Messages in this thread | | | Date | Wed, 21 Jul 2010 16:30:59 -0700 | From | Andrew Morton <> | Subject | Re: Question about binfmt_elf.c |
| |
On Fri, 16 Jul 2010 15:12:39 -0500 Rob Landley <rob@landley.net> wrote:
> Could somebody please update this comment to explain why fiddling with > strangely protected bss is _not_ an easy way to leak arbitrary amounts of > uninitalized kernel memory (with whatever previous contents they have) to > userspace? > > nbyte = ELF_PAGEOFFSET(elf_bss); > if (nbyte) { > nbyte = ELF_MIN_ALIGN - nbyte; > if (nbyte > elf_brk - elf_bss) > nbyte = elf_brk - elf_bss; > if (clear_user((void __user *)elf_bss + > load_bias, nbyte)) { > /* > * This bss-zeroing can fail if the ELF > * file specifies odd protections. So > * we don't check the return value > */ > } > } > > Just curious. Reading through the code and trying to understand it... >
In January 2005 davem added a check. In Feb 2005 Pavel said "hey, my Kylix application broke". So we took the check out again.
http://www.mail-archive.com/linux-kernel@vger.kernel.org/msg60120.html http://www.mail-archive.com/bk-commits-head@vger.kernel.org/msg01390.html
I don't kow how one would craft such an elf file. I don't _think_ it could leak unintialised memory, as we probably haven't faulted the page in yet. Perhaps a partial page could be exposed though.
Roland, Jakub: help!
| |