Re: Kernel exploit in brk() function.

Sam Halliday <[email protected]>
Newsgroups gmane.linux.lfs.security
Message-ID <[email protected]>
btw, i cant remember if anyone actually posted this... attached is the patch to
2.4.22 which fixes the buffer overflow... incase you need to use 2.4.22 for any
reason (i know i do, due to modem driver restrictions...)

-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page
linux-2.4.22-do_brk.diff (application/octet-stream, 299 B)
--- mm/mmap.c.orig	2003-12-05 16:58:21.000000000 +0000
+++ mm/mmap.c	2003-12-05 17:01:47.000000000 +0000
@@ -1040,6 +1040,8 @@
 	len = PAGE_ALIGN(len);
 	if (!len)
 		return addr;
+        if ((addr + len) > TASK_SIZE || (addr + len) < addr)
+          return -EINVAL;
 
 	/*
 	 * mlock MCL_FUTURE?
signature.asc (application/pgp-signature, 189 B)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/0LCFh5Q4qVL9G8kRAn/lAJ9LIS1kS/AZNKMecD7t+Lxpwq8iQgCdEQRT
bkK4v1EvK1S5v3VCjxIoHM0=
=OuqJ
-----END PGP SIGNATURE-----
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.