[lkml]   [2012]   [Jan]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: /proc/[pid]/mem write implications
On 01/29/2012 09:32 AM, Bryan Jacobs wrote:
> Dear LKML,
> I have a few questions on the recent change to allow writing
> to /proc/[pid]/mem. If I understand correctly, the recent
> privilege-escalation vulnerability was fundamentally caused by
> incorrectly verifying that the memory being written to by a process was
> its own. The goal was to only allow processes to write to their own
> memory space - this was deemed harmless.

Well, the more fundamental vulnerability is the check was done in
write(2) instead of open(2), which leaves a window for exploits.

> But I think that allowing arbitrary processes to write to **their own**
> memory via a file descriptor might in itself be problematic. Please,
> help me understand how this is safe.

You will have a sysctl to control if it is writable.


 \ /
  Last update: 2012-01-29 04:39    [W:0.067 / U:2.988 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site