Messages in this thread | | | From | (David Wagner) | Subject | Re: [PATCH] getsockopt() early argument sanity checking | Date | Mon, 21 Aug 2006 03:00:22 +0000 (UTC) |
| |
Solar Designer wrote: >The patch makes getsockopt(2) sanity-check the value pointed to by >the optlen argument early on. This is a security hardening measure >intended to prevent exploitation of certain potential vulnerabilities in >socket type specific getsockopt() code on UP systems.
This looks broken to me. It has a TOCTTOU (time-of-check-to-time-of-use) vulnerability (i.e., race condition): you read the length value twice, and assume that you will get the same value both times. That assumption is not valid.
It looks like it will be easy to bypass this check. For instance, think about what happens if an adversary stores the length field in a mmaped region, for instance. It should be easy for the value of that length field to change between when it was first read and when it was subsequently read. I don't see how this provides any "hardening" if the attacker knows how to read kernel source code. Am I missing something? - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |