lkml.org 
[lkml]   [2011]   [Mar]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [PATCH] Make /proc/slabinfo 0400
    From
    Hi Dan,

    [ Thanks to you and Matt for taking the time to explain this to me. ]

    On Fri, Mar 4, 2011 at 11:08 PM, Dan Rosenberg <drosenberg@vsecurity.com> wrote:
    > I could be mistaken on this, so feel free to correct me.  What if you
    > just fill more than one slab with the object you'd like to overflow
    > into, then pick an object that's guaranteed to reside in a slab filled
    > with your objects.  Upon freeing that object and allocating a new
    > to-be-overflowed object (that's sized so it's handled by the same slab
    > cache), this new object will be guaranteed to be sitting immediately
    > before one of your objects (or before the end of the slab if you're
    > unlucky).  You can still win because it doesn't matter which specific
    > object you overflow, only that you overflow one of them.

    Right. So you fill a slab with objects A that you want to overflow
    (struct shmid_kernel in the example exploit) then free one of them,
    allocate object B, smash it (and the next object), and find the
    smashed object A.

    But doesn't that make the whole /slab/procinfo discussion moot? You
    can always use brute force to allocate N objects (where N is larger
    than max objects in a slab) and then just free nth object that's most
    likely to land on the slab you have full control over (as explained by
    Matt).

    Pekka
    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2011-03-06 11:41    [W:4.582 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site