From: Linus Torvalds <torvalds@osdl.org>
To: Valdis.Kletnieks@vt.edu
Cc: linux-kernel@vger.kernel.org
Subject: Re: mremap() bug IMHO not in 2.2
Date: Mon, 5 Jan 2004 16:08:36 -0800 (PST) [thread overview]
Message-ID: <Pine.LNX.4.58.0401051604550.5970@home.osdl.org> (raw)
In-Reply-To: <200401052358.i05NwWIe010594@turing-police.cc.vt.edu>
On Mon, 5 Jan 2004 Valdis.Kletnieks@vt.edu wrote:
>
> On Mon, 05 Jan 2004 15:36:41 PST, Linus Torvalds said:
>
> > So yes, it creates some confusion in the VM layer, but it all seems
> > benign. It's clearly a bug, but where does the security problem come in?
>
> Just guessing, but would a zero-length vma be rounded up to a page, and
> thus give the attacker scribble permission on a page he shouldn't have had?
Almost certainly not.
It's more likely that one of the two functions that walk through _all_ the
vma's (fork() and exit()) simply knows that a vma can never be
zero-length, and uses a
addr = vma->vm_start;
do {
...
addr += PAGE_SIZE;
} while (addr < vma->vm_end);
kind of loop - which means that either fork() or exit() would copy or
release one page too many.
The only page that should matter is likely the one at 0xC0000000, where
there can be extra complications from the fact that we use 4MB pages for
the kernel, so when fork/exit tries to walk the page table, it would get
bogus results.
Still, I'd expect that to lead to a triple fault (and thus a reboot)
rather than any elevation of privileges..
Interesting, in any case. Good catch from whoever found it.
Linus
next prev parent reply other threads:[~2004-01-06 0:09 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-01-05 14:54 mremap bug and 2.4? Robert L. Harris
2004-01-05 15:21 ` Erik Mouw
2004-01-05 15:26 ` Marcelo Tosatti
2004-01-05 15:42 ` Robert L. Harris
2004-01-05 17:10 ` Diego Calleja
2004-01-05 18:23 ` Tomas Szepe
2004-01-05 18:26 ` mremap() bug and 2.2? Petr Baudis
2004-01-05 22:55 ` mremap() bug IMHO not in 2.2 Petr Baudis
2004-01-05 23:36 ` Linus Torvalds
2004-01-05 23:58 ` Valdis.Kletnieks
2004-01-06 0:08 ` Linus Torvalds [this message]
2004-01-06 2:14 ` Tomas Szepe
2004-01-06 9:22 ` Martin Loschwitz
2004-01-06 20:36 ` mremap() bug indeed not in 2.2 (confirmed) Petr Baudis
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Pine.LNX.4.58.0401051604550.5970@home.osdl.org \
--to=torvalds@osdl.org \
--cc=Valdis.Kletnieks@vt.edu \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.