A kernel security hole

A kernel security hole

Posted Jan 18, 2008 21:40 UTC (Fri) by giraffedata (subscriber, #1954)
In reply to: A kernel security hole by nix
Parent article: A kernel security hole

Then unlink() that copy, and the link count will fall to zero, leading to /etc/passwd being unlinked. It's not open all the time, so this now leads to /etc/passwd's blocks being freed.

It doesn't unlink /etc/passwd (and that's the problem). What it does is delete the password file. /etc/passwd now points to a ghost inode.

So what you want to do to exploit this is create files until one happens to get that inode slot (i.e. inode number). Now you own the password file.

---

(Log in to post comments)

Argh. Yeah, that's worse: now you can put multi-block content in there 
fairly fast and without filling the disk up, which means you could e.g. 
copy the pre-existing /etc/passwd and remove root's password, or add a new 
uid 0 account... plus you own the file, too, I guess that's a security 
hole :)