bugfindutils - Bugs: bug #13381, infinite loop with -follow.

 
 

bug #13381: infinite loop with -follow.

Submitted by:  Andreas Metzler <ametzler>
Submitted on:  Sun 12 Jun 2005 05:17:48 PM UTC  
 
Category: findSeverity: 6 - Security
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: James Youngman <jay>
Originator Name: Open/Closed: Closed
Release: 4.2.19Fixed Release: 4.2.22

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 20 Jun 2005 06:46:00 AM UTC, comment #3:

Followup - this isn't a denial of updatedb service because updatedb does not use -follow or -L. However, the problem is significant from a security perspective in other contexts.

Once again, -L should not be used in security-sensitive environments in any case.

Anonymous
Sun 12 Jun 2005 10:42:54 PM UTC, comment #2:

You can download a release of findutils in which this problem is
fixed from ftp://alpha.gnu.org/gnu/findutils.

The releases on alpha.gnu.org are for testing purposes, so please
take the time to download the release and verify that your
problem has been solved. Once the release has been sufficiently
tested, it can be uploaded to ftp.gnu.org for everybody to use it.

James Youngman <jay>
Project AdministratorIn charge of this item.
Sun 12 Jun 2005 09:05:45 PM UTC, comment #1:

NB: THIS BUG IS A SECURITY HOLE (denial of "updatedb" service by users, possibly denial of service to security checks based on find). Please note the list of affected versions of findutils.

The problem was introduced because safely_chdir() in find.c now sometimes avoids needing to stat the destination directory, and so stat_buf was left unpopulated. This problem is fixed by the attached patch, which has been committed into the development code. The scope of the security problem extends only to the indefinite loop, the problem does not result in users being able to persuade find to process parts of the filesystem that should be excluded.

Having said this, this bug only occurs if the "-L" option was used, which normally should not be the case with any security checks - because they should not follow symbolic links, in general.

The next release of findutils will include this fix. The NEWS file will outline the severity of the problem.

James Youngman <jay>
Project AdministratorIn charge of this item.
Sun 12 Jun 2005 05:17:48 PM UTC, original submission:

Hello,

this was found by Zhangrong Huang in http://bugs.debian.org/313081

mkdir testingfindagain
ln -s . testingfindagain/symlink

now
find testingfindagain -follow
will generate an endless loop. (For testing I suggest piping into head -c 200, otherwise you might trigger OOM)

This was introduced between 4.2.18 and 4.2.19 (when changing find.c from r1.72 to r1.73). 4.2.x up to 4.2.18 will output this and exit:

find: Symbolic link `testingfindagain/symlink' is
part of a loop in the directory hierarchy; we have already visited the directory to which it points.
testingfindagain
testingfindagain/symlink

cu andreas

Andreas Metzler <ametzler>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by ametzler (original bugsubmitter)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 12 Jun 2005 10:42:54 PM UTCjayOpen/ClosedOpen=>Closed
      ReleaseNone=>4.2.19
      Fixed ReleaseNone=>4.2.22
    Sun 12 Jun 2005 09:05:45 PM UTCjaySeverity3 - Normal=>6 - Security
      StatusNone=>Fixed
      Assigned toNone=>jay
    Sun 12 Jun 2005 05:17:48 PM UTCametzlerCarbon-Copy-=>Added -unavailable-

    Back to the top


    Powered by Savane 3.1-cleanup1