aboutsummaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorAlexey Dobriyan <adobriyan@gmail.com>2021-03-14 23:51:14 +0300
committerLinus Torvalds <torvalds@linux-foundation.org>2021-03-14 14:33:27 -0700
commitc995f12ad8842dbf5cfed113fb52cdd083f5afd1 (patch)
tree92dd0fb652dcb361423365b28ee32888ab2257c8 /drivers
parent70404fe3030ec2dcf339a9730bc03bf0e1f2acf5 (diff)
downloadlinux-stericsson-c995f12ad8842dbf5cfed113fb52cdd083f5afd1.tar.gz
prctl: fix PR_SET_MM_AUXV kernel stack leak
Doing a prctl(PR_SET_MM, PR_SET_MM_AUXV, addr, 1); will copy 1 byte from userspace to (quite big) on-stack array and then stash everything to mm->saved_auxv. AT_NULL terminator will be inserted at the very end. /proc/*/auxv handler will find that AT_NULL terminator and copy original stack contents to userspace. This devious scheme requires CAP_SYS_RESOURCE. Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers')
0 files changed, 0 insertions, 0 deletions