* Re: Linux kernel ELF core dump privilege elevation [not found] <Pine.LNX.4.44.0505101615410.1618-100000@isec.pl> @ 2005-05-11 18:12 ` Greg KH 2005-05-11 18:30 ` Greg KH 2005-05-11 21:51 ` Paul Starzetz 0 siblings, 2 replies; 3+ messages in thread From: Greg KH @ 2005-05-11 18:12 UTC (permalink / raw) To: security, linux-kernel; +Cc: full-disclosure, bugtraq, vulnwatch On Wed, May 11, 2005 at 01:08:56PM +0200, Paul Starzetz wrote: > Hi, > > since it became clear from the discussion in January about the uselib() > vulnerability, that the Linux community prefers full, non-embargoed > disclosure of kernel bugs, I release full details right now. However to > follows at least some of the responsable disclosure rules, no exploit code will be > released. Instead, only a proof-of-concept code is released to demonstrate > the vulnerability. <snip> And here's a patch for 2.6 that is completly untested. I'll work on testing it today and if it works, we will release a new 2.6.11.y release with this fix in it. thanks, greg k-h Subject: possibly fix Linux kernel ELF core dump privilege elevation As noted by Paul Starzetz references CAN-something-I-need-to-go-look-up... Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- fs/binfmt_elf.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- gregkh-2.6.orig/fs/binfmt_elf.c 2005-05-11 00:03:45.000000000 -0700 +++ gregkh-2.6/fs/binfmt_elf.c 2005-05-11 00:09:17.000000000 -0700 @@ -251,7 +251,7 @@ } /* Populate argv and envp */ - p = current->mm->arg_start; + p = current->mm->arg_end = current->mm->arg_start; while (argc-- > 0) { size_t len; __put_user((elf_addr_t)p, argv++); @@ -1301,7 +1301,7 @@ static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p, struct mm_struct *mm) { - int i, len; + unsigned int i, len; /* first copy the parameters from user space */ memset(psinfo, 0, sizeof(struct elf_prpsinfo)); ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Linux kernel ELF core dump privilege elevation 2005-05-11 18:12 ` Linux kernel ELF core dump privilege elevation Greg KH @ 2005-05-11 18:30 ` Greg KH 2005-05-11 21:51 ` Paul Starzetz 1 sibling, 0 replies; 3+ messages in thread From: Greg KH @ 2005-05-11 18:30 UTC (permalink / raw) Cc: security, linux-kernel, full-disclosure, bugtraq, vulnwatch On Wed, May 11, 2005 at 11:12:11AM -0700, Greg KH wrote: > On Wed, May 11, 2005 at 01:08:56PM +0200, Paul Starzetz wrote: > > Hi, > > > > since it became clear from the discussion in January about the uselib() > > vulnerability, that the Linux community prefers full, non-embargoed > > disclosure of kernel bugs, I release full details right now. However to > > follows at least some of the responsable disclosure rules, no exploit code will be > > released. Instead, only a proof-of-concept code is released to demonstrate > > the vulnerability. > > <snip> > > And here's a patch for 2.6 that is completly untested. I'll work on > testing it today and if it works, we will release a new 2.6.11.y release > with this fix in it. > > thanks, > > greg k-h > > > Subject: possibly fix Linux kernel ELF core dump privilege elevation > > As noted by Paul Starzetz > > references CAN-something-I-need-to-go-look-up... CAN-2005-1263 is the correct one. Sorry for being lazy and not looking it up right away. thanks, greg k-h ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Linux kernel ELF core dump privilege elevation 2005-05-11 18:12 ` Linux kernel ELF core dump privilege elevation Greg KH 2005-05-11 18:30 ` Greg KH @ 2005-05-11 21:51 ` Paul Starzetz 1 sibling, 0 replies; 3+ messages in thread From: Paul Starzetz @ 2005-05-11 21:51 UTC (permalink / raw) To: Greg KH; +Cc: security, linux-kernel, full-disclosure, bugtraq, vulnwatch On Wed, 11 May 2005, Greg KH wrote: that seems ok. > --- gregkh-2.6.orig/fs/binfmt_elf.c 2005-05-11 00:03:45.000000000 -0700 > +++ gregkh-2.6/fs/binfmt_elf.c 2005-05-11 00:09:17.000000000 -0700 > @@ -251,7 +251,7 @@ > } > > /* Populate argv and envp */ > - p = current->mm->arg_start; > + p = current->mm->arg_end = current->mm->arg_start; > while (argc-- > 0) { > size_t len; > __put_user((elf_addr_t)p, argv++); > @@ -1301,7 +1301,7 @@ > static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p, > struct mm_struct *mm) > { > - int i, len; > + unsigned int i, len; > > /* first copy the parameters from user space */ > memset(psinfo, 0, sizeof(struct elf_prpsinfo)); > -- Paul Starzetz iSEC Security Research http://isec.pl/ ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2005-05-11 21:51 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <Pine.LNX.4.44.0505101615410.1618-100000@isec.pl>
2005-05-11 18:12 ` Linux kernel ELF core dump privilege elevation Greg KH
2005-05-11 18:30 ` Greg KH
2005-05-11 21:51 ` Paul Starzetz
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox