| |||||||||||||
Linux Local Privilege Escalation via SUID /proc/pid/mem Write (zx2c4)Linux Local Privilege Escalation via SUID /proc/pid/mem Write (zx2c4)Posted Jan 24, 2012 11:45 UTC (Tue) by PaXTeam (subscriber, #24616)In reply to: Linux Local Privilege Escalation via SUID /proc/pid/mem Write (zx2c4) by tialaramex Parent article: Linux Local Privilege Escalation via SUID /proc/pid/mem Write (zx2c4)
when we said 'fix bug' above we obviously meant 'fix bug for real and without introducing another one'. pay attention to the context next time, please ;).
(Log in to post comments)
Linux Local Privilege Escalation via SUID /proc/pid/mem Write (zx2c4) Posted Jan 24, 2012 14:18 UTC (Tue) by tialaramex (subscriber, #21167) [Link]
I look forward to seeing these new type of patches which always fix the entire problem however subtle and never introduce (or indeed re-introduce) other bugs. Until then, I hope you will agree that your hypothetical is bit too... hypothetical ?
Linux Local Privilege Escalation via SUID /proc/pid/mem Write (zx2c4) Posted Jan 24, 2012 15:11 UTC (Tue) by PaXTeam (subscriber, #24616) [Link]
you know, i'm beginning to really appreciate khim's post the other day where he mentioned the twitterbrain generation. are you seriously this challenged or just trolling around? do you understand that it wasn't *my* hypothetical situation that assumed perfect fixes but raven667's (as only that way can he/she arrive at his/her numbers). do you understand that i *intentionally* annotated my hypothetical situation with bracketed expressions exactly because i wanted to highlight that other real life situations may very well end up producing opposite numbers? IOW, your argument is not with me but i guess your brittle ego is still suffering from past losses and you thought it'd be a good time to take revenge. maybe next time? :)
Linux Local Privilege Escalation via SUID /proc/pid/mem Write (zx2c4) Posted Jan 25, 2012 11:48 UTC (Wed) by ekj (guest, #1524) [Link]
Yeah okay. If you apply a patch that "fixes the bug for real, and does not introduce any new bugs", then you cannot be worse off than you where initially, agreed.
How do you know if the patch you have in front of you is one of those ideal patches ?
Linux Local Privilege Escalation via SUID /proc/pid/mem Write (zx2c4) Posted Jan 25, 2012 13:24 UTC (Wed) by PaXTeam (subscriber, #24616) [Link]
> How do you know if the patch you have in front of you is one of those ideal patches ?
did you mean a general you or me personally? as for myself, if (i believe that) i know enough to determine this i will do so (e.g., i voiced my concerns regarding this particular case already), otherwise i do as anyone else would have to do: trust someone else. for kernel code i'm familiar with or for simple fixes (say, bounds checking a parameter) it's usually the former case, otherwise it's the latter. from my experience most attempts at fixing a problem turn out to be correct, very few introduce further problems or fix them inadequately (e.g., you can compare the number of CVEs fixing previous CVEs to the total number of CVEs to get an idea).
|
|||||||||||||