Bug 3043
Summary: | issue with core dump owner | ||
---|---|---|---|
Product: | Process Management | Reporter: | blake frantz (trew) |
Component: | Other | Assignee: | Ingo Molnar (mingo) |
Status: | CLOSED CODE_FIX | ||
Severity: | high | CC: | alan, matt, protasnb |
Priority: | P2 | ||
Hardware: | i386 | ||
OS: | Linux | ||
Kernel Version: | 2.6.x and 2.4.x | Subsystem: | |
Regression: | --- | Bisected commit-id: |
Description
blake frantz
2004-07-10 19:15:53 UTC
Is this still a problem with recent kernel? thanks. Yep, still seems to be happening with 2.6.23. Cute.. that needs fixing fixed upstream: commit c46f739dd39db3b07ab5deb4e3ec81e1c04a91af Author: Ingo Molnar <mingo@elte.hu> Date: Wed Nov 28 13:59:18 2007 +0100 vfs: coredumping fix fix: http://bugzilla.kernel.org/show_bug.cgi?id=3043 only allow coredumping to the same uid that the coredumping task runs under. I don't think this fix is sufficient. If I happen to share a writable directory with the victim somewhere else, I can borrow a regular file owned by the victim from there and use it to perform the same attack. The safest approach would be to use O_EXCL all the time. |