Binfmt_script handling in combination with CONFIG_MODULES can lead to disclosure of kernel stack data during execve via copy of data from dangling pointer to stack to growing argv list. Apart from that, the BINPRM_MAX_RECURSION can be exceeded: the maximum of 4 recursions is ignored, instead a maximum of roughly 2^6 recursions is in place. See http://lkml.org/lkml/2012/8/18/75 about discussion of problem and patch proposals, but no solution yet. See http://www.halfdog.net/Security/2012/LinuxKernelBinfmtScriptStackDataDisclosure/ for POC.
Could you provide pointers or workaround to resolve this issue.
This was tracked as http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4530 and is already fixed. Here are two commits dealing with that ... https://github.com/torvalds/linux/commit/b66c5984017533316fd1951770302649baf1aa33 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b66c5984017533316fd1951770302649baf1aa33 ... but there are much more, since not only mainline kernel was patched.