From: Blaisorblade <blaisorblade@yahoo.it>
To: Dominik Hirt <dhi@server-ranch.ch>,
user-mode-linux-devel@lists.sourceforge.net
Subject: [uml-devel] Re: Security Issues
Date: Thu, 10 Feb 2005 12:20:25 +0100 [thread overview]
Message-ID: <200502101220.25484.blaisorblade@yahoo.it> (raw)
In-Reply-To: <db90534f90b487c87a9d0fa2311a82b2@server-ranch.ch>
On Wednesday 09 February 2005 10:36, Dominik Hirt wrote:
> Hi
>
> Many thanks for your answer.
> So the problem exists only when module support is activated in the
> kernel of the uml, right?
Well, what I said is that on any UML the guest root can do everything on the
host as normal user (but everything is not much if you chroot your UML). And
this is not the "security hole" I spoke about, since this is not fixable
(it's not a bug either, actually).
That's easy to exploit with module support, and possible even without
when /dev/kmem is writable; this applies also to normal kernels, there is
literature about normal kernels. It is probably hard, however, I guess.
The bug which is fixed in the patches allows *normal user* to reach the host,
even without module support.
> Do you need any mirror in Switzerland?
> When the expected traffic is not too high I could offer you one for
> free.
Well, thanks a lot, however for now I don't think additional mirrors are
needed... at least until somebody starts complaining for the load (but
patches are usually little, so there should not be any problem, I guess).
--
Paolo Giarrusso, aka Blaisorblade
Linux registered user n. 292729
http://www.user-mode-linux.org/~blaisorblade
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel
parent reply other threads:[~2005-02-10 11:21 UTC|newest]
Thread overview: expand[flat|nested] mbox.gz Atom feed
[parent not found: <db90534f90b487c87a9d0fa2311a82b2@server-ranch.ch>]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200502101220.25484.blaisorblade@yahoo.it \
--to=blaisorblade@yahoo.it \
--cc=dhi@server-ranch.ch \
--cc=user-mode-linux-devel@lists.sourceforge.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox