[lkml]   [2006]   [Oct]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Really good idea to allow mmap(0, FIXED)?
    Arjan van de Ven  wrote:
    >> Let me see if I understand. If the kernel does this somewhere:
    >> struct s *foo;
    >> foo->x->y = 0;
    >> and if there is some way that userland code can cause this to be
    >> executed with 'foo' set to a NULL pointer, then user-land code can
    >> do this:
    >> mmap(0, 4096, PROT_READ|PROT_EXEC|PROT_WRITE,
    >> struct s *bar = 0;
    >the question isn't if it's a good idea to allow mmap(0) but to allow
    >mmap PROT_WRITE | PROT_EXEC !

    Oops. Please ignore the PROT_EXEC. That is completely irrelevant.
    I'm sorry I included it; the inclusion of PROT_EXEC was a mistake.
    Delete PROT_EXEC, then re-read my email -- everything else in there is
    still valid.

    The security exploit I explained didn't involve executing anything
    from the mmap'ed page; the kernel reads an address from this page,
    and then dereferences it. Even without PROT_EXEC, it sounds like a
    user-triggerable NULL pointer dereference in the kernel can create a
    local root exploit (at least in some cases).
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2006-10-06 21:45    [W:0.032 / U:4.668 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site