Messages in this thread | | | Date | Mon, 4 Feb 2008 22:02:03 +0100 | From | "Oliver Pinter" <> | Subject | Re: {2.6.22.y} CVE-2007-6434 |
| |
sorry, drop this ..
/usr/data/source/oliver/build/linux-2.6.22.y-rcX-stable/mm/mmap.c: In function 'do_brk': /usr/data/source/oliver/build/linux-2.6.22.y-rcX-stable/mm/mmap.c:1889: error: too many arguments to function 'security_file_mmap' make[6]: *** [mm/mmap.o] Error 1 make[5]: *** [mm] Error 2
On 2/4/08, Oliver Pinter <oliver.pntr@gmail.com> wrote: > mainline: ecaf18c15aac8bb9bed7b7aa0e382fe252e275d5 > > --->8--- > commit ecaf18c15aac8bb9bed7b7aa0e382fe252e275d5 > Author: Eric Paris <eparis@redhat.com> > Date: Tue Dec 4 23:45:31 2007 -0800 > > VM/Security: add security hook to do_brk > > Given a specifically crafted binary do_brk() can be used to get low > pages > available in userspace virtual memory and can thus be used to circumvent > the mmap_min_addr low memory protection. Add security checks in > do_brk(). > > Signed-off-by: Eric Paris <eparis@redhat.com> > Acked-by: Alan Cox <alan@redhat.com> > Cc: Stephen Smalley <sds@tycho.nsa.gov> > Cc: James Morris <jmorris@namei.org> > Cc: Chris Wright <chrisw@sous-sol.org> > Signed-off-by: Andrew Morton <akpm@linux-foundation.org> > Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> > > diff --git a/mm/mmap.c b/mm/mmap.c > index facc1a7..acfc13f 100644 > --- a/mm/mmap.c > +++ b/mm/mmap.c > @@ -1934,6 +1934,10 @@ unsigned long do_brk(unsigned long addr, unsigned > long le > if (is_hugepage_only_range(mm, addr, len)) > return -EINVAL; > > + error = security_file_mmap(0, 0, 0, 0, addr, 1); > + if (error) > + return error; > + > flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags; > > error = arch_mmap_check(addr, len, flags); > ---8<--- > -- > Thanks, > Oliver >
-- Thanks, Oliver
| |