Security: fix cap_file_mmap() off-by-one error to avoid kernel null pointer exploit
in [Kernel]
|
Prev: BH1770GLC / SFH7770 combined ambient light / proximity sensor
Next: Security: fix cap_file_mmap() off-by-one error to avoid kernel null pointer exploit
From: Eric Paris on 15 Apr 2010 08:20 On Thu, 2010-04-15 at 13:51 +0800, wzt.wzt(a)gmail.com wrote: NAK The fix to the comment is fine, but you missed the point ENTIRELY. The WHOLE point of being able to set dac_mmap_min_addr == 0 is so you can disable the protection. There exist tools (wine and dosemu) which NEED to map the 0 page. Thus dac_mmap_min_addr == 0 means the protection is disabled. If you don't want to disable the protection, don't disable it! -Eric > --- > security/commoncap.c | 4 ++-- > 1 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/security/commoncap.c b/security/commoncap.c > index 6166973..cc6b458 100644 > --- a/security/commoncap.c > +++ b/security/commoncap.c > @@ -931,7 +931,7 @@ int cap_vm_enough_memory(struct mm_struct *mm, long pages) > * @addr: address attempting to be mapped > * @addr_only: unused > * > - * If the process is attempting to map memory below mmap_min_addr they need > + * If the process is attempting to map memory below dac_mmap_min_addr they need > * CAP_SYS_RAWIO. The other parameters to this function are unused by the > * capability security module. Returns 0 if this mapping should be allowed > * -EPERM if not. A patch with only this change would be fine. > @@ -942,7 +942,7 @@ int cap_file_mmap(struct file *file, unsigned long reqprot, > { > int ret = 0; > > - if (addr < dac_mmap_min_addr) { > + if (addr <= dac_mmap_min_addr) { > ret = cap_capable(current, current_cred(), CAP_SYS_RAWIO, > SECURITY_CAP_AUDIT); > /* set PF_SUPERPRIV if it turns out we allow the low mmap */ Clearly missed the boat on this one. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ |