News for hackers. Stuff that matters.

A comment on CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow. Parent comment

Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by JshWright on Tuesday January 27, 2015 @11:26AM (#8953926)
You can check to see if any running process are using any stale libraries pretty easily:

sudo lsof | grep lib | grep DEL

You can then either reload those processes manually, or just bounce the box if that's easier.

[ Parent | on HN ]
Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by gtrubetskoy on Tuesday January 27, 2015 @12:38PM (#8954438)
There's also a rare chance that a program is statically linked, in which case upgrading glibc won't help, the program would need to be recompiled.
[ Parent | on HN ]
Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by JshWright on Tuesday January 27, 2015 @12:45PM (#8954475)
Yeah, that's a good point, and definitely worth mentioning, but obviously rebooting isn't going to help in that case either. The parent was asking about how they would know if they need to reboot or not.
[ Parent | on HN ]
Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by aidenn0 on Tuesday January 27, 2015 @01:23PM (#8954690)
It is nearly impossible to statically link glibc.
[ Parent | on HN ]
Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by cnvogel on Tuesday January 27, 2015 @02:11PM (#8955023)
... with nss-modules being a major culprit, ironically... (on which gethostbyname relies greatly)...
[ Parent | on HN ]
[deleted]
Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by teraflop on Tuesday January 27, 2015 @12:15PM (#8954285)
You're testing what happens when you delete a file for which an open file descriptor exists. On Linux, a shared library will normally be memory-mapped but will not have a corresponding file descriptor. So lsof will show DEL, not (deleted).

I wouldn't normally nitpick about something like this, but if people follow your advice they might incorrectly think they don't need to reboot.

[ Parent | on HN ]
Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by nkurz on Tuesday January 27, 2015 @12:15PM (#8954287)
You can see that the removed file gets a (deleted) in the 'NAME' column but not DEL in the 'TYPE'.

Maybe you have a cut-and-paste error? The before and after look the same to me, no "(deleted)" to be seen.

[ Parent | on HN ]
Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by danielweber on Tuesday January 27, 2015 @12:22PM (#8954336)
Use contrl-F to search, it got clipped off the right-hand side by HN's raw-mode display.
[ Parent | on HN ]