Messages in this thread | | | Date | Fri, 21 Jul 2000 11:05:25 -0700 (PDT) | From | Andre Hedrick <> | Subject | Re: disk-destroyer.c |
| |
On Fri, 21 Jul 2000, Myrddin Emrys wrote:
> On Fri, 21 Jul 2000 00:44:10 -0700 (PDT) you sent this message: > > >On Fri, 21 Jul 2000, Oliver Xymoron wrote: > > > >> No, of course not, but we also don't want to make large changes to the > >> kernel to paper over a hole that we can't cement closed. Especially now. > > > >Here is you damn steel-plate-of-armor! > <snip> > >Damn-it here is you CEMENT!!!!!!!!! > > It's cement for one hole that you know exists... what about a dozen others > you don't? There's probably two dozen documented other places where you can > fry some subsystem or another. Protecting the system against a malicious > root is an exercise in futility. No matter what you do, how you guard the > system, root can bypass it. This is by design, as you well know. That is how > Linux (and most *nix) works. > > As oxy said, not now. Propose the patch after the next stable release.
Brain dead are we, now that I know the argument better.....
> > > Can disk-destroyer be pushed into a shellstack because it is so small? > > > > > Yes, it's true. It can be made even smaller, much smaller, than the > > compiled size of the code. Although the limits on how much shellcode > > you can send in a buffer overrun do vary, I expect this will almost > > certainly fit in just about every buffer overrun I've seen.
Here is your SECURITY HOLE!
JOE-SIX-PACK-HACKER can fry your butt.
Cheer,
Andre Hedrick The Linux ATA/IDE guy
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |