lkml.org 
[lkml]   [2004]   [Dec]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: Ho ho ho - Linux v2.6.10
From
Date
On Sad, 2004-12-25 at 12:19, Alan Cox wrote:
> - It seems the security hole inducing exec_id change was not reverted
> and I've not yet found any other changes that fix the same problem
> (setuid_app >/proc/self/mem) in 2.6.10. It was actually quite nasty as a
> hole because you can seek the fd to the right target address before
> execing. With the other /proc changes did I miss something on this one

Thankfully I missed something as the test app shows

static char foo[5]="GOOD";

int main(int argc, char *argv[])
{
lseek(1, (unsigned long) foo, 0);
if(write(1, "BAD!", 4) != 4)
perror("write");
write(2, foo, 4);
}


Running ./a.out >/proc/self/mem produces the desired write error still
in 2.6.10

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:09    [W:0.198 / U:0.356 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site