Christoph Hellwig wrote:
>> diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
>> index f312103..5638acf 100644
>> --- a/fs/binfmt_aout.c
>> +++ b/fs/binfmt_aout.c
>> @@ -278,6 +278,9 @@ static int load_aout_binary(struct linux
>> return -ENOEXEC;
>> }
>>
>> + if (!bprm->file->f_op || !bprm->file->f_op->mmap)
>> + return -ENOEXEC;
>> +
>
> These checks need a big comment explanining why they are there, else people
> will remove them again by accident.
Here's a resend.
Like what Marcel wrote, Andrew, please include this patch in -mm for testing.
Thanks.
Eugene
--
[PATCH] Require mmap handler for a.out executables
Files supported by fs/proc/base.c, i.e. /proc/<pid>/*, are not capable
of meeting the validity checks in ELF load_elf_*() handling because they
have no mmap handler which is required by ELF. In order to stop a.out
executables being used as part of an exploit attack against /proc-related
vulnerabilities, we make a.out executables depend on ->mmap() existing.
Signed-off-by: Eugene Teo <[email protected]>
Signed-off-by: Marcel Holtmann <[email protected]>
diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
index f312103..2042dfa 100644
--- a/fs/binfmt_aout.c
+++ b/fs/binfmt_aout.c
@@ -278,6 +278,12 @@ static int load_aout_binary(struct linux
return -ENOEXEC;
}
+ /* Requires a mmap handler. This prevents people from using a.out
+ * as part of an exploit attack against /proc-related vulnerabilities.
+ */
+ if (!bprm->file->f_op || !bprm->file->f_op->mmap)
+ return -ENOEXEC;
+
fd_offset = N_TXTOFF(ex);
/* Check initial limits. This avoids letting people circumvent
@@ -476,6 +482,12 @@ static int load_aout_library(struct file
goto out;
}
+ /* Requires a mmap handler. This prevents people from using a.out
+ * as part of an exploit attack against /proc-related vulnerabilities.
+ */
+ if (!file->f_op || !file->f_op->mmap)
+ goto out;
+
if (N_FLAGS(ex))
goto out;
--
eteo redhat.com ph: +65 6490 4142 http://www.kernel.org/~eugeneteo
gpg fingerprint: 47B9 90F6 AE4A 9C51 37E0 D6E1 EA84 C6A2 58DF 8823
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
