![]() | |||||||||||||
Messages in this thread |
Hi again, Julien corrected me on the points below : > - a NULL dereference in serial.c found by Julien Tinnes which could lead > to an oops. Could possibly be exploited by mapping the first page of a program and watching the kernel eat the data instead of oopsing. > - an off-by-one in mtrr.c found by Brad Spengler and reported by J.Tinnes > which could lead to a panic. This is inexact. I've checked several other archs : - sparc, sparc64, x86_64, alpha, mips all assume that (n) is unsigned and will overflow, possibly executing user-controlled code. - ppc and ppc64 explicitly check that (n) is < TASK_SIZE and should be safe. - x86 will BUG_ON((long)n < 0) (=> oops/panic). - others not checked. > - a few unchecked strcpy() in ipvs fixed in PaX which I'm not absolutely > sure are exploitable, but are definitely dirty and risky. They are exploitable by anyone with enough privilege to manipulate IPVS. Think of a user front-end for example. Thanks, Willy - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ | ||||||||||||
| Last update: 2005-05-30 07:16 [from the cache] ©2003-2008 | |||||||||||||