Re: local root on linux 2.2.15

[typo () SCENE AT (Firstname Lastname)]

On Thu, Jun 15, 2000 at 10:44:07AM -0500, Peter da Silva wrote:
>          This isn't as bad as a buffer overflow on stack,
>          because it's almost impossible to exploit for anything but
>          a DOS attack, but it's easy to avoid:
>
>          header = malloc(sizeof (cap_user_header_t) );
>          data = malloc(sizeof (cap_user_data_t) );

nope. both sizeof()'s will always return 4 (on 32 bit architectures).

(see /usr/include/linux/capability.h:
typedef struct __user_cap_header_struct {
        __u32 version;
        int pid;
} *cap_user_header_t;

typedef struct __user_cap_data_struct {
        __u32 effective;
        __u32 permitted;
        __u32 inheritable;
} *cap_user_data_t;
)

use this instead:
  header = malloc(sizeof (struct __user_cap_header_struct) );
  data   = malloc(sizeof (struct __user_cap_data_struct) );

> I don't have a recent Linux box to check, but isn't this a system call?

yup
#define __NR_capget             184
#define __NR_capset             185

ciao,
    typo

--
so much entropy, so little time