Al Viro 330d57fb98 [PATCH] Fix sysctl unregistration oops (CVE-2005-2709)
You could open the /proc/sys/net/ipv4/conf/<if>/<whatever> file, then
wait for interface to go away, try to grab as much memory as possible in
hope to hit the (kfreed) ctl_table.  Then fill it with pointers to your
function.  Then do read from file you've opened and if you are lucky,
you'll get it called as ->proc_handler() in kernel mode.

So this is at least an Oops and possibly more.  It does depend on an
interface going away though, so less of a security risk than it would
otherwise be.

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-11-08 17:57:30 -08:00
..
2005-11-08 22:43:44 +00:00
2005-11-07 09:05:22 -08:00
2005-11-07 07:53:42 -08:00
2005-11-08 12:20:34 +11:00
2005-11-08 12:20:34 +11:00
2005-11-08 12:20:34 +11:00
2005-11-07 07:53:42 -08:00
2005-11-07 14:11:38 -08:00
2005-10-30 17:37:32 -08:00
2005-11-01 13:18:54 -08:00
2005-11-04 22:29:52 -06:00
2005-11-07 14:35:14 +01:00