lkml.org 
[lkml]   [2008]   [Apr]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: file offset corruption on 32-bit machines?
> On Thu, 10 Apr 2008, Jan Kara wrote:
>
> > > The f_pos races are in fact exploitable, we've already been there. See
> > > for example http://www.isec.pl/vulnerabilities/isec-0016-procleaks.txt
> > Well, this race is more subtle - the window is just one instruction
> > wide (stores to f_pos from CPU2 must come between the store of lower and
> > upper 32-bits of f_pos on CPU1). And the only result is that f_pos has
> > 32-bits from one file pointer and 32-bits from the other one. So I can
> > hardly imagine this would be exploitable...
>
> Supposing you are not holding any spinlock and are running with
> preemptible kernel (pretty common scenario nowadays), there is nothing
> that would prevent kernel from rescheduling between the two instructions,
> enlarging the race window to be more comfortable for attacker, right?
Yes, this is theoretically possible.

> I think this is worth fixing.
Hmm, maybe it is, although I still don't see how to exploit it :).

Honza
--
Jan Kara <jack@suse.cz>
SuSE CR Labs


\
 
 \ /
  Last update: 2008-04-10 17:23    [from the cache]
©2003-2011 Jasper Spaans