Re: mremap() bug IMHO not in 2.2

From: Linus Torvalds (torvalds_at_osdl.org)
Date: 01/06/04

  • Next message: Rob Landley: "Re: udev and devfs - The final word" 
    Date:	Mon, 5 Jan 2004 16:08:36 -0800 (PST)
To: Valdis.Kletnieks@vt.edu

    On Mon, 5 Jan 2004 Valdis.Kletnieks@vt.edu wrote:
    >
    > On Mon, 05 Jan 2004 15:36:41 PST, Linus Torvalds said:
    >
    > > So yes, it creates some confusion in the VM layer, but it all seems
    > > benign. It's clearly a bug, but where does the security problem come in?
    >
    > Just guessing, but would a zero-length vma be rounded up to a page, and
    > thus give the attacker scribble permission on a page he shouldn't have had?

    Almost certainly not.

    It's more likely that one of the two functions that walk through _all_ the
    vma's (fork() and exit()) simply knows that a vma can never be
    zero-length, and uses a

            addr = vma->vm_start;
            do {
                    ...
                    addr += PAGE_SIZE;
            } while (addr < vma->vm_end);

    kind of loop - which means that either fork() or exit() would copy or
    release one page too many.

    The only page that should matter is likely the one at 0xC0000000, where
    there can be extra complications from the fact that we use 4MB pages for
    the kernel, so when fork/exit tries to walk the page table, it would get
    bogus results.

    Still, I'd expect that to lead to a triple fault (and thus a reboot)
    rather than any elevation of privileges..

    Interesting, in any case. Good catch from whoever found it.

                    Linus
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

  • Next message: Rob Landley: "Re: udev and devfs - The final word"

    Relevant Pages

    • Re: RFC: implement daemon() in the kernel
      ... Except some special cases, fork() ... The child process is created and suspended, the parent continues to run ... until it calls exec() or _exit. ... You do have to look out for any applications that fork and do not either exit or exec, but that is so much better than having to modify so many things just to get them to run. ...
      (Linux-Kernel)
    • thread death callback to be called after fork
      ... t = Thread.new{sleep} ... fork{t.join; exit} and Process.wait ... definining a finalizer is one way to trigger notification of thread death on ...
      (comp.lang.ruby)
    • Re: Running system() commands in background
      ... > I'm not sure fork will work under win32. ... Should this code be run under DOS and a reader does not know ... how to exit two command instances, if a reader selects to close ... Fork is not supported under Win32. ...
      (comp.lang.perl.misc)
    • Re: [PATCH 5/6] Makes procs file writable to move all threads by tgid at once
      ... reading in the fork() path to prevent newly forking threads within the ... * cgroup, so we wrap cgroup_exit. ... because the fork hook can fail and the exit hook is called in all the ... cases making the fork / exit asymmetric. ...
      (Linux-Kernel)
    • Re: [PATCH] bogus __KERNEL_SYSCALLS__ usage
      ... > (nothing to fix, they were defining it and including unistd.h for no ... used as a kernel syscall, potentially also clone and _exit, when they are ... send the line "unsubscribe linux-kernel" in ...
      (Linux-Kernel)