![]() | |||||||||||
Messages in this thread |
On Thu, 2006-10-05 at 23:55 +0000, David Wagner wrote: > Michael Buesch wrote: > >Is is really a good idea to allow processes to remap something > >to address 0? > >I say no, because this can potentially be used to turn rather harmless > >kernel bugs into a security vulnerability. > Let me see if I understand. If the kernel does this somewhere: > > struct s *foo; > foo->x->y = 0; > > and if there is some way that userland code can cause this to be > executed with 'foo' set to a NULL pointer, then user-land code can > do this: > > mmap(0, 4096, PROT_READ|PROT_EXEC|PROT_WRITE, > MAP_FIXED|MAP_PRIVATE|MAP_ANONYMOUS, 0, 0); > struct s *bar = 0; the question isn't if it's a good idea to allow mmap(0) but to allow mmap PROT_WRITE | PROT_EXEC ! - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ | ||||||||||
| Last update: 2006-10-06 09:27 [from the cache] ©2003-2008 | |||||||||||