Al Viro
330d57fb98
[PATCH] Fix sysctl unregistration oops (CVE-2005-2709)
...
You could open the /proc/sys/net/ipv4/conf/<if>/<whatever> file, then
wait for interface to go away, try to grab as much memory as possible in
hope to hit the (kfreed) ctl_table. Then fill it with pointers to your
function. Then do read from file you've opened and if you are lucky,
you'll get it called as ->proc_handler() in kernel mode.
So this is at least an Oops and possibly more. It does depend on an
interface going away though, so less of a security risk than it would
otherwise be.
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-11-08 17:57:30 -08:00
..
2005-11-07 14:32:58 +01:00
2005-10-31 16:36:08 -02:00
2005-10-31 16:36:08 -02:00
2005-11-07 07:53:48 -08:00
2005-11-07 07:53:48 -08:00
2005-11-07 18:18:09 -08:00
2005-11-07 07:53:38 -08:00
2005-10-30 17:37:21 -08:00
2005-10-30 17:37:17 -08:00
2005-11-07 07:53:35 -08:00
2005-11-06 10:22:04 +01:00
2005-11-07 07:53:35 -08:00
2005-11-07 07:53:52 -08:00
2005-10-30 17:37:14 -08:00
2005-10-30 17:37:32 -08:00
2005-10-30 17:37:21 -08:00
2005-11-07 18:18:11 -08:00
2005-10-30 17:37:10 -08:00
2005-11-03 13:53:34 +11:00
2005-11-02 22:08:52 -02:00
2005-11-05 21:00:02 -05:00
2005-11-07 07:53:53 -08:00
2005-11-07 07:53:24 -08:00
2005-11-07 07:53:52 -08:00
2005-11-07 18:18:11 -08:00
2005-11-07 07:53:42 -08:00
2005-10-30 17:37:32 -08:00
2005-11-01 09:26:16 +01:00
2005-10-30 17:37:32 -08:00
2005-10-30 17:37:32 -08:00
2005-11-08 09:40:47 -08:00
2005-11-02 22:51:46 -05:00
2005-11-07 07:54:07 -08:00
2005-11-07 07:53:43 -08:00
2005-11-07 07:53:41 -08:00
2005-11-07 07:53:55 -08:00
2005-11-07 14:18:56 +01:00
2005-11-07 14:18:56 +01:00
2005-11-07 14:18:56 +01:00
2005-11-07 07:53:37 -08:00
2005-11-07 07:54:08 -08:00
2005-10-30 17:37:23 -08:00
2005-10-30 17:37:23 -08:00
2005-10-30 17:37:32 -08:00
2005-11-07 07:53:46 -08:00
2005-10-30 17:37:17 -08:00
2005-11-04 22:08:00 -05:00
2005-11-07 07:53:35 -08:00
2005-10-29 21:40:44 -07:00
2005-11-07 07:53:41 -08:00
2005-10-30 17:37:22 -08:00
2005-11-07 07:53:37 -08:00
2005-10-29 21:40:44 -07:00
2005-10-30 17:37:26 -08:00
2005-11-07 18:18:11 -08:00
2005-10-30 17:37:32 -08:00
2005-11-07 18:18:10 -08:00
2005-11-07 07:53:55 -08:00
2005-11-04 15:33:38 -05:00
2005-10-30 17:37:21 -08:00
2005-11-07 08:04:01 -08:00
2005-11-05 14:40:55 -05:00
2005-11-05 22:02:29 +01:00
2005-11-05 21:19:33 +00:00
2005-10-30 17:37:15 -08:00
2005-11-07 07:54:09 -08:00
2005-11-08 09:40:47 -08:00
2005-11-08 17:57:30 -08:00
2005-11-07 07:53:42 -08:00
2005-11-07 18:18:09 -08:00
2005-11-07 07:53:39 -08:00
2005-11-07 07:53:37 -08:00
2005-10-30 17:37:27 -08:00
2005-11-07 07:53:47 -08:00
2005-11-07 07:53:46 -08:00
2005-11-07 07:53:46 -08:00
2005-11-07 07:53:47 -08:00
2005-11-07 14:25:38 +01:00
2005-10-30 17:37:31 -08:00
2005-10-30 17:37:23 -08:00
2005-11-07 07:53:41 -08:00
2005-11-06 09:07:03 +00:00
2005-11-06 09:07:03 +00:00
2005-10-30 17:37:32 -08:00
2005-11-07 07:53:37 -08:00
2005-10-30 17:37:19 -08:00
2005-11-05 20:56:41 -02:00
2005-11-07 07:53:24 -08:00
2005-10-30 17:37:13 -08:00
2005-11-07 07:53:28 -08:00
2005-10-30 17:37:14 -08:00
2005-10-30 17:37:20 -08:00
2005-11-08 17:57:30 -08:00
2005-10-30 17:37:32 -08:00
2005-10-30 17:37:21 -08:00
2005-10-30 17:37:18 -08:00
2005-11-07 07:53:41 -08:00