Subject: Possible race condition in wu-ftpd 2.4?

From: [email-masked] (Warren Toomey)
Date: Thu, 23 Mar 1995 14:58:32 +0000

Hi,
	I've just been pointed at this mailing list by AUSCERT in Australia.
My ftp machine minnie.cs.adfa.oz.au has been sporadically crashing due to a
page fault.

After finding out exactly where in the kernel it was crashing, and preventing
it & logging the attempt, the logs show that wu-ftpd 2.4 is the culprit, via
the getsockopt/setsockopt system call. I am running wu-ftpd 2.4 via the
tcp_wrappers.

Each sockopt event is logged as follows:

Mar 14 17:28:01 minnie /386bsd: sogetopt null pcb pid 687
Mar 14 17:28:01 minnie /386bsd: sosetopt null pcb pid 687
 
as logged by the kernel as it prevents the page fault. The tcp_wrappers log:
 
Mar 14 17:28:01 minnie ftpd[687]: connect from egavd.nexus.olemiss.edu
 
Finally, wu-ftpd 2.4 logged:
 
Mar 14 17:28:04 minnie ftpd[687]: connection from localhost [0.0.0.0]
Mar 14 17:28:04 minnie ftpd[687]: FTP session closed

Looking at the dozens of `events' in the last 2 weeks since I fixed the
bug, I find:

	+ the ftp session closes immediately
	+ wu-ftpd logs the machine's name as localhost, but on all
	  other connections it gets it right
	+ the event is not related to any source routed packets
	+ multiple hosts are causing these events
	+ the hosts causing the events haven't made any other ftp
	  connections in the days before/after the event

My conclusion is that either I am being attacked by a number of sites, or
that wu-ftpd has some bug or race condition.

If any of you have seen anything like this, can you please email me and
let me know, especially if you know the cause. I am on the mailing list.

Many thanks in advance,

	Warren Toomey	[email-masked]	[email-masked]

Appendix
--------

The machine minnie.cs.adfa.oz.au's only purpose is to provide anonymous
ftp, www, mailing-list and search-by-email facilities. There are no user
accounts except some active mail recipients, a non-operator user `warren'
and root.

The operating system is FreeBSD 1.1. I upgraded the OS
in an attempt to rid the system of the crash, but to no avail. I used kgdb
to trace the crashes to the function sogetopt() and sosetopt()
in /sys/kern/uipc_socket.c.

Rarely, in these two functions, the field so->so_pcb was set to NULL.
This null pointer was being dereferenced via the intotcpcb() macro as
follows:

sogetopt/sosetopt() calls tcp_ctloutput() through a f'n pointer, passing so
tcp_ctloutput() calls sotoinpcb() and intotcpcb(), dereferencing so->so_pcb
and crashing the kernel when so->so_pcb is NULL.

I fixed the kernel to prevent to f'n pointer call to tcp_ctloutput() when
so->so_pcb is NULL. I also generate a kernel log message logging the error
and the process-id that did the sogetopt/sosetopt (done via the
getsockopt/setsockopt() system calls).

After rebooting using the modified kernel, I obtained the logs as shown
above.

I am suspicious that wu-ftpd logged a different address than tcp_wrappers,
and suspicious that it is 0.0.0.0. There may be a race condition being
probed in wu-ftp: the intruder opens an ftp connection, and then immediately
closes it again. wu-ftpd tries to getsockopt() on the connection, but it
ain't there any more. The missing so_pcb field causes minnie to crash.

This is only a hypothesis. I could be wrong.