Add a New Comment (Rich Markup)
With a current trunk (r37759) build, a quick test (sending the same invalid message as in the original report) shows gdomap staying alive and the syslog message being logged properly. Hence this now appears fixed. Thank you!
Thanks for spotting that … I re-ordered the code to do the openlog after closing file descriptors in the child process. Please give it a go.
gdomap, when told to run in daemon mode, calls openlog() early on in main() to initialize the system logger. Internally, openlog() (at least in (e)glibc) creates a fd to connect to the system logger via a unix domain socket. gdomap, after command line parsing etc., and forking, then ensures that there are no open fds that may interfere with its operation by closing them all (skipping stderr). Unfortunately, this also closes the fd that openlog() just made. Eventually, this closed fd's number is re-used for gdomap's UDP listening socket. The net effect is: when a call to syslog() is later attempted, syslog()'s attempt to send to the system logger fails. It then closes what it thinks is still its fd (but is actually now the UDP listening socket mentioned above), and attempts to reconnect to the system logger. (For whatever reason this fails.) gdomap eventually notices in its handle_io() loop that the UDP listening socket is closed, and dies with the message "Fatal error on socket." (trying to syslog it, funnily enough). This was found by sending an invalid message to a gdomap daemon via TCP (triggering the "Illegal operation code received!" message) and observing gdomap dying instead of continuing on gracefully: $ sudo gdomap $ pidof gdomap 23357 $ ( echo -ne "AA\x12AAAAA"; head -c256 /dev/zero ) | nc localhost gdomap $ pidof gdomap $ I think I read in the mail thread about Dan Rosenberg's gdomap CVE-worthy bugs that gdomap isn't a crucial part of GNUstep anymore, but I thought this would be still worth reporting. (If it is still a useful part, I would consider this a low-severity security bug since it's a simple DoS that can be triggered by remote users over TCP/UDP without authentication (or debug mode)). FWIW, the attached strace shows the issue; the effects of the call to syslog() that fails start at line 1254.
(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)
Attach Files: Comment:
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Only logged-in users can vote.
Please enter the title of George Orwell's famous dystopian book (it's a date):
Follow 4 latest changes.
Copyright © 2023 Free Software Foundation, Inc. Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved. The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team. Source Code
Powered by Savane 3.11