public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug network/15946] New: getaddrinfo() writes DNS queries to random file descriptors under high load
@ 2013-09-12  9:50 arnaud.lb at gmail dot com
  2013-09-15 15:58 ` [Bug network/15946] " ian at airs dot com
                   ` (23 more replies)
  0 siblings, 24 replies; 25+ messages in thread
From: arnaud.lb at gmail dot com @ 2013-09-12  9:50 UTC (permalink / raw)
  To: glibc-bugs

https://sourceware.org/bugzilla/show_bug.cgi?id=15946

            Bug ID: 15946
           Summary: getaddrinfo() writes DNS queries to random file
                    descriptors under high load
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: critical
          Priority: P2
         Component: network
          Assignee: unassigned at sourceware dot org
          Reporter: arnaud.lb at gmail dot com

Created attachment 7193
  --> https://sourceware.org/bugzilla/attachment.cgi?id=7193&action=edit
reproducing code

Under high load, getaddrinfo() starts sending DNS queries to random
file descriptors, e.g. some unrelated socket connected to a remote service.

The attached code reproduces the bug on at least the following configurations:

Archlinux libc6 2.18
Debian libc6 2.6.11
Debian libc6 2.13-38
Debian libc6 2.17-92
Ubuntu libc6 2.17-0ubuntu5

What the code does is to fill the file descriptor space, closing and creating
many file descriptors, to maximize the chances of reproducing the bug:

 - a thread listens to a local unix socket
 - a thread connects to the unix socket, never writes to it, dups the
connection as much as possible (fills the fd space), closes the dups, and
starts
dup()ing again
 - lots of threads call getaddrinfo()

Under less than a minute, the listener starts reading garbage.

The garbage received by the listener seems to always be a full, well-formed,
DNS query. It seems to always be an AAAA query, even when hints.ai_family is
AF_INET. All queries are similar, only the id changes.

-- 
You are receiving this mail because:
You are on the CC list for the bug.


^ permalink raw reply	[flat|nested] 25+ messages in thread
end of thread, other threads:[~2015-10-22 13:50 UTC | newest]

Thread overview: 25+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-09-12  9:50 [Bug network/15946] New: getaddrinfo() writes DNS queries to random file descriptors under high load arnaud.lb at gmail dot com
2013-09-15 15:58 ` [Bug network/15946] " ian at airs dot com
2013-09-15 16:05 ` ian at airs dot com
2013-09-16  7:56 ` fweimer at redhat dot com
2014-03-06 20:27 ` bugdal at aerifal dot cx
2014-03-06 21:01 ` schwab@linux-m68k.org
2014-03-06 21:07 ` bugdal at aerifal dot cx
2014-03-06 21:16 ` schwab@linux-m68k.org
2014-03-13  0:08 ` edsrzf at gmail dot com
2014-06-03 16:05 ` schwab@linux-m68k.org
2014-06-03 16:05 ` cvs-commit at gcc dot gnu.org
2014-06-13 12:49 ` fweimer at redhat dot com
2014-08-28 10:26 ` cvs-commit at gcc dot gnu.org
2015-01-08 14:21 ` nilsson.dd+bz at gmail dot com
2015-01-28 12:33 ` jannhorn at googlemail dot com
2015-01-28 19:51 ` k_f at gentoo dot org
2015-01-29  2:43 ` jirka at fud dot cz
2015-01-30  3:18 ` bugdal at aerifal dot cx
2015-01-30 13:22 ` jirka at fud dot cz
2015-02-24 10:51 ` [Bug network/15946] getaddrinfo() writes DNS queries to random file descriptors under high load (CVE-2013-7423) fweimer at redhat dot com
2015-03-03 11:26 ` schwab@linux-m68k.org
2015-04-07 18:02 ` cvs-commit at gcc dot gnu.org
2015-04-07 18:06 ` cvs-commit at gcc dot gnu.org
2015-05-27 11:32 ` jim.king at simplivity dot com
2015-10-22 13:50 ` fweimer at redhat dot com

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).