| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 7 Aug 2006 18:12:55 -0500 From: Chase Venters <chase.venters@...entec.com> To: Daniel Jacobowitz <dan@...ian.org> Cc: David Wagner <daw-usenet@...erner.cs.berkeley.edu>, linux-kernel@...r.kernel.org Subject: Re: [RFC/PATCH] revoke/frevoke system calls V2 On Monday 07 August 2006 17:56, Daniel Jacobowitz wrote: > On Mon, Aug 07, 2006 at 10:52:59PM +0000, David Wagner wrote: > > I'm still trying to understand the semantics of this proposed > > frevoke() implementation. Can an attacker use this to forcibly > > close some other processes' file descriptor? Suppose the target > > process has fd 0 open and the attacker revokes the file corresponding > > to fd 0; what is the state of fd 0 in the target process? Is it > > closed? If the target process then open()s another file, does it > > get bound to fd 0? (Recall that open() always binds to the lowest > > unused fd.) If the answers are "yes", then the security consequences > > seem very scary. > > No, that's already been answered at least once. The file remains open, > but returns EBADF on various operations. IIRC, it returns EBADF because the file actually gets closed. The file descriptor, on the other hand, is permanently leaked. Have these details changed? Thanks, Chase - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists