linux-kernel - [PATCH 0/1] uprobes: Fix the memory out of bound overwrite in copy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20131107194010.GA29154@redhat.com>
Date:	Thu, 7 Nov 2013 20:40:10 +0100
From:	Oleg Nesterov <oleg@...hat.com>
To:	Ingo Molnar <mingo@...nel.org>
Cc:	Ingo Molnar <mingo@...e.hu>,
	Ananth N Mavinakayanahalli <ananth@...ibm.com>,
	David Long <dave.long@...aro.org>,
	Srikar Dronamraju <srikar@...ux.vnet.ibm.com>,
	linux-kernel@...r.kernel.org
Subject: [PATCH 0/1] uprobes: Fix the memory out of bound overwrite in
	copy_insn()

On 11/07, Oleg Nesterov wrote:
>
> But when I looked at it now I realized that it is very wrong, and it
> is very easy to crash the kernel (fortunately only root can enable
> uprobes).
>
> So we need to fix it (and cleanup), I'll try to make the patch asap.

Just truncate the binary after uprobe was enabled, then mmap() the
truncated area. This crashes the kernel if nobody else mmaped this
area in between.

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/