December 2007 - openSUSE Security - openSUSE Mailing Lists

[opensuse-security] Re: [security-announce] SUSE Security Announcement: Linux kernel (SUSE-SA:2007:064)
by Frank Steiner 05 Dec '07

05 Dec '07

Hi, Marcus Meissner wrote > ______________________________________________________________________________ > > SUSE Security Announcement > > Package: kernel > Announcement ID: SUSE-SA:2007:064 > Date: Tue, 04 Dec 2007 11:00:00 +0000 > Affected Products: SUSE LINUX 10.1 > SUSE Linux Enterprise Desktop 10 SP1 > SUSE Linux Enterprise 10 SP1 DEBUGINFO > SLE SDK 10 SP1 > SUSE Linux Enterprise Server 10 SP1 > 4 hours after I booted our NFS server and our clients with the new kernel, lockd and/or nfsd crashed on the NFS server and I had to reboot. I know it's tainted so I won't get official support, so we will run a test with the original SuSE kernel. Anyway, it's only tainted with the fglrx and the nvidia 3D modules and we've been adding those to every kernel since SuSE 10.1 and SLES10 were release, so I doubt that it's their fault. Since October 4th we were running the 2.6.16.53-0.16 kernel code (with fglrs and nvidia) without any problems, so it must be a patch from 2.6.16.53 to 2.6.16.54. It looks like sth. has changed in the lockd or nfsd code. Is anyone else sth. similar? since cu, Frank Oops: 0002 [1] SMP last sysfs file: /class/scsi_host/host4/proc_name CPU 0 Modules linked in: nfsd exportfs af_packet cpufreq_ondemand cpufreq_userspace cpufreq_powersave powernow_k8 freq_table eeprom adm1026 hwmon_vid hwmon i2c_isa edd mptctl button battery ac sr_mod cdrom dm_mod usbhid usb_storage shpchp i2c_nforce2 forcedeth ohci_hcd ehci_hcd usbcore i2c_core pci_hotplug fan thermal processor qla2xxx firmware_class scsi_transport_fc amd74xx sg mptsas scsi_transport_sas mptscsih mptbase ide_disk ide_core Pid: 6403, comm: lockd Tainted: G U 2.6.16-10suse-bio-smp #1 RIP: 0010:[<ffffffff8019414e>] <ffffffff8019414e>{__locks_delete_block+43} RSP: 0018:ffff810116fdbe00 EFLAGS: 00010286 RAX: ffff81013cfab508 RBX: ffff81013cfab500 RCX: ffffffff80421780 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff81013cfab500 RBP: ffff81011bfe1810 R08: ffff810116fbb054 R09: 0000000000000005 R10: 0000000000000000 R11: ffff81011a893800 R12: ffff810149d5f860 R13: 0000000000000001 R14: ffff8101168a54f0 R15: 0000000000000000 FS: 00002b65f94dc6d0(0000) GS:ffffffff804a9000(0000) knlGS:00000000eb99fba0 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000000 CR3: 000000021b5e0000 CR4: 00000000000006e0 Process lockd (pid: 6403, threadinfo ffff810116fda000, task ffff81011b088100) Stack: ffffffff801947c4 ffff810149d5f860 ffff81011bfe1810 ffff8101199a08d0 ffffffff8019492b ffff81011bfe1810 ffffffff80194d46 ffff81011bfe1310 ffff8101199a0828 ffff8100d24093c0 Call Trace: <ffffffff801947c4>{locks_wake_up_blocks+27} <ffffffff8019492b>{locks_delete_lock+126} <ffffffff80194d46>{__posix_lock_file+398} <ffffffff80233f4f>{nlmsvc_unlock+125} <ffffffff802382c5>{nlm4svc_proc_unlock+111} <ffffffff8037298c>{svc_process+838} <ffffffff8023365a>{lockd+0} <ffffffff802337f9>{lockd+415} <ffffffff8010bb8a>{child_rip+8} <ffffffff8023365a>{lockd+0} <ffffffff8023365a>{lockd+0} <ffffffff8010bb82>{child_rip+0} Code: 48 89 0a 48 89 40 08 48 89 47 08 48 c7 07 00 00 00 00 c3 48 RIP <ffffffff8019414e>{__locks_delete_block+43} RSP <ffff810116fdbe00> CR2: 0000000000000000 <0>Bad page state in process 'nfsd' page:ffff81021ce5c6a8 flags:0x0600000000000000 mapping:0000000000000000 mapcount:-32510 count:469637161 Trying to fix it up, but a reboot is needed Backtrace: Call Trace: <ffffffff80161fd5>{bad_page+80} <ffffffff80163035>{get_page_from_freelist+740} <ffffffff80163181>{__alloc_pages+101} <ffffffff80375042>{svc_recv+250} <ffffffff8012aed7>{default_wake_function+0} <ffffffff80382504>{__down_read+18} <ffffffff8824b47e>{:nfsd:nfsd+0} <ffffffff8824b586>{:nfsd:nfsd+264} <ffffffff8010bb8a>{child_rip+8} <ffffffff8824b47e>{:nfsd:nfsd+0} <ffffffff8824b47e>{:nfsd:nfsd+0} <ffffffff8010bb82>{child_rip+0} nfsd: last server has exited nfsd: unexporting all filesystems -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr. 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: +49 89 2180-99-4049 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. * --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 3

[opensuse-security] Treason uncloaked
by Magnus Rosenbaum 04 Dec '07

04 Dec '07

Hello everybody, yesterday one of my webservers refused to deliver any more webpages, while reaching the server with ssh was fine and the load of the server was very low. But there were 100 apache processes, which is the configured limit on that server. Usually there are about 30 apache processes. In /var/log/messages I found some messages like this at the same time: Nov 19 14:38:12 server1 kernel: TCP: Treason uncloaked! Peer 87.160.97.54:2560/80 shrinks window 1710186274:17 10191335. Repaired. Does anyone know what this means and how it might be related to the apache processes? Ist this some kind of DoS attack? cu, Magnus -- Carl Magnus Rosenbaum M.A. Administration - Programmierung - Weiterbildung http://cmr.cx/ Tel: +49 89 70066626 Fax: +49 89 70066686 Mobil: +49 163 7006662 PGP Fingerprint: DEBC 3C99 EF1D 74F0 D4C7 EFF5 C268 3690 0EA1 7641

6 8

[opensuse-security] The last security update makes samba dump core dozens of times per sencond.
by Carlos E. R. 02 Dec '07

02 Dec '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bugzilla 345437 After today's security update, samba dumps core when a Siemens Gigaset M740 AV digital TV receiver (internally a linux 2.4 machine) tries to load a share in my opensuse 10.3 machine. This was working till today. These security patches were installed today: dmapi 2.2.8-22 cifs-mount 3.0.26a-3.3 libsmbclient 3.0.26a-3.3 samba-client 3.0.26a-3.3 samba 3.0.26a-3.3 I can't connect, and these messages start to fill the log by the hundred and I have to restart the server (and no, there is no core in that dir): Dec 2 00:33:04 nimrodel smbd[3686]: [2007/12/02 00:33:04, 0] lib/fault.c:dump_core(181) Dec 2 00:33:04 nimrodel smbd[3686]: dumping core in /var/log/samba/cores/smbd Dec 2 00:33:04 nimrodel smbd[3686]: Dec 2 00:33:04 nimrodel smbd[3687]: [2007/12/02 00:33:04, 0] lib/util.c:smb_panic(1632) Dec 2 00:33:04 nimrodel smbd[3687]: PANIC (pid 3687): push_ascii - dest_len == -1 Dec 2 00:33:04 nimrodel smbd[3687]: [2007/12/02 00:33:04, 0] lib/util.c:log_stack_trace(1736) Dec 2 00:33:04 nimrodel smbd[3687]: BACKTRACE: 14 stack frames: Dec 2 00:33:04 nimrodel smbd[3687]: #0 /usr/sbin/smbd(log_stack_trace+0x2d) [0x8024ca7d] Dec 2 00:33:04 nimrodel smbd[3687]: #1 /usr/sbin/smbd(smb_panic+0x5d) [0x8024cbad] Dec 2 00:33:04 nimrodel smbd[3687]: #2 /usr/sbin/smbd [0x802351e4] Dec 2 00:33:04 nimrodel smbd[3687]: #3 /usr/sbin/smbd(push_string_fn+0x44) [0x80235234] Dec 2 00:33:04 nimrodel smbd[3687]: #4 /usr/sbin/smbd(srvstr_push_fn+0xa5) [0x800bfd65] Dec 2 00:33:04 nimrodel smbd[3687]: #5 /usr/sbin/smbd [0x800a5886] Dec 2 00:33:04 nimrodel smbd[3687]: #6 /usr/sbin/smbd [0x800b0424] Dec 2 00:33:04 nimrodel smbd[3687]: #7 /usr/sbin/smbd(handle_trans2+0x168) [0x800b16d8] Dec 2 00:33:04 nimrodel smbd[3687]: #8 /usr/sbin/smbd(reply_trans2+0x69c) [0x800b2a3c] Dec 2 00:33:04 nimrodel smbd[3687]: #9 /usr/sbin/smbd [0x800cfaee] Dec 2 00:33:04 nimrodel smbd[3687]: #10 /usr/sbin/smbd(smbd_process+0x4df) [0x800d085f] Dec 2 00:33:04 nimrodel smbd[3687]: #11 /usr/sbin/smbd(main+0xa18) [0x80323ea8] Dec 2 00:33:04 nimrodel smbd[3687]: #12 /lib/libc.so.6(__libc_start_main+0xe0) [0xb7aa1fe0] Dec 2 00:33:04 nimrodel smbd[3687]: #13 /usr/sbin/smbd [0x800542a1] Dec 2 00:33:04 nimrodel smbd[3687]: [2007/12/02 00:33:04, 0] lib/fault.c:dump_core(181) - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4-svn0 (GNU/Linux) iD8DBQFHUgahtTMYHG2NR9URAoNuAKCY8C6BGmKzODUajTxuzKzRe9zuEgCfcQTc yiNsMl8PZcKjkOsDi/E7qlE= =Kdoe -----END PGP SIGNATURE----- --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security+help(a)opensuse.org

2 2