Tags Tags

Bug#611195: vlc-nox: generating plugin cache at postinst segfaults on PaX kernel

January 26th, 2011 - 11:10 am ET by Pierre Ynard | Report spam
Help Create a new topic
Package: vlc-nox
Version: 1.1.3-1squeeze2
Severity: normal

Upgrading gives the following error:

Setting up vlc-nox (1.1.3-1squeeze2) ...
Segmentation fault
dpkg: error processing vlc-nox (--configure):
subprocess installed post-installation script returned error exit status 139

Apparently, vlc-cache-gen segfaults when processing the sdl_image plugin:

stat64("/usr/lib/vlc/plugins/codec/liblpcm_plugin.so", {st_mode=S_IFREG|0644, st_size˜20, ...}) = 0
open("/usr/lib/vlc/plugins/codec/liblpcm_plugin.so", O_RDONLY) = 5
read(5, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\220\6\0\0004\0\0\0"..., 512) = 512
fstat64(5, {st_mode=S_IFREG|0644, st_size˜20, ...}) = 0
mmap2(NULL, 12652, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x4687b000
mmap2(0x4687e000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x2) = 0x4687e000
close(5) = 0
stat64("/usr/lib/vlc/plugins/codec/libsdl_image_plugin.so", {st_mode=S_IFREG|0644, st_sizeh52, ...}) = 0
open("/usr/lib/vlc/plugins/codec/libsdl_image_plugin.so", O_RDONLY) = 5
read(5, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\240\7\0\0004\0\0\0"..., 512) = 512
fstat64(5, {st_mode=S_IFREG|0644, st_sizeh52, ...}) = 0
mmap2(NULL, 9628, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x4747a000
mmap2(0x4747c000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1) = 0x4747c000
close(5) = 0
open("/etc/ld.so.cache", O_RDONLY) = 5
fstat64(5, {st_mode=S_IFREG|0644, st_sizeP711, ...}) = 0
mmap2(NULL, 50711, PROT_READ, MAP_PRIVATE, 5, 0) = 0x4686e000
close(5) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/usr/lib/libSDL_image-1.2.so.0", O_RDONLY) = 5
read(5, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\320\30\0\0004\0\0\0"..., 512) = 512
fstat64(5, {st_mode=S_IFREG|0644, st_sizeG072, ...}) = 0
brk(0x80fe000) = 0x80fe000
mmap2(NULL, 113072, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x46852000
mmap2(0x4685d000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0xb) = 0x4685d000
mmap2(0x4685e000, 63920, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x4685e000
close(5) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/usr/lib/libSDL-1.2.so.0", O_RDONLY) = 5
read(5, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0p]\0\0004\0\0\0"..., 512) = 512
fstat64(5, {st_mode=S_IFREG|0644, st_sizeB1876, ...}) = 0
mmap2(NULL, 720688, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0x467a2000
mmap2(0x46808000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x65) = 0x46808000
mmap2(0x4680a000, 294704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x4680a000
mprotect(0x4946b000, 3840, PROT_READ|PROT_WRITE) = -1 EACCES (Permission denied)
SIGSEGV (Segmentation fault) @ 0 (0)
+++ killed by SIGSEGV +++
zsh: segmentation fault strace -f /usr/lib/vlc/vlc-cache-gen /usr/lib/vlc/plugins

Note the mprotect() error, as logged by the kernel:

[1607219.198034] grsec: denied RWX mprotect of /lib/ld-2.11.2.so by
/usr/lib/vlc/vlc-cache-gen[vlc-cache-gen:15667] uid/euid:0/0 gid/egid:0/0,
parent /var/lib/dpkg/info/vlc-nox.postinst[vlc-nox.postins:15666] uid/euid:0/0 gid/egid:0/0

Disabling the mprotect() restriction feature makes the problem go away.

FWIW, a gdb backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x50f49677 in ?? () from /lib/ld-linux.so.2
(gdb) bt
#0 0x50f49677 in ?? () from /lib/ld-linux.so.2
#1 0x50f4a134 in ?? () from /lib/ld-linux.so.2
#2 0x50f4fe9c in ?? () from /lib/ld-linux.so.2
#3 0x50f507f6 in ?? () from /lib/ld-linux.so.2
#4 0x50f4f192 in ?? () from /lib/ld-linux.so.2
#5 0x50f54b81 in ?? () from /lib/ld-linux.so.2
#6 0x50f507f6 in ?? () from /lib/ld-linux.so.2
#7 0x50f545c6 in ?? () from /lib/ld-linux.so.2
#8 0x50c8ac0b in ?? ()
#9 0x50f507f6 in ?? () from /lib/ld-linux.so.2
#10 0x50c8b09c in ?? ()
#11 0x50c8ab41 in ?? ()
#12 0x50ed0929 in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Feel free to forward the bug appropriately, but:

- Why is the dynamic loader crashing, instead of handling the error
gracefully?
- What's up with libSDL-1.2?
- It sucks that installation and/or start-up of VLC fails because of
one faulty module

Debian Release: 6.0
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)

Kernel: Linux 2.6.36.2-grsec
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages vlc-nox depends on:
ii liba52-0.7.4 0.7.4-14 library for decoding ATSC A/52 str
ii libasound2 1.0.23-2.1 shared library for ALSA applicatio
ii libass4 0.9.9-1 library for SSA/ASS subtitles rend
ii libavahi-client3 0.6.27-3 Avahi client library
ii libavahi-common3 0.6.27-3 Avahi common library
ii libavc1394-0 0.5.3-1+b2 control IEEE 1394 audio/video devi
ii libavcodec52 4:0.5.2-6 ffmpeg codec library
ii libavformat52 4:0.5.2-6 ffmpeg file format library
ii libavutil49 4:0.5.2-6 ffmpeg utility library
ii libc6 2.11.2-10 Embedded GNU C Library: Shared lib
ii libcaca0 0.99.beta17-1 colour ASCII art library
ii libcddb2 1.3.2-2 library to access CDDB data - runt
ii libcdio10 0.81-4 library to read and control CD-ROM
ii libdbus-1-3 1.2.24-4 simple interprocess messaging syst
ii libdc1394-22 2.1.2-3 high level programming interface f
ii libdca0 0.0.5-3 decoding library for DTS Coherent
ii libdirac-encoder0 1.0.2-3 open and royalty free high quality
ii libdvbpsi6 0.1.7-1 library for MPEG TS and DVB PSI ta
ii libdvdnav4 4.1.3-7 DVD navigation library
ii libdvdread4 4.1.3-10 library for reading DVDs
ii libebml0 0.7.7-3.1 access library for the EBML format
ii libfaad2 2.7-6 freeware Advanced Audio Decoder -
ii libflac8 1.2.1-3 Free Lossless Audio Codec - runtim
ii libfontconfig1 2.8.0-2.1 generic font configuration library
ii libfreetype6 2.4.2-2.1 FreeType 2 font engine, shared lib
ii libfribidi0 0.19.2-1 Free Implementation of the Unicode
ii libgcc1 1:4.4.5-10 GCC support library
ii libgcrypt11 1.4.5-2 LGPL Crypto library - runtime libr
ii libgnutls26 2.8.6-1 the GNU TLS library - runtime libr
ii libgpg-error0 1.6-1 library for common error values an
ii libkate1 0.3.8-1 Kate is a codec for karaoke and te
ii liblircclient0 0.8.3-5 infra-red remote control support -
ii liblua5.1-0 5.1.4-5 Simple, extensible, embeddable pro
ii libmad0 0.15.1b-5 MPEG audio decoder library
ii libmatroska0 0.8.1-1.1 extensible open standard audio/vid
ii libmodplug1 1:0.8.8.1-2 shared libraries for mod music bas
ii libmpcdec6 2:0.1~r459-1 MusePack decoder - library
ii libmpeg2-4 0.4.1-3 MPEG1 and MPEG2 video decoder libr
ii libmtp8 1.0.3-1 Media Transfer Protocol (MTP) libr
ii libncursesw5 5.7+20100313-5 shared libraries for terminal hand
ii libogg0 1.2.0~dfsg-1 Ogg bitstream library
ii libpng12-0 1.2.44-1 PNG library - runtime
ii libpostproc51 4:0.5.2-6 ffmpeg video postprocessing librar
ii libproxy0 0.3.1-2 automatic proxy configuration mana
ii libraw1394-11 2.0.5-2 library for direct access to IEEE
ii libschroedinger-1.0-0 1.0.9-2 library for encoding/decoding of D
ii libshout3 2.2.2-5+b1 MP3/Ogg Vorbis broadcast streaming
ii libsmbclient 2:3.5.6~dfsg-4 shared library for communication w
ii libspeex1 1.2~rc1-1 The Speex codec runtime library
ii libstdc++6 4.4.5-10 The GNU Standard C++ Library v3
ii libswscale0 4:0.5.2-6 ffmpeg video scaling library
ii libtag1c2a 1.6.3-1 TagLib Audio Meta-Data Library
ii libtheora0 1.1.1+dfsg.1-3 The Theora Video Compression Codec
ii libtwolame0 0.3.12-1 MPEG Audio Layer 2 encoding librar
ii libudev0 164-4 libudev shared library
ii libupnp3 1:1.6.6-5 Portable SDK for UPnP Devices, ver
ii libv4l-0 0.8.1-2 Collection of video4linux support
ii libvcdinfo0 0.7.23-4+b2 library to extract information fro
ii libvlc5 1.1.3-1squeeze2 multimedia player and streamer lib
ii libvlccore4 1.1.3-1squeeze2 base library for VLC and its modul
ii libvorbis0a 1.3.1-1 The Vorbis General Audio Compressi
ii libvorbisenc2 1.3.1-1 The Vorbis General Audio Compressi
ii libxml2 2.7.8.dfsg-2 GNOME XML library
ii zlib1g 1:1.2.3.4.dfsg-3 compression library - runtime

vlc-nox recommends no packages.

vlc-nox suggests no packages.

Versions of packages vlc depends on:
ii libaa1 1.4p5-38 ascii art library
ii libc6 2.11.2-10 Embedded GNU C Library: Shared lib
ii libfreetype6 2.4.2-2.1 FreeType 2 font engine, shared lib
ii libfribidi0 0.19.2-1 Free Implementation of the Unicode
ii libgcc1 1:4.4.5-10 GCC support library
ii libgl1-mesa-glx [libgl1 7.7.1-4 A free implementation of the OpenG
ii libqtcore4 4:4.6.3-4 Qt 4 core module
ii libqtgui4 4:4.6.3-4 Qt 4 GUI module
ii libsdl-image1.2 1.2.10-2+b2 image loading library for Simple D
ii libsdl1.2debian 1.2.14-6.1 Simple DirectMedia Layer
ii libstdc++6 4.4.5-10 The GNU Standard C++ Library v3
ii libtar 1.2.11-6 C library for manipulating tar arc
ii libvlccore4 1.1.3-1squeeze2 base library for VLC and its modul
ii libx11-6 2:1.3.3-4 X11 client-side library
ii libx11-xcb1 2:1.3.3-4 Xlib/XCB interface library
ii libxcb-keysyms1 0.3.6-1 utility libraries for X C Binding
ii libxcb-randr0 1.6-1 X C Binding, randr extension
ii libxcb-shm0 1.6-1 X C Binding, shm extension
ii libxcb-xv0 1.6-1 X C Binding, xv extension
ii libxcb1 1.6-1 X C Binding
ii libxext6 2:1.1.2-1 X11 miscellaneous extension librar
ii ttf-freefont 20090104-7 Freefont Serif, Sans and Mono True
ii zlib1g 1:1.2.3.4.dfsg-3 compression library - runtime

Versions of packages libvlc5 depends on:
ii libc6 2.11.2-10 Embedded GNU C Library: Shared lib
ii libvlccore4 1.1.3-1squeeze2 base library for VLC and its modul

Versions of packages libvlccore4 depends on:
ii libc6 2.11.2-10 Embedded GNU C Library: Shared lib
ii libdbus-1-3 1.2.24-4 simple interprocess messaging syst
ii vlc-data 1.1.3-1squeeze2 Common data for VLC

Versions of packages vlc-nox is related to:
pn libavutil50 <none> (no description available)
pn libavutil51 <none> (no description available)




To UNSUBSCRIBE, email to debian-bugs-dist-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
email Follow the discussionReplies 1 replyReplies Make a reply

Replies

#1 pageexec
January 26th, 2011 - 12:40 pm ET | Report spam
On 26 Jan 2011 at 17:03, Pierre Ynard wrote:

mprotect(0x4946b000, 3840, PROT_READ|PROT_WRITE) = -1 EACCES (Permission denied)
SIGSEGV (Segmentation fault) @ 0 (0)
+++ killed by SIGSEGV +++
zsh: segmentation fault strace -f /usr/lib/vlc/vlc-cache-gen /usr/lib/vlc/plugins

Note the mprotect() error, as logged by the kernel:

[1607219.198034] grsec: denied RWX mprotect of /lib/ld-2.11.2.so by
/usr/lib/vlc/vlc-cache-gen[vlc-cache-gen:15667] uid/euid:0/0 gid/egid:0/0,
parent /var/lib/dpkg/info/vlc-nox.postinst[vlc-nox.postins:15666] uid/euid:0/0 gid/egid:0/0

Disabling the mprotect() restriction feature makes the problem go away.

[...]

Feel free to forward the bug appropriately, but:

- Why is the dynamic loader crashing, instead of handling the error
gracefully?
- What's up with libSDL-1.2?
- It sucks that installation and/or start-up of VLC fails because of
one faulty module



this is a long standing bug in glibc and RELRO handling in ld.so. what happens is this:

1. ld.so maintains the current stack execution rights in a variable (most of the time
they'd be rw-, i.e., non-executable)
2. said variable is marked to be stored in the RELRO segment of ld.so
3. when a dynamically linked program is started, ld.so performs all the relocations, etc
then as a final step it mprotects the RELRO segments of all binaries (including itself)
as actually read-only
4. PaX/MPROTECT enforces this read-only property in that it denies further mprotect
requests that would make any part of such RELRO segments writable again (which is
kinda the whole idea behind RELRO)
5. later a library is dlopen'd that wants an executable stack (has a RWE GNU_STACK segment)
so ld.so wants to update this internal variable as well but since it's in the RELRO
segment, it makes that area writable temporarily. this step fails per 4 and since the
mprotect return value is not checked, the attempt of actually writing to the variable
will cause a segfault.

now as you can see there's a cascade of failures here. the fundamental issue is the
whole broken concept of GNU_STACK but i guess debian folks are not about to neutralize
it, so let's look at the next step: putting a writable variable into the RELRO segment.

it was originally done in the hope that an exploit wouldn't be able to modify it either
and therefore prevent a specific ret2libc class of attack that'd abuse ld.so to do the
attacker's bidding by creating an rwx stack (let's not digress into how pointless this
is). this would work if this variable didn't need to be modified *after* RELRO enforcement
had taken place, but RWE GNU_STACK support for dlopen'd libraries requires exactly that
(which of course also circumvents GNU_STACK but let's not digress again ;). so what glibc
devs decided to do was to temporarily revert the RELRO segment's read-only status to update
the variable but for some reason they didn't check the return value of mprotect (probably
on grounds that 'it cannot fail' since it's called on a known valid region, etc except
there're many other reasons that can make mprotect fail).

so there you have it in a nutshell. probably the quickest 'fix' is to at least add a check
for mprotect's return value but that still won't let this libSDL library to load under PaX
and MPROTECT (whether it really needs an executable stack or is just incorrectly marked due
to some unmarked .S files is another angle you can investigate).

cheers,

PaX Team




To UNSUBSCRIBE, email to
with a subject of "unsubscribe". Trouble? Contact

Similar topics

Make your own search :