lkml.org 
[lkml]   [2006]   [Feb]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectMapping to 0x0
Hello,



from somewhere in my INBOX, this claim was made:

>> (also note that userland processes can map 0x00000000 and the kernel
>> would jump to it ...)

In C code:

#include <sys/mman.h>
#include <sys/ioctl.h>
#include <fcntl.h>
#include <stdio.h>
int main(void) {
int fd = open("badcode.bin", O_RDONLY);
mmap(NULL, 4096, PROT_READ | PROT_EXEC, MAP_FIXED, fd, 0);
}
The mmap() usually succeeds and maps something at address 0x00000000. Now
what if the kernel would try to execute this (of course badly programmed)
code in the context of this very process?
int (*callback)(int xyz) = NULL;
callback();

Would not be the badcode be executed with kernel privileges?



Jan Engelhardt
--

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2006-02-22 15:12    [W:0.310 / U:0.192 seconds]
©2003-2014 Jasper Spaans. Advertise on this site