Ubuntu
linux package

problem with PIE binaries and kernels <= 3.19

Bug #1518483 reported by Steve Beattie
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
bash (Ubuntu)
Fix Released
Medium
Unassigned
Vivid
Won't Fix
Medium
Unassigned
linux (Ubuntu)
Fix Released
High
Unassigned
Vivid
Fix Released
High
Tim Gardner

Bug Description

When bash is built as a Position Independent Executable (PIE), it very sporadically crashes due to some issue with memory layout in kernels before 4.2. I'm currently testing enabling PIE by default in gcc on amd64 for xenial, and some of my builds (e.g. cpio) are failing in the buildds with the following message emitted:

  bash: xmalloc: .././locale.c:81: cannot allocate 2 bytes (0 bytes allocated)

when the bash that is used is built as PIE. I have seen these failures on buildds where the host is running 3.13 and 3.19. I am also able to reproduce this locally on a machine running trusty with the stock trusty kernel. However, when I boot that same machine with the linux-lts-wily (4.2) kernel and retry the build with everything else exactly the same, the failure disappears.

I discussed this a bit with Kees Cook, and he noted that some cleanups to the kernel's ASLR code happened in 4.1. Specifically, he noted:

  commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86
  Author: Michael Davidson <email address hidden>

    fs/binfmt_elf.c: fix bug in loading of PIE binaries

However, that landed in stable and has been picked up in our kernels as 668965be56ea0b2c45ed6bec84dc2088490ae6b1, landing in Ubuntu-3.13.0-56.93 and b51621abbcb4694b8d2842ce3a66006a60bba6e5 / Ubuntu-3.19.0-19.19.

Kees also pointed out that he landed a series of patches from 204db6ed17743000691d930368a5abd6ea541c58 until Michael Davidson's patch (i.e. a87938b2e246b81b4fb713edb371a9fa3c5c3c86..204db6ed17743000691d930368a5abd6ea541c58 ), and in particular, there's:

  commit d1fd836dcf00d2028c700c7e44d2c23404062c90
  Author: Kees Cook <email address hidden>

    mm: split ET_DYN ASLR from mmap ASLR

Other fixes that I see to fs/binfmt_elf.c and arch/x86/mm/mmap.c look like they either occurred only in 4.3 or have already been backported via the stable kernels.

I should also point out that these cleanups may address some of the ASLR failed tests that occur on non-x86 architectures for pre 4.2 kernels.

I am happy to test out kernels to try to address this. Thanks.

ProblemType: Bug
DistroRelease: Ubuntu 14.04
Package: linux-image-3.13.0-68-generic 3.13.0-68.111
ProcVersionSignature: Ubuntu 3.13.0-68.111-generic 3.13.11-ckt27
Uname: Linux 3.13.0-68-generic x86_64
ApportVersion: 2.14.1-0ubuntu3.18
Architecture: amd64
AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/dsp', '/dev/snd/by-path', '/dev/snd/controlC0', '/dev/snd/hwC0D0', '/dev/snd/hwC0D1', '/dev/snd/pcmC0D0c', '/dev/snd/pcmC0D0p', '/dev/snd/pcmC0D1c', '/dev/snd/pcmC0D1p', '/dev/snd/pcmC0D2c', '/dev/snd/pcmC0D3p', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1:
Date: Fri Nov 20 13:58:40 2015
HibernationDevice: RESUME=UUID=dc63f523-507a-4f9d-aa30-a2e880199150
IwConfig:
 eth0 no wireless extensions.

 lo no wireless extensions.
MachineType: Shuttle Inc SG33
ProcEnviron:
 SHELL=/bin/bash
 TERM=screen
 PATH=(custom, user)
 LANG=en_US.UTF-8
 XDG_RUNTIME_DIR=<set>
ProcFB: 0 inteldrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.13.0-68-generic root=UUID=d30e91cf-3c43-41a9-a72d-c07d1be1d53e ro loop.max_loop=64 rootflags=data=ordered nomdmonddf nomdmonisw nomdmonddf nomdmonisw nomdmonddf nomdmonisw nomdmonddf nomdmonisw
RelatedPackageVersions:
 linux-restricted-modules-3.13.0-68-generic N/A
 linux-backports-modules-3.13.0-68-generic N/A
 linux-firmware 1.127.18
RfKill:

SourcePackage: linux
StagingDrivers: zram
UpgradeStatus: Upgraded to trusty on 2014-04-16 (583 days ago)
WpaSupplicantLog:

dmi.bios.date: 11/28/2007
dmi.bios.vendor: Phoenix Technologies, LTD
dmi.bios.version: 6.00 PG
dmi.board.name: FG33
dmi.board.vendor: Shuttle Inc
dmi.board.version: V10
dmi.chassis.type: 3
dmi.chassis.vendor: Shuttle Inc
dmi.chassis.version: G5
dmi.modalias: dmi:bvnPhoenixTechnologies,LTD:bvr6.00PG:bd11/28/2007:svnShuttleInc:pnSG33:pvrV10:rvnShuttleInc:rnFG33:rvrV10:cvnShuttleInc:ct3:cvrG5:
dmi.product.name: SG33
dmi.product.version: V10
dmi.sys.vendor: Shuttle Inc

CVE References

Revision history for this message
Steve Beattie (sbeattie) wrote :
summary: - problem with PIE binaries and kernels < 4.2
+ problem with PIE binaries and kernels <= 3.19
Revision history for this message
Brad Figg (brad-figg) wrote : Status changed to Confirmed

This change was made by a bot.

Changed in linux (Ubuntu):
status: New → Confirmed
Tim Gardner (timg-tpi)
Changed in linux (Ubuntu):
status: Confirmed → Fix Released
Changed in linux (Ubuntu Vivid):
assignee: nobody → Tim Gardner (timg-tpi)
status: New → In Progress
Revision history for this message
Tim Gardner (timg-tpi) wrote :

Steve - See http://kernel.ubuntu.com/~rtg/PIE-lp1518483/ for a test kernel. Remember to install linux-image-extras as well.

Revision history for this message
Steve Beattie (sbeattie) wrote :

Tim - yes, the kernel from http://kernel.ubuntu.com/~rtg/PIE-lp1518483/ lets my builds succeed; I verified that backing down to linux-image-3.19.0-36-generic still results in the build failures. Can we get this patch series in the next SRU cycle?

Thanks!

Brad Figg (brad-figg)
Changed in linux (Ubuntu Vivid):
status: In Progress → Fix Committed
Revision history for this message
Brad Figg (brad-figg) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-vivid' to 'verification-done-vivid'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-vivid
Revision history for this message
Steve Beattie (sbeattie) wrote :

I've verified that the 3.19.0-41.46 kernel addresses the issue. Thanks!

tags: added: verification-done-vivid
removed: verification-needed-vivid
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (14.4 KiB)

This bug was fixed in the package linux - 3.19.0-41.46

---------------
linux (3.19.0-41.46) vivid; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1522918

  [ Upstream Kernel Changes ]

  * Revert "dm: fix AB-BA deadlock in __dm_destroy()"
    - LP: #1522766
  * dm: fix AB-BA deadlock in __dm_destroy()
    - LP: #1522766

linux (3.19.0-40.45) vivid; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1522786

  [ Andy Whitcroft ]

  * [Packaging] control -- prepare for new kernel-wedge semantics
    - LP: #1516686
  * [Debian] rebuild should only trigger for non-linux packages
    - LP: #1498862, #1516686
  * [Tests] gcc-multilib does not exist on ppc64el
    - LP: #1515541

  [ Joseph Salisbury ]

  * SAUCE: scsi_sysfs: protect against double execution of
    __scsi_remove_device()
    - LP: #1509029

  [ Luis Henriques ]

  * [Config] updateconfigs after 3.19.8-ckt10 stable update

  [ Upstream Kernel Changes ]

  * Revert "ARM64: unwind: Fix PC calculation"
    - LP: #1520309
  * Revert "md: allow a partially recovered device to be hot-added to an
    array."
    - LP: #1520309
  * tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c
    - LP: #1512815
  * HID: rmi: Print the firmware id of the touchpad
    - LP: #1515503
  * HID: rmi: Add functions for writing to registers
    - LP: #1515503
  * HID: rmi: Disable scanning if the device is not a wake source
    - LP: #1515503
  * HID: rmi: Set F01 interrupt enable register when not set
    - LP: #1515503
  * be2net: log link status
    - LP: #1513980
  * xhci: Workaround to get Intel xHCI reset working more reliably
  * Drivers: hv: hv_balloon: refuse to balloon below the floor
    - LP: #1294283
  * Drivers: hv: hv_balloon: survive ballooning request with num_pages=0
    - LP: #1294283
  * Drivers: hv: hv_balloon: correctly handle val.freeram<num_pages case
    - LP: #1294283
  * Drivers: hv: hv_balloon: correctly handle num_pages>INT_MAX case
    - LP: #1294283
  * Drivers: hv: balloon: check if ha_region_mutex was acquired in
    MEM_CANCEL_ONLINE case
    - LP: #1294283
  * mm: meminit: make __early_pfn_to_nid SMP-safe and introduce
    meminit_pfn_in_nid
    - LP: #1294283
  * mm: meminit: inline some helper functions
    - LP: #1294283
  * mm, meminit: allow early_pfn_to_nid to be used during runtime
    - LP: #1294283
  * mm: initialize hotplugged pages as reserved
    - LP: #1294283
  * gut proc_register() a bit
    - LP: #1519106
  * arm: factor out mmap ASLR into mmap_rnd
    - LP: #1518483
  * x86: standardize mmap_rnd() usage
    - LP: #1518483
  * arm64: standardize mmap_rnd() usage
    - LP: #1518483
  * mips: extract logic for mmap_rnd()
    - LP: #1518483
  * powerpc: standardize mmap_rnd() usage
    - LP: #1518483
  * s390: standardize mmap_rnd() usage
    - LP: #1518483
  * mm: expose arch_mmap_rnd when available
    - LP: #1518483
  * s390: redefine randomize_et_dyn for ELF_ET_DYN_BASE
    - LP: #1518483
  * mm: split ET_DYN ASLR from mmap ASLR
    - LP: #1518483
  * mm: fold arch_randomize_brk into ARCH_HAS_ELF_RANDOMIZE
    - LP: #1518483
  * isdn_ppp: Add checks for allocation failure in isdn_ppp_open()
   ...

Changed in linux (Ubuntu Vivid):
status: Fix Committed → Fix Released
Revision history for this message
Dmitry (mikhin) wrote :

After some investigation I've found that fix of this bug introduced new problem - https://bugs.launchpad.net/ubuntu/+source/linux-lts-vivid/+bug/1527599.
More specially problem appears after http://kernel.ubuntu.com/git/ubuntu/ubuntu-vivid.git/commit/?id=06ec92f3bac598a7a9b9ecf451ab1915929a5980 commit.

Revision history for this message
Steve Beattie (sbeattie) wrote :

Since it's not guaranteed that we'll ever get buildds booted into kernels with the fix above, I'm proposing to disable -pie for bash. For xenial, this will have no affect except for on s390x, as on all other arches, pie is not the default anyway.

Changed in bash (Ubuntu Vivid):
status: New → Invalid
Revision history for this message
Steve Beattie (sbeattie) wrote :

Debdif to disable pie for bash builds

Revision history for this message
Steve Beattie (sbeattie) wrote :

Oh, I should point out, I aslo pushed this to the ubuntu-security-proposed ppa https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa and that I've been using bash with this in place for a couple of months now from my test pie build ppa.

Revision history for this message
Ubuntu Foundations Team Bug Bot (crichton) wrote :

The attachment "bash_4.3-14ubuntu2.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

tags: added: patch
Mathew Hodson (mhodson)
Changed in linux (Ubuntu Vivid):
importance: Undecided → High
Changed in linux (Ubuntu):
importance: Undecided → High
Changed in bash (Ubuntu Vivid):
status: Invalid → Won't Fix
importance: Undecided → Medium
Changed in bash (Ubuntu):
importance: Undecided → Medium
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package bash - 4.3-14ubuntu2

---------------
bash (4.3-14ubuntu2) yakkety; urgency=medium

  * Disable building with pie (LP: #1518483)

 -- Steve Beattie <email address hidden> Mon, 25 Apr 2016 15:00:52 -0700

Changed in bash (Ubuntu):
status: New → Fix Released
Revision history for this message
Esokrates (esokrarkose) wrote :

sbeattie: Any chance of building bash with pie in the future? 16.10 has 4.8 as default kernel, so disabling pie should not be necessary anymore!?

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.