bugfindutils - Bugs: bug #13381, infinite loop with -follow.

 
 

bug #13381: infinite loop with -follow.

Submitter:  Andreas Metzler <ametzler>
Submitted:  Sun 12 Jun 2005 05:17:48 PM UTC
   
 
Category:  find Severity:  6 - Security
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  jay
Originator Name:  Open/Closed:  Closed
Release:  4.2.19 Fixed Release:  4.2.22
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 20 Jun 2005 06:46:00 AM UTC, comment #3: 

Followup - this isn't a denial of updatedb service because updatedb  does not use -follow or -L.  However, the problem is significant from a security perspective in other contexts.

Once again, -L should not be used in security-sensitive environments in any case.

Anonymous
Sun 12 Jun 2005 10:42:54 PM UTC, comment #2: 

You can download a release of findutils in which this problem is
fixed from ftp://alpha.gnu.org/gnu/findutils.

The releases on alpha.gnu.org are for testing purposes, so please
take the time to download the release and verify that your
problem has been solved.  Once the release has been sufficiently
tested, it can be uploaded to ftp.gnu.org for everybody to use it.

James Youngman <jay>
Group administrator
Sun 12 Jun 2005 09:05:45 PM UTC, comment #1: 

NB: THIS BUG IS A SECURITY HOLE (denial of "updatedb" service by users, possibly denial of service to security checks based on find).  Please note the list of affected versions of findutils.

The problem was introduced because safely_chdir() in find.c now sometimes avoids needing to stat the destination directory, and so stat_buf was left unpopulated.  This problem is fixed by the attached patch, which has been committed into the development code.   The scope of the security problem extends only to the indefinite loop, the problem does not result in users being able to persuade find to process parts of the filesystem that should be excluded.

Having said this, this bug only occurs if the "-L" option was used, which normally should not be the case with any security checks - because they should not follow symbolic links, in general.

The next release of findutils will include this fix.  The NEWS file will outline the severity of the problem.

James Youngman <jay>
Group administrator
Sun 12 Jun 2005 05:17:48 PM UTC, original submission:  

Hello,

this was found by Zhangrong Huang in http://bugs.debian.org/313081

mkdir testingfindagain
ln -s . testingfindagain/symlink

now
find testingfindagain -follow
will generate an endless loop. (For testing I suggest piping into head -c 200, otherwise you might trigger OOM)

This was introduced between 4.2.18 and 4.2.19 (when changing find.c from r1.72  to r1.73). 4.2.x up to 4.2.18 will output this and exit:

find: Symbolic link `testingfindagain/symlink' is
 part of a loop in the directory hierarchy; we have already visited the directory to which it points.
testingfindagain
testingfindagain/symlink

              cu andreas

Andreas Metzler <ametzler>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ametzler (original bugsubmitter)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2005-06-12 jay Open/ClosedOpen Closed
        ReleaseNone 4.2.19
        Fixed ReleaseNone 4.2.22
    2005-06-12 jay Severity3 - Normal 6 - Security
        StatusNone Fixed
        Assigned toNone jay
    2005-06-12 ametzler Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code