Messages in this thread | | | Subject | Re: [CHECKER] copy_*_user length bugs? | From | Andreas Schwab <> | Date | 18 Apr 2001 17:21:00 +0200 |
| |
Chris Evans <chris@scary.beasts.org> writes:
|> To justify this, consider if len were set to minus 2 billion. This will |> pass the sanity check, and pass the value straight on to copy_to_user. The |> copy_to_user parameter is unsigned, so this value because approximately |> +2Gb. |> |> Now, providing the malicious user passes a low user space pointer (e.g. |> just above 0), the kernel's virtual address space wrap check will not |> trigger because ~0 + ~2Gb does not exceed 4G. And the result is the user |> being able to read kernel memory.
On m68k this is not a problem, since kernel and user address space are strictly distinct, even in the kernel. The luser will get an EFAULT eventually.
Andreas.
-- Andreas Schwab "And now for something SuSE Labs completely different." Andreas.Schwab@suse.de SuSE GmbH, Schanzäckerstr. 10, D-90443 Nürnberg Key fingerprint = 58CA 54C7 6D53 942B 1756 01D3 44D5 214B 8276 4ED5 - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |