Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 231442 - kernel fails to add AT_NULL terminator to auxiliary vector
Summary: kernel fails to add AT_NULL terminator to auxiliary vector
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: kernel
Version: 5.0
Hardware: All
OS: Linux
Target Milestone: ---
: ---
Assignee: Vitaly Mayatskikh
QA Contact: Martin Jenner
Depends On:
Blocks: 425461
TreeView+ depends on / blocked
Reported: 2007-03-08 12:11 UTC by David Sherwood
Modified: 2008-08-15 23:00 UTC (History)
3 users (show)

Fixed In Version: RHBA-2008-0314
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2008-05-21 14:41:50 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
IBM Linux Technology Center 34925 None None None Never
Red Hat Product Errata RHBA-2008:0314 normal SHIPPED_LIVE Updated kernel packages for Red Hat Enterprise Linux 5.2 2008-05-20 18:43:34 UTC

Description David Sherwood 2007-03-08 12:11:30 UTC
Description of problem:

It is possible for ELF binaries to be launched by the kernel
without a terminating AT_NULL in the auxilliary vector. This
will confuse the dynamic linker and potentially cause it to crash.

Reason for failure is because the saved_auxv vector in the mm_struct
is not large enough to fit all possible entries. This can occur for
64-bit ELF binaries that also have a AT_EXECFD entry, bearing in mind
that 64-bit binaries often have a number of additional AT_IGNORE entries.

Version-Release number of selected component (if applicable):

How reproducible:

Very reproducible. Without a AT_NULL terminator the linker just
parses random memory until it runs off the stack.

Steps to Reproduce:

1. Register a 64-bit handler in binfmt_misc with the flags POC for
   any arbitrary binary format of type P.
2. Invoke the handler by executing a binary file of type P.
3. If this doesn't happen readily, then try setting certain
   environment variables such as LD_SHOW_AUXV=1 or LD_DEBUG=all, etc.

Actual results:

Certain specially invoked 64-bit ELF binaries can crash in the linker.

Expected results:

The linker never crashes.

Additional info:

Here are the 22 entries found in a 64-bit ELF binary that
causes the linker to crash:


The saved_auxv member only has space for 22 entries, thus it
cannot fit an extra AT_NULL.

Comment 1 IBM Bug Proxy 2007-08-08 14:10:29 UTC
----- Additional Comments From (prefers email at  2007-08-08 10:04 EDT -------
Hrm, that's becoming a recurring problem. We bumpted the size to 44 (22 entries
without NULL terminator) in 2.6.16 because of that. It seems to be that
something (either RHEL5 or upstream, I would have to check) added some new
entries without bumping the size of the array. I suspect we may want to change
the logic here to avoid the problem once for all.

I'm away and travelling for about a month so I won't be able to do anything
there but that's definitely something that needs to be looked at more closely
and fixed, maybe Paul can have a go ? The fix for now is trivial, just bump the
array size to 46 instead of 44 (AT_VECTOR_SIZE in include/linux/auxvec.h), but
we should look into doing something better to avoid the problem in the future
for upstream. 

Comment 5 RHEL Product and Program Management 2007-11-02 14:05:17 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update

Comment 7 Don Zickus 2007-12-14 18:40:41 UTC
in 2.6.18-60.el5
You can download this test kernel from

Comment 10 errata-xmlrpc 2008-05-21 14:41:50 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

Comment 11 IBM Bug Proxy 2008-06-26 09:24:43 UTC
------- Comment From 2008-06-26 05:22 EDT-------

Is the fix for this bug expected to be in the next update/release?

Comment 12 IBM Bug Proxy 2008-08-15 23:00:22 UTC
Well, it's not "unused". It's necessary to be backward compatible with old old
old glibc's. I suppose that's not a big deal to lose that compatibility in RHEL
tough as the affected glibc is really very old.

Note You need to log in before you can comment on or make changes to this bug.