bugtraq - Hotfix for new mremap vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.58.0402191712480.2090@orodruina.lan>
Date: Thu, 19 Feb 2004 17:32:30 +0100 (CET)
From: Pavel harry_x Palát <harry_x@...ylon5.cz>
To: bugtraq@...urityfocus.com
Subject: Hotfix for new mremap vulnerability


Greetings,

	Here (http://wizard.ath.cx/fixmremap2.tar.gz) is small hotfix for newly
discovered mremap() vulnerability. It
doesn't directly change do_mremap() code, it just overwrites syscall
handler with LKM. In my opinion it is enough to fix just mremap() syscall because at
least on x86 there are no other functions which would use do_mremap
directly. But this may not be true on others platforms (for example
ia64)...

The package contains the hotfix and a small proof of concept program which
can be used to see if kernel is vulnerable.

Use at your own risk.

Pavel Palát

--
Pavel "harry_x" Palát
    harry_x@...ylon5.cz
    irc: #mistral.cz on IRCnet

    The only way of finding the limits to the possible is by going beyond them to the impossible
                                                  Arthur C. Clark