Re: New mremap bug
Christophe Devine <[email protected]> Wed, 18 Feb 2004 18:34:20 +0000 (UTC)
| Newsgroups | gmane.linux.lfs.security |
|---|---|
| Organization | Linux From Scratch |
| Message-ID | <[email protected]> |
Billy O'Connor <[email protected]> wrote: > > For those of you who'd want to test for this vulnerability, > > I've written some simple exploit code: > > http://linuxfromscratch.org/~devine/mremap_poc_2.c > With MREMAP_MAYMOVE | MREMAP_FIXED, I segfaulted, with MREMAP_MAYMOVE > alone, it ran. Have a look at the kernel messages with dmesg, if you see stuff like: kernel BUG at mmap.c:1194! invalid operand: 0000 CPU: 0 EIP: 0010:[<c01239b5>] Not tainted Then your kernel is almost certainly vulnerable. There's no root exploit available yet though ;-) -- http://linuxfromscratch.org/mailman/listinfo/lfs-security FAQ: http://www.linuxfromscratch.org/faq/ Unsubscribe: See the above information page