LWN.net Logo

Stable kernel updates (security fix)

Stable kernel updates (security fix)

Posted May 7, 2008 19:56 UTC (Wed) by viro (subscriber, #7872)
In reply to: Stable kernel updates (security fix) by iabervon
Parent article: Stable kernel updates (security fix)

It does matter; file_lock is not supposed to outlive the struct file
it refers to.  If it does, and if struct file in question is later
freed, you can get the page that used to contain it mapped in userland.
Then it's not hard to fill it with the right pattern, so that e.g.
reading from /proc/locks would read data from arbitrary kernel address
and print it for you (look at the place where it prints ->i_ino,
for starters).  That's already a roothole; looking for more direct
ways to escalate is left as an exercise for readers (and yes, it is
possible).


(Log in to post comments)

Stable kernel updates (security fix)

Posted May 7, 2008 21:49 UTC (Wed) by iabervon (subscriber, #722) [Link]

Ah, yes, if the kernel itself is assuming that a locked file must be open in how it handles
memory, that's a pretty easy escalation.

Copyright © 2008, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds