News for hackers. Stuff that matters.

A comment on CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow. Parent comment

[deleted]
Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by teraflop on Tuesday January 27, 2015 @12:15PM (#8954285)
You're testing what happens when you delete a file for which an open file descriptor exists. On Linux, a shared library will normally be memory-mapped but will not have a corresponding file descriptor. So lsof will show DEL, not (deleted).

I wouldn't normally nitpick about something like this, but if people follow your advice they might incorrectly think they don't need to reboot.

[ Parent | on HN ]
Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by nkurz on Tuesday January 27, 2015 @12:15PM (#8954287)
You can see that the removed file gets a (deleted) in the 'NAME' column but not DEL in the 'TYPE'.

Maybe you have a cut-and-paste error? The before and after look the same to me, no "(deleted)" to be seen.

[ Parent | on HN ]
Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by danielweber on Tuesday January 27, 2015 @12:22PM (#8954336)
Use contrl-F to search, it got clipped off the right-hand side by HN's raw-mode display.
[ Parent | on HN ]