shell scripts cannot run from bash

[Alvin Thompson]

ubuntu 8.10 64-bit does not run scripts properly from bash. try this:

$ echo echo hello! > hello
$ chmod +x hello
$ ./hello

bash crashes with the following error:

malloc: ../bash/dispose_cmd.c:241: assertion botched
free: called with unallocated block argument
Aborting...Aborted

this obviously has unbelievable security ramifications. i'm amazed this ever saw the light of day.

[Kees Cook (kees)]

$ echo echo hello! > hello
$ cat hello
echo hello!
$ chmod +x hello
$ ./hello
hello!

I don't seem to be able to reproduce this problem.

[Kees Cook (kees)]

Please also check any output in "dmesg". Are you perhaps trying to run shell scripts within a confined AppArmor profile?

[Alvin Thompson (alvint-deactivatedaccount)]

i don't think so; it's a default install. how do i check?

i see nothing unusual in dmesg, although it does say 'AppArmor initialized' and 'AppArmor Filesystem Enabled'.

[Alvin Thompson (alvint-deactivatedaccount)]

are you using the 64-bit version of 8.10? it seems to be confined to that.

[Alvin Thompson (alvint-deactivatedaccount)]

actually, it may be related to apparmor and ssh. if i run the script locally on one of my work machines (32-bit), it works fine. if i ssh to the machine and run the script, the terminal locks up with 50% CPU usage. i have to kill the process.

i've been trying to run the script through ssh on the 64-bit machine. i'll try it locally when i get home.

[Kees Cook (kees)]

Yes, I'm doing this with a 64bit 8.10 machine. What do you have in your
/usr/share/binfmts directory? Perhaps something strange is in there trying
to execute your script prior to bash (your script example lacks a "#!..."
header as the first line, so it's possible that something other than bash
is trying to execute it).

[Alvin Thompson (alvint-deactivatedaccount)]

---
$ ls /usr/share/binfmts
jar python2.5
---

if i add the line '#!/bin/bash' to the script, it runs fine, so i guess it's not bash. any ideas?

[Alvin Thompson (alvint-deactivatedaccount)]

it looks like there are 2 problems here. if i remove everything java from my work (32-bit) computer, the problem goes away (no more lockups). that got rid of /usr/share/binfmts/jar, which i assume was the source of the lockups. that's definitely a security issue because an unprivileged user can launch a very effective DOS with just a couple of shells.

unfortunately, the same didn't work for my 64-bit computer at home. i still have the same (original) problem. to sum up, i removed everything mono and java so now the only thing in binfmts is 'python2.5', but the problem is still there. i'm assuming this is still a bash problem because of the error message.

[Alvin Thompson (alvint-deactivatedaccount)]

not sure this adds anything, but if i set my login shell to /bin/sh things work fine.

[Alvin Thompson (alvint-deactivatedaccount)]

can you try after SSH-ing off of your 64-bit machine and back to it? the problem might occur only through an SSH connection.

[Alvin Thompson (alvint-deactivatedaccount)]

i think i've provided all of the requested information. should i mark the bug as 'new' again?

[Kees Cook (kees)]

I am still unable to reproduce this problem. Do you have a series of steps that will cause it? You mentioned your home 64bit machine does not exhibit the problem? What is the output of "ulimit -a" on both machines? (Maybe there are resource limits?)

[Alvin Thompson (alvint-deactivatedaccount)]

i think there were actually 2 problems. the original problem on my 64-bit (home) machine is still present. when i try to run the above shell script on the 64-bit machine i get this error:
---
malloc: ../bash/dispose_cmd.c:241: assertion botched
free: called with unallocated block argument
Aborting...Aborted
---
if i add the "#!/bin/[ba]sh" line to the script it does work fine. "ulimit -a" output:
---
core file size (blocks, -c) 0
data seg size (kbytes, -d) unlimited
scheduling priority (-e) 0
file size (blocks, -f) unlimited
pending signals (-i) 40448
max locked memory (kbytes, -l) 32
max memory size (kbytes, -m) unlimited
open files (-n) 1024
pipe size (512 bytes, -p) 8
POSIX message queues (bytes, -q) 819200
real-time priority (-r) 0
stack size (kbytes, -s) 8192
cpu time (seconds, -t) unlimited
max user processes (-u) unlimited
virtual memory (kbytes, -v) unlimited
file locks (-x) unlimited
---
for my work (32-bit) computer the cause (i suspect) was the "/usr/share/binfmts/jar" file; when running a script from a bash ssh shell (without the "#!/bin/[ba]sh" line), the process locks up with around 50% CPU and must be killed externally. i could recreate this by simply SSHing from this computer to another computer, then back to my work computer, and running the script. removing java from this computer solved this problem, and this computer does not exhibit the crash problem of my home computer (above). "ulimit -a" for this computer is:
---
core file size (blocks, -c) 0
data seg size (kbytes, -d) unlimited
scheduling priority (-e) 0
file size (blocks, -f) unlimited
pending signals (-i) 8187
max locked memory (kbytes, -l) 32
max memory size (kbytes, -m) unlimited
open files (-n) 1024
pipe size (512 bytes, -p) 8
POSIX message queues (bytes, -q) 819200
real-time priority (-r) 0
stack size (kbytes, -s) 8192
cpu time (seconds, -t) unlimited
max user processes (-u) 8187
virtual memory (kbytes, -v) unlimited
file locks (-x) unlimited
---

[Alvin Thompson (alvint-deactivatedaccount)]

i can add a login for you on my home computer if it will be helpful...

[Jesse Michael (jesse.michael)]

I can't duplicate this in a gnome-terminal, but if I ssh localhost and run it that way, it hangs for me with 100% cpu also.

Here's the stack trace from when I attached to the process with gdb:

#0 0x080943f0 in termsig_sighandler ()
#1 <signal handler called>
#2 0x0806edda in dispose_word ()
#3 0x0806ef50 in dispose_words ()
#4 0x0806f1b6 in dispose_command ()
#5 0x0806f189 in dispose_command ()
#6 0x0806f136 in dispose_command ()
#7 0x08076ddb in dispose_variable ()
#8 0x08090729 in hash_flush ()
#9 0x08075479 in delete_all_variables ()
#10 0x08060be4 in main ()

[Kees Cook (kees)]

In my intrepid VM, ssh'ing in, I see it. Looking at the code, I suspect
it's the "-" in argv[0] and how it is skipping it without regard to
possible later use of free().

[dugrands (kanjesam)]

Hello, I have an almost similar but different problem. i can't execute any script from the command line at all.

./script will give a no file or directory found.

Any Idea?

btw. its ubuntu 8.10.

thanks.

[Alvin Thompson (alvint-deactivatedaccount)]

jesse, how did you recreate that 100% CPU problem? when i uninstalled java and mono, the problem went away for me and doesn't come back even if i reinstall them.

[Alvin Thompson (alvint-deactivatedaccount)]

dugrands, what exactly is the error it gives you?

[dugrands (kanjesam)]

It, says, "-bash: /path/to/script no such file or directory." the script is not a link and doing cat even shows the unreadable binary code.

[Alvin Thompson (alvint-deactivatedaccount)]

dugrands, what did you cat that shows binary code? a script is written in text.

[Kees Cook (kees)]

I'm unsetting this as a security issue since it's just related to running scripts that lack a #! header from the login shell.

[Alvin Thompson (alvint-deactivatedaccount)]

how is this not a security issue? with the second problem, an unprivileged user can launch a DOS attack by maxing out the CPU.

[klnusbaum (kob0724)]

I would just like to say that I use 64-bit Ubuntu 8.10 and I have this exact same problem. If I ssh to my machine, I can't run a script on my machine unless at the top of that script I put #!/bin/bash.

[chupachups (kchan-fluentskill)]

Its not just the 64bit version of 8.10

I'm running the 32bit version on intel hardware and can reproduce the problem

It exhibits itself when you do the above in ssh, not in terminal

ie

ssh localhost
echo echo hello! > hello
chmod +x hello
./hello

I encountered this problem whilst setting up oracle 11g, which has a script "oraenv", and within this "oraenv" it invokes a 2nd script "dbhome" which doesn't contain #!

[klnusbaum (kob0724)]

I'm not sure if this is significant, but it might have something to do with our problem. Whenever I'm sshing to my ubuntu machine, I'm doing it via a tcsh shell. Is any one else who is getting this problem using a tcsh shell when they are sshing to their machine?

[George Talev (gtalev)]

In order to have the same buggy behavior in gnome-terminal, you have to set the option "Run command as a login shell" in Edit -> Profile preferences -> Title And Command

[Andy Grover (andy-groveronline)]

upgraded to jaunty, working for me now.

[Ken Sharp (kennybobs)]

I would guess that this is now fixed. Anyone still seeing this in a current release?

[Launchpad Janitor (janitor)]

[Expired for bash (Ubuntu) because there has been no activity for 60 days.]