Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OS X 10.11 buffer overflow with deep filesystem hierarchy

cxsecurity.com

Post reply on HN
Print view View original

11–20 of 47 posts

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#11

Post by daenney »

devit wrote: post #7

This is because OSX uses a feature-limited (and apparently completely broken given this report...) BSD-derived userspace instead of the GNU software used with Linux, which are usually specifically designed to not have fixed limits of any kind.

That's because, license wise, they can't include GPL 3 licensed code, aka the GNU user space.

Also, this bug does not prove that the whole user space is completely broken. Many people use it daily without ever hitting these bugs. If you go looking for issues, you'll find them, just as you'll find them on Linux but in different places. Not to say this doesn't suck and we shouldn't fix them, but it's hardly proof of anything.

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#12

Post by pmarin »

tedunangst wrote: post #10
trengrj wrote: post #8

Earlier quoted context omitted.

An OS X web server... As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code http://meta.ath0.com/2012/02/05/apples-great-gpl-purge/ . This results in their userspace code being out of date (i.e. they still use bash version 3.2) and having bugs like these.

So all BSD systems have the same bug??

Most BSD systems not include GPL code in their base system if it is not necesary but you can install it from ports or whatever they have.

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#13

Post by misterdata »

devit wrote: post #7

This is because OSX uses a feature-limited (and apparently completely broken given this report...) BSD-derived userspace instead of the GNU software used with Linux, which are usually specifically designed to not have fixed limits of any kind.

So I assume this means the other BSDs (e.g. FreeBSD) exhibit the same bug?

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#14

Post by userbinator »

The article references http://www.opensource.apple.com/source/Libc/Libc-1044.40.1/g... but there's nothing that particularly stands out as being the bug at a quick glance and it is designed to handle arbitrarily deep hierarchies; nonetheless this looks like an off-by-one to me (in fts_alloc):

    len = sizeof(FTSENT) + namelen;
    if (!ISSET(FTS_NOSTAT))
        len += sizeof(struct stat) + ALIGNBYTES;
    if ((p = malloc(len)) == NULL)
        return (NULL);

    /* Copy the name plus the trailing NULL. */
    memmove(p->fts_name, name, namelen + 1);
It's a pretty minor bug, since I'd bet the chances of it causing a major exploitable vulnerability are quite low. A theoretical attacker can only control somewhat coarsely where a single byte with the value 0 can be written, and this is in userspace. Most of the time it probably lands in unused padding, and otherwise in an invalid address which causes a segfault.

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#15

Post by devit »

daenney wrote: post #11
devit wrote: post #7

This is because OSX uses a feature-limited (and apparently completely broken given this report...) BSD-derived userspace instead of the GNU software used with Linux, which are usually specifically designed to not have fixed limits of any kind.

That's because, license wise, they can't include GPL 3 licensed code, aka the GNU user space. Also, this bug does not prove that the whole user space is completely broken. Many people use it daily without ever hitting these bugs. If you go looking for issues, you'll find them, just as you'll find them on Linux but in different places. Not to say this doesn't suck and we shouldn't fix them, but it's hardly proof of an…

Where "can't" means "they don't want to because they want to reserve themselves the ability to screw their users by shipping devices with OSX or derivatives installed where the user cannot change the software, which the GPLv3 is specifically designed to prevent".

Considering handling paths is one of the most fundamental functions of the Unix tools and C library, having buffer overflows there is quite damning.

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#16

Post by hedwall »

the_mitsuhiko wrote: post #9
trengrj wrote: post #8

Earlier quoted context omitted.

An OS X web server... As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code http://meta.ath0.com/2012/02/05/apples-great-gpl-purge/ . This results in their userspace code being out of date (i.e. they still use bash version 3.2) and having bugs like these.

> As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code They do not refuse, they cannot include it from a legal point of view.

What is the difference between GPL2 and GPL3 that makes this impossible from a legal POV?

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#17

Post by Someone »

hedwall wrote: post #16
the_mitsuhiko wrote: post #9

Earlier quoted context omitted.

> As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code They do not refuse, they cannot include it from a legal point of view.

What is the difference between GPL2 and GPL3 that makes this impossible from a legal POV?

I don't think anybody knows whether there is a real difference, but the increased strictness of GPL3 such as its anti-TIVOization (https://en.m.wikipedia.org/wiki/Tivoization) clauses certainly make a lot of lawyers concerned.

Where exactly the border lies between and not linking is a grey area, legally, that hasn't become clearer with GPL3.

It wouldn't surprise me to see bash go from the standard install, too. Apple is slowly removing all GPL code from its OS.

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#18

Post by autoreleasepool »

Someone wrote: post #17
hedwall wrote: post #16

Earlier quoted context omitted.

What is the difference between GPL2 and GPL3 that makes this impossible from a legal POV?

I don't think anybody knows whether there is a real difference, but the increased strictness of GPL3 such as its anti-TIVOization ( https://en.m.wikipedia.org/wiki/Tivoization ) clauses certainly make a lot of lawyers concerned. Where exactly the border lies between and not linking is a grey area, legally, that hasn't become clearer with GPL3. It wouldn't surprise me to see bash go from the standard install, too. App…

I hope they make ZSH the standard shell. It's similar enough to bash to not disrupt most workflows and Apple has been able to update it due to its permissive license.

I use ZSH as my main shell on OS X. I find it superior to bash in almost every way (especially with oh-my-zsh) except in ubiquity. Even so, I have no problem using bash if that's all that's available, the two shells are fairly compatible.

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#19

Post by [deleted] »

tedunangst wrote: post #10
trengrj wrote: post #8

Earlier quoted context omitted.

An OS X web server... As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code http://meta.ath0.com/2012/02/05/apples-great-gpl-purge/ . This results in their userspace code being out of date (i.e. they still use bash version 3.2) and having bugs like these.

So all BSD systems have the same bug??

[deleted]

Re: OS X 10.11 buffer overflow with deep filesystem hierarchy

#20

Post by __s »

misterdata wrote: post #13
devit wrote: post #7

This is because OSX uses a feature-limited (and apparently completely broken given this report...) BSD-derived userspace instead of the GNU software used with Linux, which are usually specifically designed to not have fixed limits of any kind.

So I assume this means the other BSDs (e.g. FreeBSD) exhibit the same bug?

https://news.ycombinator.com/item?id=10443276
Post reply on HN