mailing list archives
Re: CVE request (and disclosure): ax25d missing setuid return code check
From: Solar Designer <solar () openwall com>
Date: Thu, 11 Aug 2011 22:55:13 +0400
On Thu, 2011-08-11 at 15:05 +0100, Ralf Baechle wrote:
These days setuid and similar syscalls need to allocate memory for the
credentials of a process and memory allocations may fail. A system could
even be put under massive memory pressure with the intend to make this
Per the discussion on kernel-hardening, this specific allocation
currently can't fail, but my opinion is that we need to harden the
kernel code to kill the process if the allocation does fail (which might
become possible in a future revision of the code). I introduced such
process-killing into Owl-current recently (although, as I said, this
code path is believed to be never reached).
On Thu, Aug 11, 2011 at 10:21:11AM -0400, Jon Oberheide wrote:
The important vector is RLIMIT_NPROC.
Right. This one will be gone in Linux 3.1 (patch applied today, after a
lengthy discussion and several revisions):
This is also in Owl-current.
Even though we're hardening the kernel in this respect, userspace
programs should continue to check return value from setuid() anyway, as
well as from syscalls in general. And we should continue to treat
missing setuid() return value checks as security bugs, even if they
would normally not be triggerable on Linux 3.1+ (except in case the
process is running with lowered capabilities).
Re: CVE request (and disclosure): ax25d missing setuid return code check Josh Bressers (Aug 12)