Re: 2.2.0 SECURITY

Jeremy Fitzhardinge (jeremy@goop.org)
Wed, 27 Jan 1999 00:11:22 -0800 (PST)


On 27-Jan-99 David S. Miller wrote:
> 1) No down() is done on the core file's inode semaphore for the
> write operations. I suppose a nice racey exploit could be used
> which involved opening a core file while the kernel was still
> writing to it and doing "stuff".

"stuff"? Like corrupting the coredump? Doesn't seem to be the height of
problems. I think at worst you could corrupt the content of the file, but
you can't make it start writing to the wrong place.

> 2) If write or seek fail in various places here, it just returns zero
> and leaves us in KERNEL_DS, this is really bad. These kinds of
> errors are why I hate macros which "return", it's asking for a bug.
>
> I'm not saying either is the cause of the crash here, but ELF core
> dumping needs some serious code review....

Yeah, I agree. I wrote it quite a while ago, and it hasn't gotten any prettier
since.

I think you've misread the macro stuff, ugly though it is. There's two
definitions of DUMP_SEEK and DUMP_WRITE. The first returns, but its used in a
context where that's OK. The second does a goto close_coredump on error, which
does the write thing with regard to segments and other cleanup.

Its clearly not the coredump code which is causing problems though - it looks
like exec of a core file is the problem, or whatever ldd does. The core files
are being generated fine.

J

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/