17 05:45:00 UTC ---
No, it cannot fail in these situations.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12492] dl: RELRO handling crashes when PaX kernel enforces MPROTECT restrictions

[pageexec at freemail dot hu]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

PaX Team <pageexec at freemail dot hu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|WONTFIX                     |

--- Comment #4 from PaX Team <pageexec at freemail dot hu> 2011-02-17 10:02:59 UTC ---
merging and splitting vma structures require memory allocation that can fail.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12492] dl: RELRO handling crashes when PaX kernel enforces MPROTECT restrictions

[pageexec at freemail dot hu]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

--- Comment #5 from PaX Team <pageexec at freemail dot hu> 2011-02-17 10:25:43 UTC ---
i almost forgot, you didn't answer my question: what is your definition of a
supported kernel?

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12492] dl: RELRO handling crashes when PaX kernel enforces MPROTECT restrictions

[drepper.fsp at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

Ulrich Drepper <drepper.fsp at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
         Resolution|                            |WONTFIX

--- Comment #6 from Ulrich Drepper <drepper.fsp at gmail dot com> 2011-02-18 16:40:41 UTC ---
Stop reopening the bug.  If you have to redefine what your own OS does then
maintain your own version of everything else as well.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12492] dl: RELRO handling crashes when PaX kernel enforces MPROTECT restrictions

[ireopenit at mailinator dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

ireopenit at mailinator dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
                 CC|                            |ireopenit at mailinator dot
                   |                            |com
         Resolution|WONTFIX                     |

--- Comment #7 from ireopenit at mailinator dot com 2011-02-18 16:53:35 UTC ---
Do you have any real reason not to apply the submitted patch? Childish spite
doesn't count.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12492] dl: RELRO handling crashes when PaX kernel enforces MPROTECT restrictions

[kees at outflux dot net]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

Kees Cook <kees at outflux dot net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |kees at outflux dot net

--- Comment #8 from Kees Cook <kees at outflux dot net> 2011-02-18 17:08:11 UTC ---
The stock Linux kernel can fail the mprotect call. The LSM mediates this
routine. Even SELinux has hooks to reject certain calls. It seems prudent to
check the return code since LSMs are being improved/changed all the time.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12492] dl: RELRO handling crashes when PaX kernel enforces MPROTECT restrictions

[pageexec at freemail dot hu]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

--- Comment #9 from PaX Team <pageexec at freemail dot hu> 2011-02-18 19:43:01 UTC ---
since this bug affects any kernel, including those of your own employer, it
will stay open until it gets fixed. it's also obvious that failing the second
mprotect in the same block of code means you've left ld.so's RELRO region
writable and that's a security bug itself so you'd better check its return
value as well and ask for a CVE.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12492] dl: RELRO handling crashes when kernel enforces MPROTECT restrictions

[ldv at altlinux dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

Dmitry V. Levin <ldv at altlinux dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|dl: RELRO handling crashes  |dl: RELRO handling crashes
                   |when PaX kernel enforces    |when kernel enforces
                   |MPROTECT restrictions       |MPROTECT restrictions

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12492] dl: RELRO handling crashes when kernel enforces MPROTECT restrictions

[linkfanel at yahoo dot fr]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

--- Comment #10 from Pierre Ynard <linkfanel at yahoo dot fr> 2011-02-21 04:05:59 UTC ---
First of all, I'm sorry for all of this that I started :( I'm sorry to
use up so much of your time, I imagine that dealing with bug reports and
trivial issues must be boring and sometimes frustrating. I'm just trying
to help by taking care some of the dull janitor job like checking return
values: a patch is all ready and it only needs someone to commit it.

glibc is a great piece of software and I'm sure people look at it as a
coding model, so it would be a shame to leave examples that could look
like bad practice, even if that part of the code is not so important in
itself.

I'd love to see this matter just resolved. If you don't mind. Please
please accept my humble apology along with this patch.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12492] dl: RELRO handling crashes when kernel enforces MPROTECT restrictions

[linkfanel at yahoo dot fr]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

--- Comment #11 from Pierre Ynard <linkfanel at yahoo dot fr> 2011-03-02 22:12:09 UTC ---
The patch was merged into eglibc
(http://www.eglibc.org/archives/commits/msg01710.html). I guess than rather
than "just use a supported kernel", I'll have to just use a supported libc :(
Pax Team, any suggestion about what should be done if the second mprotect()
fails?

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12492] dl: RELRO handling crashes when kernel enforces MPROTECT restrictions

[pageexec at freemail dot hu]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

--- Comment #12 from PaX Team <pageexec at freemail dot hu> 2011-03-02 22:30:32 UTC ---
probably the same as with the first mprotect failure.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12492] dl: RELRO handling crashes when kernel enforces MPROTECT restrictions

[linkfanel at yahoo dot fr]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

--- Comment #13 from Pierre Ynard <linkfanel at yahoo dot fr> 2011-03-03 02:09:51 UTC ---
But it still leaves the RELRO region writable, and I doubt the calling
application is going to do anything about it

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12492] dl: RELRO handling crashes when kernel enforces MPROTECT restrictions

[pageexec at freemail dot hu]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

--- Comment #14 from PaX Team <pageexec at freemail dot hu> 2011-03-03 08:40:54 UTC ---
by default the code after call_lose_errno won't return to the application ;).

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12492] dl: RELRO handling crashes when kernel enforces MPROTECT restrictions

[thoger at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

Tomas Hoger <thoger at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |thoger at redhat dot com

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug ld.so|libdl/12492] dl: RELRO handling crashes when kernel enforces MPROTECT restrictions

[jsm28 at gcc dot gnu.org]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

Joseph Myers <jsm28 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|libc                        |ld.so|libdl

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug dynamic-link/12492] dl: RELRO handling crashes when kernel enforces MPROTECT restrictions

[atoth at atoth dot sote.hu]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

Attila Tóth <atoth at atoth dot sote.hu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |atoth at atoth dot sote.hu

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug dynamic-link/12492] dl: RELRO handling crashes when kernel enforces MPROTECT restrictions

[jsm28 at gcc dot gnu.org]

http://sourceware.org/bugzilla/show_bug.cgi?id=12492

Joseph Myers <jsm28 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #16 from Joseph Myers <jsm28 at gcc dot gnu.org> ---
Fixed for 2.18 by:

commit 0432680e8c2ecd832038387f92b462dea75e94cc
Author: Pierre Ynard <linkfanel@yahoo.fr>
Date:   Fri Jun 28 21:43:42 2013 +0000

    Test for mprotect failure in dl-load.c (bug 12492).

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/12492] dl: RELRO handling crashes when kernel enforces MPROTECT restrictions

[jackie.rosen at hushmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=12492

Jackie Rosen <jackie.rosen at hushmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jackie.rosen at hushmail dot com

--- Comment #17 from Jackie Rosen <jackie.rosen at hushmail dot com> ---
*** Bug 260998 has been marked as a duplicate of this bug. ***
Seen from the domain http://volichat.com
Page where seen: http://volichat.com/adult-chat-rooms
Marked for reference. Resolved as fixed @bugzilla.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/12492] dl: RELRO handling crashes when kernel enforces MPROTECT restrictions

[schwab at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=12492

Andreas Schwab <schwab at sourceware dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|jackie.rosen at hushmail dot com   |

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/12492] dl: RELRO handling crashes when kernel enforces MPROTECT restrictions

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=12492

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.