Bug 288965

Summary:	app-antivirus/clamav-0.95.2: PAX causes segfault on clamd
Product:	Gentoo Linux	Reporter:	Chris Frederick <chrisf>
Component:	Hardened	Assignee:	The Gentoo Linux Hardened Team <hardened>
Status:	RESOLVED DUPLICATE
Severity:	critical
Priority:	High
Version:	2008.0
Hardware:	x86
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Chris Frederick 2009-10-13 21:37:59 UTC

clamd keeps getting killed via a segmentation fault.  Looking into the logs shows the following:
PAX: execution attempt in: <NULL>, 00000000-00000000 00000000
PAX: terminating task: /usr/sbin/clamd(clamd):24126, uid/euid: 101/101, PC: 00000000, SP: 481f8ad0
PAX: bytes at PC: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
PAX: bytes at SP-4: 

I have created a shell script to watch for this issue and re-start /etc/init.d/clamd if necessary.  vixie-cron then emails me every time /etc/init.d/clamd is restarted via this script.  Since I have discovered this on 9/24, I have received over 200 emails, and the frequency is increasing (up to about 3-5 per hour currently).  This is letting emails through to users without any virus filtering.

Reproducible: Always

Steps to Reproduce:
1. /etc/init.d/clamd start
2. while [ ! -z "$(pidof clamd)" ];do sleep 60;done
3. tail /var/log/kern.log

Actual Results:  
PAX: execution attempt in: <NULL>, 00000000-00000000 00000000
PAX: terminating task: /usr/sbin/clamd(clamd):24126, uid/euid: 101/101, PC: 00000000, SP: 481f8ad0
PAX: bytes at PC: ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
PAX: bytes at SP-4: 

Expected Results:  
not segfault

Portage 2.1.6.13 (!../usr/portage/profiles/hardened/x86, gcc-3.4.6, glibc-2.9_p20081201-r2, 2.6.25-hardened-r10 i686)
=================================================================
System uname: Linux-2.6.25-hardened-r10-i686-Intel-R-_Pentium-R-_4_CPU_3.20GHz-with-glibc2.3.2
Timestamp of tree: Mon, 12 Oct 2009 14:15:01 +0000
app-shells/bash:     3.2_p39
dev-lang/python:     2.4.4-r9, 2.5.4-r3
dev-python/pycrypto: 2.0.1-r6
sys-apps/baselayout: 1.12.11.1
sys-apps/sandbox:    1.6-r2
sys-devel/autoconf:  2.63-r1
sys-devel/automake:  1.7.9-r1, 1.10.2
sys-devel/binutils:  2.18-r3
sys-devel/gcc-config: 1.4.1
sys-devel/libtool:   1.5.26
virtual/os-headers:  2.6.27-r2
ACCEPT_KEYWORDS="x86"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=pentium4 -pipe -fomit-frame-pointer"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/gconf /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/udev/rules.d"
CXXFLAGS="-O2 -march=pentium4 -pipe -fomit-frame-pointer"
DISTDIR="/usr/distfiles"
FEATURES="distlocks fixpackages parallel-fetch protect-owned sandbox sfperms strict unmerge-orphans userfetch"
GENTOO_MIRRORS="ftp://gentoo.mirrors.tds.net/gentoo"
LDFLAGS="-Wl,-O1"
MAKEOPTS="-j2"
PKGDIR="/usr/distfiles/server-packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/var/overlay"
SYNC="rsync://rsync.us.gentoo.org/gentoo-portage"
USE="acl acpi berkdb cracklib crypt gd hardened ldap mmx modules nls nptl nptlonly pam pic readline sse sse2 ssl sysfs tcpd threads urandom vim-syntax x86 xorg zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1       emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m  maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="authz_user alias auth_basic authn_file authz_host deflate dir env expires filter headers log_config mime negotiation rewrite unique_id dav dav_fs" APACHE2_MPMS="prefork" ELIBC="glibc" INPUT_DEVICES="mouse keyboard evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" USERLAND="GNU" VIDEO_CARDS="apm ark chips cirrus cyrix dummy fbdev glint i128 i740 imstt intel    mach64 mga neomagic nsc nv r128 radeon rendition s3 s3virge savage         siliconmotion sis sisusb tdfx tga trident tseng v4l vesa vga via vmware         voodoo"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK, LANG, LC_ALL, LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

Comment 1 Gordon Malm (RETIRED) gentoo-dev

2009-10-14 00:30:34 UTC


*** This bug has been marked as a duplicate of bug 275928 ***