[lkml]   [2008]   [Aug]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: buffer overflow in /proc/sys/sunrpc/transports
    Vegard Nossum  wrote:
    >I don't know if this could be used in some malicious way. Maybe if a setuid
    >root program tried to open a user-supplied file (which could be this one in
    >/proc), it could crash the program quite easily. But since there is no way
    >to change the contents of the file... I don't know.

    You don't necessarily need control over the values that are written past
    the end of the buffer to exploit a buffer overrun bug. If those values
    are semi-random but predictable, it may still be possible to exploit the
    vulnerability by arranging to stash malicious code at the address that the
    return address will be overwritten with. Even if those values are random
    and not predictable, it may still be able to fill a large fraction of the
    address space with malicious code and thus have a significant probability
    of successful exploitation. See, e.g., NOP sleds, heap spraying, heap
    feng shui. I would not want to rely on this bug being difficult to exploit.

    Bottom line: I suspect it would be prudent to assume this bug may be
    fully exploitable.

     \ /
      Last update: 2008-08-30 22:23    [W:0.020 / U:223.804 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site