Re: [PATCH] acpi: debugfs: fix buffer overflows, double free

[Vasiliy Kulikov <segoon () openwall com>]

Eugene,

On Fri, Jan 21, 2011 at 11:46 +0800, Eugene Teo wrote:
> On 01/21/2011 04:08 AM, Vasiliy Kulikov wrote:
> > File position is not controlled, it may lead to overwrites of arbitrary
> > kernel memory.  Also the code may kfree() the same pointer multiple
> > times.
>
> http://lkml.org/lkml/2011/1/20/348
> https://bugzilla.redhat.com/CVE-2011-0023
>
> Please use CVE-2011-0023 (this does not include the unresolved flaw
> described in the following paragraph below).
>
> > One more flaw is still present: if multiple processes open the file then
> > all 3 static variables are shared, leading to various race conditions.
> > They should be moved to file->private_data.

Since ed3aada1bf34c this file is available to root only.  This may be
exploited if and only if the file is chmod'ed/chown/ed to nonroot.


Thanks,

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments