sysctl: free(): invalid next size (fast): 0x0804b008

Bug #190717 reported by Till Ulen
4
Affects Status Importance Assigned to Milestone
procps (Debian)
Fix Released
Unknown
procps (Ubuntu)
Fix Released
Undecided
Kees Cook

Bug Description

Binary package hint: procps

When running the command 'sysctl net.ipv4.conf.all', glibc detects some problem with memory management:

$ sysctl net.ipv4.conf.all
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 1
net.ipv4.conf.all.shared_media = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.proxy_arp = 0
net.ipv4.conf.all.medium_id = 0
net.ipv4.conf.all.bootp_relay = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.all.tag = 0
net.ipv4.conf.all.arp_filter = 0
net.ipv4.conf.all.arp_announce = 0
net.ipv4.conf.all.arp_ignore = 0
net.ipv4.conf.all.arp_accept = 0
net.ipv4.conf.all.disable_xfrm = 0
net.ipv4.conf.all.disable_policy = 0
net.ipv4.conf.all.force_igmp_version = 0
net.ipv4.conf.all.promote_secondaries = 0
*** glibc detected *** sysctl: free(): invalid next size (fast): 0x0804b008 ***
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6[0xb7df8d65]
/lib/tls/i686/cmov/libc.so.6(cfree+0x90)[0xb7dfc800]
sysctl[0x8049105]
======= Memory map: ========
08048000-0804a000 r-xp 00000000 fe:01 16397 /sbin/sysctl
0804a000-0804b000 rw-p 00001000 fe:01 16397 /sbin/sysctl
0804b000-0806c000 rw-p 0804b000 00:00 0 [heap]
b7c00000-b7c21000 rw-p b7c00000 00:00 0
b7c21000-b7d00000 ---p b7c21000 00:00 0
b7d8e000-b7d8f000 rw-p b7d8e000 00:00 0
b7d8f000-b7ed3000 r-xp 00000000 fe:01 86310 /lib/tls/i686/cmov/libc-2.6.1.so
b7ed3000-b7ed4000 r--p 00143000 fe:01 86310 /lib/tls/i686/cmov/libc-2.6.1.so
b7ed4000-b7ed6000 rw-p 00144000 fe:01 86310 /lib/tls/i686/cmov/libc-2.6.1.so
b7ed6000-b7ed9000 rw-p b7ed6000 00:00 0
b7ed9000-b7ee5000 r-xp 00000000 fe:01 65659 /lib/libproc-3.2.7.so
b7ee5000-b7ee6000 rw-p 0000b000 fe:01 65659 /lib/libproc-3.2.7.so
b7ee6000-b7efa000 rw-p b7ee6000 00:00 0
b7efc000-b7f06000 r-xp 00000000 fe:01 65553 /lib/libgcc_s.so.1
b7f06000-b7f07000 rw-p 0000a000 fe:01 65553 /lib/libgcc_s.so.1
b7f07000-b7f08000 rw-p b7f07000 00:00 0
b7f0a000-b7f0b000 rw-p b7f0a000 00:00 0
b7f0b000-b7f25000 r-xp 00000000 fe:01 71394 /lib/ld-2.6.1.so
b7f25000-b7f27000 rw-p 00019000 fe:01 71394 /lib/ld-2.6.1.so
bfc0c000-bfc22000 rw-p bfc0c000 00:00 0 [stack]
ffffe000-fffff000 r-xp 00000000 00:00 0 [vdso]
Aborted (core dumped)

Despite the "core dumped" message, there is no core dump neither in the current directory nor in /var/crash. The 0x0804b008 number in the "invalid next size" line is the same each time I execute 'sysctl net.ipv4.conf.all'.

I'm running Ubuntu 7.10 Gutsy with latest security and recommended updates. Relevant package versions are:

procps 1:3.2.7-3ubuntu5
libc6-i686 2.6.1-1ubuntu10
libc6 2.6.1-1ubuntu10
libgcc1 1:4.2.1-5ubuntu4
linux-image-2.6.22-14-generic 2.6.22-14.51

Can anyone reproduce this problem? If not, what can I do to help you debug this?

Revision history for this message
Andrew McCarthy (andrewmccarthy) wrote :

This appears to be a bug that was recently fixed in Debian's procps version 1:3.2.7-4. If so, this is fixed in the version in Hardy. As a bug that causes a crash, could a developer please release an update for Gutsy?

Changed in procps:
status: New → Confirmed
Revision history for this message
Andrew McCarthy (andrewmccarthy) wrote :

I think the specific patch needed for pre-Hardy releases for this issue is procps-3.2.7/debian/patches/10_sysctl_malloclen.dpatch.

Changed in procps:
status: Unknown → Fix Released
Revision history for this message
Kees Cook (kees) wrote :

This is fixed in Hardy. Since it is not appear to impact functionality, it is unlikely that it will be addressed in a StableReleaseUpdate.

Changed in procps:
assignee: nobody → keescook
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.