Re: BK2CVS problem

From: Scott Robert Ladd
Date: Wed Nov 05 2003 - 23:13:33 EST

Larry McVoy wrote:
On Wed, Nov 05, 2003 at 04:48:09PM -0600, Chad Kitching wrote:

From: Zwane Mwaikambo

+ if ((options == (__WCLONE|__WALL)) && (current->uid = 0))
+ retval = -EINVAL;

That looks odd

Setting current->uid to zero when options __WCLONE and __WALL are set? The retval is dead code because of the next line, but it looks like an attempt
to backdoor the kernel, does it not?

It sure does. Note "current->uid = 0", not "current->uid == 0". Good eyes, I missed that. This function is sys_wait4() so by passing in
__WCLONE|__WALL you are root. How nice.

In other words, the theoretical exploit was inserted by someone clever. Do we have any idea who?

BTW, good job catching the problem Larry.

Scott Robert Ladd
Coyote Gulch Productions (
Software Invention for High-Performance Computing

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at