Messages in this thread | | | Date | Sun, 29 Jan 2012 11:36:21 +0800 | From | Cong Wang <> | Subject | Re: /proc/[pid]/mem write implications |
| |
On 01/29/2012 09:32 AM, Bryan Jacobs wrote: > Dear LKML, > > I have a few questions on the recent change to allow writing > to /proc/[pid]/mem. If I understand correctly, the recent > privilege-escalation vulnerability was fundamentally caused by > incorrectly verifying that the memory being written to by a process was > its own. The goal was to only allow processes to write to their own > memory space - this was deemed harmless.
Well, the more fundamental vulnerability is the check was done in write(2) instead of open(2), which leaves a window for exploits.
> > But I think that allowing arbitrary processes to write to **their own** > memory via a file descriptor might in itself be problematic. Please, > help me understand how this is safe.
You will have a sysctl to control if it is writable.
Thanks.
| |