Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 4412 - GCC 3.1 compiled pam leaves gaping security hole
Summary: GCC 3.1 compiled pam leaves gaping security hole
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] GCC Porting (show other bugs)
Hardware: x86 All
: High critical (vote)
Assignee: Ferry Meyndert (RETIRED)
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2002-07-01 18:55 UTC by Peter Bienstman (RETIRED)
Modified: 2003-02-04 19:42 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Peter Bienstman (RETIRED) gentoo-dev 2002-07-01 18:55:54 UTC
If pam is compiled with gcc 3.1 and with -O3, pam accepts any random password 
when doing a login or an su. Dropping the optimisation level to -O2 solves 
this problem.
Comment 1 Matthew Kennedy (RETIRED) gentoo-dev 2002-07-01 19:20:22 UTC
Seemant,

I can't reproduce this as described. I'd rather someone else with some pam
knowledge take a look at it.
Comment 2 Shawn Foley 2002-07-02 13:38:27 UTC
My experience

PAM compiled with
"-march=pentium3 -O3 -pipe -mfpmath=sse -funroll-all-loops -fomit-frame-pointer
-ffast-math -fprefetch-loop-arrays"
no password needed to get into system

PAM compiled with
"-march=pentium3 -O3 -pipe -mfpmath=sse"
password needed 
Comment 3 Peter Bienstman (RETIRED) gentoo-dev 2002-07-02 17:35:09 UTC
Some more info on my compile flags. Things go wrong with   "-O3 -march=pentium3 -funroll-all-loops -fomit-frame-pointer -ffast-math -mfpmath=sse -pipe"   Keeping the same flags, but changing -O3 to -O2 solved the problem. 
Comment 4 Shawn Foley 2002-07-02 22:38:10 UTC
after some trial an error i am not able to reproduce this error when i take out
"-funroll-all-loops" but leave in "-O3"

so
"-march=pentium3 -O3 -pipe -mfpmath=sse -fomit-frame-pointer -ffast-math
-fprefetch-loop-arrays"
=OK

"-march=pentium3 -O3 -pipe -mfpmath=sse -funroll-all-loops -fomit-frame-pointer
-ffast-math -fprefetch-loop-arrays"
=BAD
Comment 5 foser (RETIRED) gentoo-dev 2002-08-23 08:19:25 UTC
can't reproduce it with flags "-march=athlon-tbird -O3 -pipe -m3dnow -mmmx
-fomit-frame-pointer -funroll-loops -finline-functions -fexpensive-optimizations" 
Comment 6 SpanKY gentoo-dev 2002-09-14 23:39:55 UTC
can you test this on gcc3.2 to see if the issue still exists ?
cause if it doesnt i say we punt this bug since 3.1 was never a real gcc 
version we want to support anyways ;)
Comment 7 Martin Schlemmer (RETIRED) gentoo-dev 2002-12-03 01:53:03 UTC
Could have been the memory corruption bug in pre gcc-3.2.1 (we patched 3.2
to fix this).  Can you try this again with 3.2.1, and close if fixed ?