apache2 SEGV with multiple SSL sites
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Apache2 Web Server |
Unknown
|
Unknown
|
|||
apache2 (Ubuntu) |
Fix Released
|
High
|
Unassigned | ||
Trusty |
Fix Released
|
High
|
Unassigned |
Bug Description
Apache2 crashes with multiple SSL sites.
[Impact]
Apache may SEGV on initialisation (and thus refuse to start) when using multiple SSL sites in a moderately complex configuration. Though the crash is caused by OCSP stapling code, it is not necessary for OCSP to be enabled to cause the problem. As the problem is caused by a memory address changing between reads of the config file, in theory any configuration with one SSL site could refuse to run, though in practice a degree of complexity appears to be necessary to cause sufficient memory allocation to trigger the crash.
The bug is thus serious as any SSL apache configuration may not load.
[Testcase]
See comment #1
[Regression Potential]
The most likely regression potential is a failure of OCSP to work properly. OCSP is relatively new and little used code, and hence is less well tested than other areas. Though the work was done upstream and has been approved by OCSP-familiar apache authors, it is possible a change to the OCSP code will cause some OCSP functionality defect. However, the comparative lack of use of OCSP (compared to SSL) means the impact of any such failure should be limited.
Detailed description follows:
When starting apache2 with multiple SSL sites I get a SEGV like this:
(gdb) bt
#0 0x00007ffff05faaf3 in ?? () from /usr/lib/
#1 0x00007ffff29647a6 in int_free_ex_data (class_
#2 0x00007ffff2a05061 in x509_cb (operation=
exarg=
#3 0x00007ffff2a08fea in asn1_item_
at tasn_fre.c:173
#4 0x00007ffff2a091c5 in ASN1_item_free (val=val@
#5 0x00007ffff2a0514c in X509_free (a=a@entry=
#6 0x00007ffff05ee0b8 in ssl_pphrase_Handle (s=s@entry=
#7 0x00007ffff05e3658 in ssl_init_Module (p=0x7ffff7ff0028, plog=<optimized out>, ptemp=0x7ffff7f
at ssl_engine_
#8 0x00005555555aa2a9 in ap_run_post_config (pconf=
#9 0x000055555558ae07 in main (argc=6, argv=0x7fffffff
This is 100% repeatable.
This looks very like:
https:/
save that I am not using Auth at all. However, ssl itself requires the socache logic, so perhaps it has the same root cause.
Disabling a couple of SSL sites normally resolves the problem.
What I expected to happen: apache2 to start without SEGV
What actually happened: apache2 did not start due to SEGV
root@nimtest:/root# lsb_release -rd
Description: Ubuntu 14.04.1 LTS
Release: 14.04
root@nimtest:/root# apt-cache policy apache2-bin
apache2-bin:
Installed: 2.4.7-1ubuntu4.1
Candidate: 2.4.7-1ubuntu4.1
Version table:
*** 2.4.7-1ubuntu4.1 0
500 http://
500 http://
100 /var/lib/
2.4.7-1ubuntu4 0
500 http://
root@nimtest:/root# dpkg --list | egrep '\b(apache2|
ii apache2 2.4.7-1ubuntu4.1 amd64 Apache HTTP Server
ii apache2-bin 2.4.7-1ubuntu4.1 amd64 Apache HTTP Server (binary files and modules)
ii apache2-data 2.4.7-1ubuntu4.1 all Apache HTTP Server (common files)
ii apache2-dbg 2.4.7-1ubuntu4.1 amd64 Apache debugging symbols
ii apache2-utils 2.4.7-1ubuntu4.1 amd64 Apache HTTP Server (utility programs for web servers)
ii libgnutls-
ii libssl1.0.0:amd64 1.0.1f-1ubuntu2.5 amd64 Secure Sockets Layer toolkit - shared libraries
ii libssl1.
ii openssl 1.0.1f-1ubuntu2.5 amd64 Secure Sockets Layer toolkit - cryptographic utility
ii python-openssl 0.13-2ubuntu6 amd64 Python 2 wrapper around the OpenSSL library
Modules in use:
root@nimtest:/root# ls -1 /etc/apache2/
access_compat.load
alias.conf
alias.load
auth_basic.load
authn_core.load
authn_file.load
authz_core.load
authz_groupfile
authz_host.load
authz_user.load
autoindex.conf
autoindex.load
cgi.load
dbd.load
deflate.conf
deflate.load
dir.conf
dir.load
env.load
filter.load
headers.load
ident2.load
lbmethod_
mime.conf
mime.load
mpm_prefork.conf
mpm_prefork.load
negotiation.conf
negotiation.load
php5.conf
php5.load
proxy.conf
proxy.load
proxy_balancer.conf
proxy_balancer.load
proxy_http.load
reqtimeout.conf
reqtimeout.load
rewrite.load
setenvif.conf
setenvif.load
slotmem_shm.load
socache_shmcb.load
ssl.conf
ssl.load
status.conf
status.load
substitute.load
websocket.load
websocket_
Here's a startup log plus 'bt full'
root@nimtest:/root# APACHE_
GNU gdb (Ubuntu 7.7-0ubuntu3.1) 7.7
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://
Find the GDB manual and other documentation resources online at:
<http://
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/sbin/
done.
(gdb) run
Starting program: /usr/sbin/apache2 -k start -X -e Debug
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_
[Fri Sep 05 19:20:45.569382 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module access_
[Fri Sep 05 19:20:45.572221 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module alias_module from /usr/lib/
[Fri Sep 05 19:20:45.574731 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module auth_basic_module from /usr/lib/
[Fri Sep 05 19:20:45.577289 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module authn_core_module from /usr/lib/
[Fri Sep 05 19:20:45.579829 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module authn_file_module from /usr/lib/
[Fri Sep 05 19:20:45.582459 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module authz_core_module from /usr/lib/
[Fri Sep 05 19:20:45.585176 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module authz_groupfile
[Fri Sep 05 19:20:45.587851 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module authz_host_module from /usr/lib/
[Fri Sep 05 19:20:45.590460 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module authz_user_module from /usr/lib/
[Fri Sep 05 19:20:45.593611 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module autoindex_module from /usr/lib/
[Fri Sep 05 19:20:45.596597 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module cgi_module from /usr/lib/
[Fri Sep 05 19:20:45.599459 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module dbd_module from /usr/lib/
[Fri Sep 05 19:20:45.602970 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module deflate_module from /usr/lib/
[Fri Sep 05 19:20:45.607589 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module dir_module from /usr/lib/
[Fri Sep 05 19:20:45.611506 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module env_module from /usr/lib/
[Fri Sep 05 19:20:45.615353 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module filter_module from /usr/lib/
[Fri Sep 05 19:20:45.618714 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module headers_module from /usr/lib/
[Fri Sep 05 19:20:45.621296 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module ident_module from /usr/lib/
[Fri Sep 05 19:20:45.624291 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module lbmethod_
[Fri Sep 05 19:20:45.627441 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module mime_module from /usr/lib/
[Fri Sep 05 19:20:45.630890 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module mpm_prefork_module from /usr/lib/
[Fri Sep 05 19:20:45.634628 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module negotiation_module from /usr/lib/
[Fri Sep 05 19:20:45.771556 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module php5_module from /usr/lib/
[Fri Sep 05 19:20:45.776446 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module proxy_module from /usr/lib/
[Fri Sep 05 19:20:45.779712 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module proxy_balancer_
[Fri Sep 05 19:20:45.783012 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module proxy_http_module from /usr/lib/
[Fri Sep 05 19:20:45.785965 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module reqtimeout_module from /usr/lib/
[Fri Sep 05 19:20:45.789713 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module rewrite_module from /usr/lib/
[Fri Sep 05 19:20:45.792660 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module setenvif_module from /usr/lib/
[Fri Sep 05 19:20:45.795575 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module slotmem_shm_module from /usr/lib/
[Fri Sep 05 19:20:45.798641 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module socache_
[Fri Sep 05 19:20:45.808987 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module ssl_module from /usr/lib/
[Fri Sep 05 19:20:45.812723 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module status_module from /usr/lib/
[Fri Sep 05 19:20:45.816188 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module substitute_module from /usr/lib/
[Fri Sep 05 19:20:45.820615 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module websocket_module from /usr/lib/
[Fri Sep 05 19:20:45.825187 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module websocket_
[Fri Sep 05 19:20:45.829577 2014] [so:debug] [pid 46103] mod_so.c(266): AH01575: loaded module websocket_
AH00548: NameVirtualHost has no effect and will be removed in the next release /etc/apache2/
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message
[New Thread 0x7fffe6d32700 (LWP 46111)]
[Thread 0x7fffe6d32700 (LWP 46111) exited]
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff05faaf3 in ?? () from /usr/lib/
(gdb) bt full
#0 0x00007ffff05faaf3 in ?? () from /usr/lib/
No symbol table info available.
#1 0x00007ffff29647a6 in int_free_ex_data (class_
mx = 1
i = 0
item = 0x555555835a90
ptr = <optimized out>
storage = 0x555555af6fa0
#2 0x00007ffff2a05061 in x509_cb (operation=
exarg=
ret = 0x555555af7460
#3 0x00007ffff2a08fea in asn1_item_
at tasn_fre.c:173
tt = <optimized out>
seqtt = <optimized out>
ef = <optimized out>
cf = <optimized out>
aux = <optimized out>
asn1_cb = 0x7ffff2a04fa0 <x509_cb>
i = <optimized out>
#4 0x00007ffff2a091c5 in ASN1_item_free (val=val@
No locals.
#5 0x00007ffff2a0514c in X509_free (a=a@entry=
No locals.
#6 0x00007ffff05ee0b8 in ssl_pphrase_Handle (s=s@entry=
using_cache = 0
mc = 0x7ffff7fc5950
sc = 0x7fffeb618bc8
pServ = 0x7fffeb64c5b8
cpVHostID = 0x7ffff7e5a160 "nimtest2.
szPath = "/etc/extility/
pPrivateKey = <optimized out>
asn1 = <optimized out>
ucp = 0x555555835785 ""
length = <optimized out>
pX509Cert = 0x555555af7460
bReadable = <optimized out>
aPassPhrase = 0x7ffff7e5a110
nPassPhrase = 0
cpp = <optimized out>
i = 0
j = 0
algoCert = 1
algoKey = 0
at = <optimized out>
an = 0x7ffff05fd3c2 "RSA"
pkey_mtime = 0
rv = <optimized out>
#7 0x00007ffff05e3658 in ssl_init_Module (p=0x7ffff7ff0028, plog=<optimized out>, ptemp=0x7ffff7f
at ssl_engine_
mc = <optimized out>
sc = <optimized out>
s = 0x0
#8 0x00005555555aa2a9 in ap_run_post_config (pconf=
---Type <return> to continue, or q <return> to quit---
pHook = 0x7ffff7eb2bb8
n = 14
rv = 0
#9 0x000055555558ae07 in main (argc=6, argv=0x7fffffff
c = 101 'e'
showcompile = 0
confname = 0x5555555ca607 "apache2.conf"
error = <optimized out>
process = 0x7ffff7ff2118
pconf = 0x7ffff7ff0028
plog = 0x7ffff7fbd028
ptemp = 0x7ffff7fbf028
pcommands = 0x7ffff7fc7028
opt = 0x7ffff7fc7118
rv = <optimized out>
mod = 0x5555557ec160 <ap_prelinked_
opt_arg = 0x7fffffffe831 "Debug"
I think I've got about the minimal case for replication. Attached is a tiny perl script which generates a number of SSL sites of the form:
<VirtualHost 127.0.0.1:$port>
ServerName 127.0.0.1:$port
SSLEngine on ateFile /etc/ssl/ certs/ssl- cert-snakeoil. pem ateKeyFile /etc/ssl/ private/ ssl-cert- snakeoil. key
SSLCertific
SSLCertific
DBDriver pgsql
</VirtualHost>
When the numebr of sites exceeds 61 (on my machine), I get an illegal instruction error.
The "DBDriver pgsql" itself is important, but I don't think this is a DBD problem. About anything that loads a module causes a problem.