Re: Ho ho ho - Linux v2.6.10

[Alan Cox <alan@lxorguk.ukuu.org.uk>]

On Sad, 2004-12-25 at 12:19, Alan Cox wrote:
> - It seems the security hole inducing exec_id change was not reverted
> and I've not yet found any other changes that fix the same problem
> (setuid_app >/proc/self/mem) in 2.6.10. It was actually quite nasty as a
> hole because you can seek the fd to the right target address before
> execing. With the other /proc changes did I miss something on this one

Thankfully I missed something as the test app shows

static char foo[5]="GOOD";

int main(int argc, char *argv[])
{
  lseek(1, (unsigned long) foo, 0);
  if(write(1, "BAD!", 4) != 4)
    perror("write");
  write(2, foo, 4);
}


Running ./a.out >/proc/self/mem produces the desired write error still
in 2.6.10