Menu ▾ ▴

#9 Segfault when running elevated unhide -m -d sys procall brute reverse

v1.0_(example)
pending
nobody
None
5
2020-10-26
2020-10-21
No

Hi,

Today I tried out unhide because rkhunter did not work at my side due config issues.

However, when doing deeper tests, as mentioned in man unhide, I get segfaults when running it via sudo and su. I didn't try it via the recovery boot as root tho.

The output of LANG=C inxi:

CPU: 8-Core AMD FX-8320 (-MCP-) speed/min/max: 1495/1400/3500 MHz Kernel: 5.4.72-1-MANJARO x86_64 Up: 4h 28m
Mem: 4034.1/7919.1 MiB (50.9%) Storage: 1.03 TiB (77.2% used) Procs: 305 Shell: inxi: 3.1.05

The outputs of my attempts with sudo and su, and their coredumps taken from journalctl could be found in the attachments.

Unfortunately I forgot to use LANG=C before running the commands. The non-English language is Dutch.

The standard test unhide sys proc does not produce segmentation faults.

4 Attachments

Discussion

  • Patrick G.

    Patrick G. - 2020-10-26
    • status: open --> pending
    • private: Yes --> No
     
  • Patrick G.

    Patrick G. - 2020-10-26

    Hi,
    Thanks for the report.

    I'm using unhide mainly via CLI in an elevated shell (su). I recently made an extensive test of all unhide subcommands without encountering any problems.
    I tried the same command you used "unhide -m -d sys procall brute reverse" several times but I was unable to reproduce the crash.
    Note that Rkhunter also runs as root and spawns a rooted unhide.

    Even thougth your two crashes don't happened in the same test, the backtraces are exactly the same.
    Strange but without debug symbol, it's difficult to guess what happened.
    It's unclear to me if Manjaro provides degug packages. If it is the case, could you run the debug version and joined the gdb output of the backtrace ?

    Your inxi output doesn't mention a shell, which one are you using ?

    Regards.

     

Log in to post a comment.