[lkml]   [2006]   [Aug]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] getsockopt() early argument sanity checking
Solar Designer  wrote:
>The patch makes getsockopt(2) sanity-check the value pointed to by
>the optlen argument early on. This is a security hardening measure
>intended to prevent exploitation of certain potential vulnerabilities in
>socket type specific getsockopt() code on UP systems.

This looks broken to me. It has a TOCTTOU (time-of-check-to-time-of-use)
vulnerability (i.e., race condition): you read the length value twice,
and assume that you will get the same value both times. That assumption
is not valid.

It looks like it will be easy to bypass this check. For instance,
think about what happens if an adversary stores the length field in a
mmaped region, for instance. It should be easy for the value of that
length field to change between when it was first read and when it was
subsequently read. I don't see how this provides any "hardening" if
the attacker knows how to read kernel source code. Am I missing
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2006-08-21 05:03    [W:0.111 / U:9.856 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site