>> int main(void) {
>> int fd = open("badcode.bin", O_RDONLY);
> int fd = open("/dev/mem", O_RDWR);
>
>> mmap(NULL, 4096, PROT_READ | PROT_EXEC, MAP_FIXED, fd, 0);
>> }
>>
>No. In your demo code, page 0 gets memory-mapped into user space.
>This allows user-mode code to access the first page of memory
>and even read/write offset 0, still in user mode, with the
>root privs that allowed you access to that page in the
>first place.
Only root can map to 0x0?
>Everything you do, is still in user-mode.
>You just own some physical memory that the kernel didn't
>care about anyway.
So you can't accidentally call a place in userspace from kernel context?
(Including the case where set_fs(USER_DS) was used.)
Jan Engelhardt
--
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
