grsecurity forums

Has anyone else seen this with libgd and their webserver?

May 15 10:50:04 vserver kernel: PAX: From 1.2.3.4: execution attempt in: <NULL>, 00000000-00000000 00000000
May 15 10:50:04 vserver kernel: PAX: terminating task: /usr/sbin/httpd(httpd):10406, uid/euid: 48/48, PC: 000002a9, SP: 5b06127c
May 15 10:50:04 vserver kernel: PAX: bytes at PC: <invalid address>.
May 15 10:50:04 vserver kernel: PAX: bytes at SP: 258e2a9a 09cc6b18 00002000 000002a0 258e844c 257a5a6e 00000001 5b061338 258da8d1 09cc6b18 00002000 256be920 00000000 00000006 2579ece0 0000006b 00000000 0000008c 00000010 00000001

I'm assuming something as simple as chpaxing the library could fix it, but I'm not sure if you can chpax a library.

ObDetails:

2.6.11.7-grsec
redhat9 (so none of that execstack insanity or broken glibc)

linuxuser wrote:Has anyone else seen this with libgd and their webserver?

May 15 10:50:04 vserver kernel: PAX: From 1.2.3.4: execution attempt in: <NULL>, 00000000-00000000 00000000
May 15 10:50:04 vserver kernel: PAX: terminating task: /usr/sbin/httpd(httpd):10406, uid/euid: 48/48, PC: 000002a9, SP: 5b06127c

looks like a NULL function pointer dereference, you would have seen a sigsegv without PaX. try to get a coredump and analyze it (i posted instructions on that on the list some time ago, maybe someone wants to put that into the wiki now? , to see what led to this failure.

Thanks for the pointer, I'll do that.