We have a software which intercepts file IO operations and noticed a recent bug caused by a process who’s /proc/$pid/exe pointed to /usr/bin/bash;61f1808a (deleted) (via readlink(2)). I’m curious what could be causing this and if the image /usr/bin/bash;61f1808a actually existed at some point or if there’s a way to intentionally spawn processes with invalid images.
Relevant system is CentOS 7.9 with kernel 3.10, presumably bash 4.2.46 but of course would be nice to know if it happens on newer stuff too
