Re: Linux kernel sysctl() vulnerability

[Stephen White <swhite () OX COMPSOC NET>]

On Sat, Feb, 2001, Florian Weimer wrote:
> Chris Evans <chris () SCARY BEASTS ORG> writes:
> > There exists a Linux system call sysctl() which is used to query and
> > modify runtime system settings. Unprivileged users are permitted to query
> > the value of many of these settings.
>
> The following trivial patch should fix this issue. (I wonder how you
> can audit code for such vulnerabilities.  It's probably much easier to
> rewrite it in Ada. ;-)

The attached kernel module should sanitise input to the sysctl sycall to
prevent the problem without forcing a kernel recompile or upgrade.  I
assume the vulnerability can't be exploited via the /proc sysctl
interface.

Unfortunately the module does nothing for the ptrace race condition,
though a module to disable ptrace would be trivial it would disable
strace and some features of gdb and so on.

--
Stephen White              \    OU Compsoc System Administration Team
PGP Key ID: 0xC79E5B6A      \      System Administration Co-ordinator
<swhite () ox compsoc net>      \         http://ox.compsoc.net/~swhite/

Attachment: sysctl_fix.c
Description: