[PATCH] fix Linux kernel ELF core dump privilege elevation

[Greg KH <gregkh@suse.de>]

[PATCH] fix Linux kernel ELF core dump privilege elevation

As reported by Paul Starzetz <ihaquer@isec.pl>

Reference: CAN-2005-1263

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
commit a84a505956f5c795a9ab3d60d97b6b91a27aa571
tree 440fdf47fcddf8b0d615667b418981a511d16e30
parent d3f0fcec2d50a18a84c4f3dd7683206ed37ca009
author Greg Kroah-Hartman <gregkh@suse.de> Wed, 11 May 2005 00:10:44 -0700
committer Greg KH <gregkh@suse.de> Mon, 16 May 2005 21:07:05 -0700

 fs/binfmt_elf.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

Index: fs/binfmt_elf.c
===================================================================
--- 6e56e97c81b5b8c4d556ffd90349e73a885a20dc/fs/binfmt_elf.c  (mode:100644)
+++ 440fdf47fcddf8b0d615667b418981a511d16e30/fs/binfmt_elf.c  (mode:100644)
@@ -251,7 +251,7 @@
 	}
 
 	/* Populate argv and envp */
-	p = current->mm->arg_start;
+	p = current->mm->arg_end = current->mm->arg_start;
 	while (argc-- > 0) {
 		size_t len;
 		__put_user((elf_addr_t)p, argv++);
@@ -1301,7 +1301,7 @@
 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
 		       struct mm_struct *mm)
 {
-	int i, len;
+	unsigned int i, len;
 	
 	/* first copy the parameters from user space */
 	memset(psinfo, 0, sizeof(struct elf_prpsinfo));

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/