[lkml]   [1999]   [Jan]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: 2.2.0 SECURITY

There are several stupid bugs in binfmt_elf's core dumping code.

Just from a quick scan:

1) No down() is done on the core file's inode semaphore for the
write operations. I suppose a nice racey exploit could be used
which involved opening a core file while the kernel was still
writing to it and doing "stuff".

2) If write or seek fail in various places here, it just returns zero
and leaves us in KERNEL_DS, this is really bad. These kinds of
errors are why I hate macros which "return", it's asking for a bug.

I'm not saying either is the cause of the crash here, but ELF core
dumping needs some serious code review....

David S. Miller

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:50    [W:0.040 / U:1.564 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site