[lkml]   [2000]   [Nov]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    On 14 Nov 2000 11:42:42 -0800, 
    "H. Peter Anvin" <> wrote:
    >Seriously, though, I don't see any reason modprobe shouldn't accept
    >funky filenames. There is a standard way to do that, which is to have
    >an argument consisting of the string "--"; this indicates that any
    >further arguments should be considered filenames and not options.

    The original exploit had nothing to do with filenames masquerading as
    options, it was: ping6 -I ';chmod o+w .'. Then somebody pointed out
    that -I '-C/my/config/file' could be abused as well. '--' fixes the
    second exploit but not the first.

    The problem is the combination of kernel code passing user space
    parameters through unchanged (promoting user input to root) plus the
    modprobe meta expansion algorithm. By treating the last parameter from
    the kernel as a tainted module name (not an option) and suppressing
    meta expansion on tainted parameters, modprobe removes enough of the
    problem to be safe.

    My changes to modprobe do nothing about this: "ping6 -I binfmt_misc".
    That construct lets a user load any module. However that is a pure
    kernel problem which needs to be fixed by the developers who call

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 12:45    [W:0.018 / U:48.844 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site