Bug 351816 – pecl-ssh2: WordPress updater causes Apache to crash due to stack smash

• Product: Gentoo Linux
• Status: RESOLVED TEST-REQUEST

[Description David Korth 2011-01-16 01:55:14 UTC]

Attempting to run the WordPress updater (WordPress 3.0) using SSH2 on a server with hardened Gentoo results in Apache aborting due to a stack smash. I've narrowed it down to dev-php5/pecl-ssh2. Compiling pecl-ssh2 using hardenednossp works around the problem and allows the updater to continue.

From apache's error.log:
*** stack smashing detected ***: apache2 - terminated
apache2: stack smashing attack in function <unknown> - terminated
Report to http://bugs.gentoo.org/

Relevant package versions:
www-servers/apache: 2.2.16
dev-lang/php: 5.3.5 (with suhosin)
net-libs/libssh2: 1.2.7
dev-php5/pecl-ssh2: 0.11.2-r1

emerge --info:

Portage 2.1.9.25 (hardened/linux/amd64, gcc-4.4.4, glibc-2.11.2-r3, 2.6.35-gentoo-r9-hellfire x86_64)
=================================================================
System uname: Linux-2.6.35-gentoo-r9-hellfire-x86_64-Intel-R-_Xeon-R-_CPU_E5410_@_2.33GHz-with-gentoo-2.0.1
Timestamp of tree: Sat, 15 Jan 2011 23:00:22 +0000
distcc 3.1 x86_64-pc-linux-gnu [disabled]
ccache version 2.4 [enabled]
app-shells/bash:     4.1_p7
dev-java/java-config: 2.1.11-r3
dev-lang/python:     2.6.6-r1, 3.1.2-r4
dev-util/ccache:     2.4-r9
dev-util/cmake:      2.8.1-r2
sys-apps/baselayout: 2.0.1-r1
sys-apps/openrc:     0.6.8
sys-apps/sandbox:    2.4
sys-devel/autoconf:  2.65-r1
sys-devel/automake:  1.8.5-r3, 1.9.6-r3, 1.10.3, 1.11.1
sys-devel/binutils:  2.20.1-r1
sys-devel/gcc:       4.4.4-r2
sys-devel/gcc-config: 1.4.1
sys-devel/libtool:   2.2.10
sys-devel/make:      3.81-r2
virtual/os-headers:  2.6.30-r1 (sys-kernel/linux-headers)
ACCEPT_KEYWORDS="amd64"
ACCEPT_LICENSE="*"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -march=core2 -mmmx -msse -msse2 -msse3 -mssse3 -msse4.1 -ftree-vectorize"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/openvpn/easy-rsa"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.3/ext-active/ /etc/php/cgi-php5.3/ext-active/ /etc/php/cli-php5.3/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo"
CXXFLAGS="-O2 -pipe -march=core2 -mmmx -msse -msse2 -msse3 -mssse3 -msse4.1 -ftree-vectorize"
DISTDIR="/var/cache/distfiles/"
FEATURES="assume-digests binpkg-logs ccache distlocks fixlafiles fixpackages news protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox"
GENTOO_MIRRORS="http://gentoo.mirrors.tds.net/gentoo"
LANG="en_US.UTF-8"
LC_ALL="en_US.UTF-8"
LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--hash-style=both -Wl,--as-needed"
LINGUAS="en en_US"
MAKEOPTS="-j9"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_EXTRA_OPTS="--progress --exclude=etc/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="aalib acl acpi amd64 apache2 avahi berkdb bidi branding bzip2 caps cddb cdr cgi cjk cli cracklib crypt cups curl cxx dbus dedicated device-mapper dmi dri dvd dvdr dvdread enca encode exif expat extraengine fastcgi fftw flac fontconfig foomaticdb ftp fts3 fuse gd geoip gif gmp gpm gs gsl hardened hfs iconv idn imagemagick imlib innodb ithreads javascript jbig jpeg jpeg2k justify lame ldap libcaca libgcrypt libsamplerate libwww lm_sensors lzo lzw mdnsresponder-compat mhash mime mmap mmx mmxext modules mp3 mudflap multilib mysql ncurses network network-cron nls nptl nptlonly ntfs offensive ogg openmp pam pcre perl pic png ppds pppd rdesktop readline reiserfs secure-delete session sftp simplexml slp smime smp snmp sqlite sqlite3 srvdir sse sse2 sse3 ssl ssse3 suhosin svg symlink sysfs system-sqlite tcpd tetex themes threads threadsafe tidy tiff truetype udev unicode urandom usb utempter vcd vhosts vorbis wmf xattr xcb xml xorg xsl zeroconf zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic auth_digest authn_alias authn_anon authn_default authn_file authz_default authz_groupfile authz_host authz_owner authz_user autoindex dav dav_fs dav_lock deflate dir env expires ext_filter filter headers include info log_config logio mime mime_magic negotiation rewrite setenvif speling status userdir vhost_alias cgid" APACHE2_MPMS="worker" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en en_US" PHP_TARGETS="php5-3" RUBY_TARGETS="ruby18" USERLAND="GNU" VIDEO_CARDS="vesa radeon" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" 
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS


Reproducible: Always

Steps to Reproduce:
1. Install an old version of WordPress (e.g. 3.0).
2. Attempt to use the automatic updater via SSH2.


Actual Results:  
WordPress will hand on either "Unpacking the update" or "Installing the latest version", and the Apache error log will show a stack smash error.

Expected Results:  
WordPress' automatic update should complete successfully.

[Comment 1 Matti Bickel (RETIRED) 2011-01-29 22:27:25 UTC]

Thanks for the report, I will investigate this. Having no hardened testing machine handy, this might prove tricky. But let's see what I can do.

[Comment 2 Ole Markus With (RETIRED) 2012-02-15 12:59:13 UTC]

Sorry for taking so long about this.

In order to resolve this bug we need an easier way to reproduce it.

It would also be nice to know if the bug persists on the newer version of pecl-ssh2 and its deps.