Re: Problems in automatic crash analysis frameworks

[Jakub Filak <jfilak () redhat com>]

Hello,

I have a question regarding the ABRT vulnerabilities. I don't particularly understand how an attacker can use 
/proc/pid/exe symlink to force ABRT to read an arbitrary file if the symlink cannot be changed and kernel refuses to 
create the process if the symlink's target is not executable.

> This code trusts the /proc/pid/exe symlink, even though it is possible
> to link it anywhere you want.
>
> https://github.com/abrt/abrt/blob/master/src/hooks/abrt-hook-ccpp.c#L368
>
>        sprintf(buf, "/proc/%lu/exe", (long)pid);
>        int src_fd_binary = open(buf, O_RDONLY); /* might fail and
>                                                    return -1, it's ok */

Thank you for clarifying this for me.


Kind regards,
Jakub