bugGNUstep - Bugs: bug #41751, gdomap's usage of syslog fails

Group
 
 

bug #41751: gdomap's usage of syslog fails

Submitter:  Matthew Daley <hypermatt>
Submitted:  Sun 02 Mar 2014 12:35:46 PM UTC
   
 
Category:  Base/Foundation Severity:  3 - Normal
Item Group:  Bug Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 23 Mar 2014 08:25:59 AM UTC, comment #2: 

With a current trunk (r37759) build, a quick test (sending the same invalid message as in the original report) shows gdomap staying alive and the syslog message being logged properly. Hence this now appears fixed. Thank you!

Matthew Daley <hypermatt>
Wed 19 Mar 2014 08:19:41 AM UTC, comment #1: 

Thanks for spotting that … I re-ordered the code to do the openlog after closing file descriptors in the child process. Please give it a go.

Richard Frith-Macdonald <CaS>
Group Member
Sun 02 Mar 2014 12:35:46 PM UTC, original submission:  

gdomap, when told to run in daemon mode, calls openlog() early on in main() to initialize the system logger. Internally, openlog() (at least in (e)glibc) creates a fd to connect to the system logger via a unix domain socket.

gdomap, after command line parsing etc., and forking, then ensures that there are no open fds that may interfere with its operation by closing them all (skipping stderr). Unfortunately, this also closes the fd that openlog() just made. Eventually, this closed fd's number is re-used for gdomap's UDP listening socket.

The net effect is: when a call to syslog() is later attempted, syslog()'s attempt to send to the system logger fails. It then closes what it thinks is still its fd (but is actually now the UDP listening socket mentioned above), and attempts to reconnect to the system logger. (For whatever reason this fails.) gdomap eventually notices in its handle_io() loop that the UDP listening socket is closed, and dies with the message "Fatal error on socket." (trying to syslog it, funnily enough).

This was found by sending an invalid message to a gdomap daemon via TCP (triggering the "Illegal operation code received!" message) and observing gdomap dying instead of continuing on gracefully:

$ sudo gdomap
$ pidof gdomap
23357
$ ( echo -ne "AA\x12AAAAA"; head -c256 /dev/zero ) | nc localhost gdomap
$ pidof gdomap
$

I think I read in the mail thread about Dan Rosenberg's gdomap CVE-worthy bugs that gdomap isn't a crucial part of GNUstep anymore, but I thought this would be still worth reporting. (If it is still a useful part, I would consider this a low-severity security bug since it's a simple DoS that can be triggered by remote users over TCP/UDP without authentication (or debug mode)).

FWIW, the attached strace shows the issue; the effects of the call to syslog() that fails start at line 1254.

Matthew Daley <hypermatt>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by CaS (Posted a comment)
  • -email is unavailable- added by hypermatt (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-03-23 CaS Open/ClosedIn Test Closed
    2014-03-19 CaS StatusNone Fixed
        Open/ClosedOpen In Test
    2014-03-02 hypermatt Attached File- Added gdomap-syslog-strace.txt, #30751

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code