|
|
Subscribe / Log in / New account

Race-free process creation in the GNU C Library

Race-free process creation in the GNU C Library

Posted Sep 2, 2023 11:09 UTC (Sat) by bluca (subscriber, #118303)
In reply to: Race-free process creation in the GNU C Library by darmengod
Parent article: Race-free process creation in the GNU C Library

That doesn't allow the receiver to verify anything, it's not just about knowing the pid, it's about knowing that it is still owned by the original process and not a recycled one. This is a real-world problem that has caused several CVEs, for example in polkit, and that so far has only been partially worked around by using unreliable heuristic like the start time in the target's proc/pid/status and other metadata, that can make it harder to exploit but not impossible


to post comments


Copyright © 2025, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds