[lkml]   [1999]   [Jan]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: 2.2.0 SECURITY

    There are several stupid bugs in binfmt_elf's core dumping code.

    Just from a quick scan:

    1) No down() is done on the core file's inode semaphore for the
    write operations. I suppose a nice racey exploit could be used
    which involved opening a core file while the kernel was still
    writing to it and doing "stuff".

    2) If write or seek fail in various places here, it just returns zero
    and leaves us in KERNEL_DS, this is really bad. These kinds of
    errors are why I hate macros which "return", it's asking for a bug.

    I'm not saying either is the cause of the crash here, but ELF core
    dumping needs some serious code review....

    David S. Miller

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:50    [W:0.019 / U:48.700 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site