OpenE2K/linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
330d57fb98
linux/kernel
History
Al Viro 330d57fb98 [PATCH] Fix sysctl unregistration oops (CVE-2005-2709) 
You could open the /proc/sys/net/ipv4/conf/<if>/<whatever> file, then
wait for interface to go away, try to grab as much memory as possible in
hope to hit the (kfreed) ctl_table.  Then fill it with pointers to your
function.  Then do read from file you've opened and if you are lucky,
you'll get it called as ->proc_handler() in kernel mode.

So this is at least an Oops and possibly more.  It does depend on an
interface going away though, so less of a security risk than it would
otherwise be.

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-11-08 17:57:30 -08:00
..
irq [PATCH] more kernel-doc cleanups, additions 2005-11-07 07:53:55 -08:00
power [PATCH] swsusp: remove unused variable 2005-11-07 07:53:29 -08:00
acct.c [PATCH] saner handling of auto_acct_off() and DQUOT_OFF() in umount 2005-11-07 18:18:09 -08:00
audit.c [PATCH] gfp_t: kernel/* 2005-10-28 08:16:49 -07:00
auditsc.c [PATCH] gfp_t: kernel/* 2005-10-28 08:16:49 -07:00
capability.c [PATCH] kernel/capability.c: add kerneldoc 2005-07-27 16:26:06 -07:00
compat.c [PATCH] kernel: fix-up schedule_timeout() usage 2005-09-10 10:06:37 -07:00
configs.c
cpu.c [PATCH] create and destroy cpufreq sysfs entries based on cpu notifiers 2005-10-30 17:37:14 -08:00
cpuset.c [PATCH] cpusets: automatic numa mempolicy rebinding 2005-10-30 17:37:22 -08:00
crash_dump.c [PATCH] kernel/crash_dump.c: add kerneldoc 2005-07-27 16:26:06 -07:00
dma.c
exec_domain.c
exit.c [PATCH] Process Events Connector 2005-11-07 07:53:35 -08:00
extable.c
fork.c [SPARC64] mm: context switch ptlock 2005-11-07 14:09:01 -08:00
futex.c [PATCH] FUTEX_WAKE_OP: enhanced error handling 2005-11-07 07:53:38 -08:00
intermodule.c [PATCH] introduce and use kzalloc 2005-09-07 16:57:45 -07:00
itimer.c [PATCH] itimer fixes 2005-07-27 16:25:51 -07:00
kallsyms.c [PATCH] fix missing includes 2005-10-30 17:37:32 -08:00
Kconfig.hz
Kconfig.preempt
kexec.c [PATCH] mm: split page table lock 2005-10-29 21:40:42 -07:00
kfifo.c [PATCH] gfp flags annotations - part 1 2005-10-08 15:00:57 -07:00
kmod.c [PATCH] Keys: Get rid of warning in kmod.c if keys disabled 2005-10-30 17:37:23 -08:00
kprobes.c [PATCH] Kprobes: preempt_disable/enable() simplification 2005-11-07 07:53:46 -08:00
ksysfs.c
kthread.c [PATCH] Add kthread_stop_sem() 2005-10-30 17:37:17 -08:00
Makefile [PATCH] RCU torture-testing kernel module 2005-10-30 17:37:27 -08:00
module.c [PATCH] fix remaining missing includes 2005-11-07 07:53:41 -08:00
panic.c [PATCH] Call emergency_reboot from panic 2005-07-26 14:35:43 -07:00
params.c [PATCH] fix missing includes 2005-10-30 17:37:32 -08:00
pid.c
posix-cpu-timers.c [PATCH] posix-timers `unlikely' rejig 2005-11-07 07:53:24 -08:00
posix-timers.c [PATCH] posix-timers: use schedule_timeout() in common_nsleep() 2005-10-30 17:37:20 -08:00
printk.c [PATCH] unexport console_unblank 2005-11-07 07:54:07 -08:00
profile.c [PATCH] mostly_read data section 2005-07-07 18:23:46 -07:00
ptrace.c [PATCH] consolidate sys_ptrace() 2005-11-07 07:53:42 -08:00
rcupdate.c [PATCH] RCU torture-testing kernel module 2005-10-30 17:37:27 -08:00
rcutorture.c [PATCH] RCU torture-testing kernel module 2005-10-30 17:37:27 -08:00
resource.c [PATCH] introduce and use kzalloc 2005-09-07 16:57:45 -07:00
sched.c [PATCH] unexport idle_cpu 2005-11-07 07:54:07 -08:00
seccomp.c
signal.c [PATCH] Remove duplicate code in signal.c 2005-10-30 17:37:32 -08:00
softirq.c [PATCH] cpu hoptlug: avoid usage of smp_processor_id() in preemptible code 2005-11-07 07:53:29 -08:00
softlockup.c [PATCH] cpu hoptlug: avoid usage of smp_processor_id() in preemptible code 2005-11-07 07:53:29 -08:00
spinlock.c [PATCH] spinlock consolidation 2005-09-10 10:06:21 -07:00
stop_machine.c
sys_ni.c [PATCH] remove sys_set_zone_reclaim() 2005-08-01 10:03:56 -07:00
sys.c [PATCH] unexport uts_sem 2005-11-07 07:54:07 -08:00
sysctl.c [PATCH] Fix sysctl unregistration oops (CVE-2005-2709) 2005-11-08 17:57:30 -08:00
time.c [PATCH] NTP shift_right cleanup 2005-10-30 17:37:18 -08:00
timer.c [PATCH] jiffies_64 cleanup 2005-10-30 17:37:25 -08:00
uid16.c
user.c [PATCH] inotify 2005-07-12 20:38:38 -07:00
wait.c
workqueue.c [PATCH] cpu hoptlug: avoid usage of smp_processor_id() in preemptible code 2005-11-07 07:53:29 -08:00