linux/arch/s390
Al Viro 330d57fb98 [PATCH] Fix sysctl unregistration oops (CVE-2005-2709)
You could open the /proc/sys/net/ipv4/conf/<if>/<whatever> file, then
wait for interface to go away, try to grab as much memory as possible in
hope to hit the (kfreed) ctl_table.  Then fill it with pointers to your
function.  Then do read from file you've opened and if you are lucky,
you'll get it called as ->proc_handler() in kernel mode.

So this is at least an Oops and possibly more.  It does depend on an
interface going away though, so less of a security risk than it would
otherwise be.

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-11-08 17:57:30 -08:00
..
appldata [PATCH] Fix sysctl unregistration oops (CVE-2005-2709) 2005-11-08 17:57:30 -08:00
boot [PATCH] use ${CROSS_COMPILE}installkernel in arch/*/boot/install.sh 2005-06-23 09:45:07 -07:00
crypto Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
kernel [PATCH] s390: merge common parts of head.S and head64.S 2005-11-07 07:53:34 -08:00
lib [PATCH] spinlock consolidation 2005-09-10 10:06:21 -07:00
math-emu Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
mm [PATCH] kfree cleanup: arch 2005-11-07 07:54:06 -08:00
oprofile Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
Kconfig [NET]: add a top-level Networking menu to *config 2005-07-11 21:03:49 -07:00
Kconfig.debug Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
Makefile [PATCH] s390: merge common parts of head.S and head64.S 2005-11-07 07:53:34 -08:00
defconfig [PATCH] s390: default configuration 2005-09-17 11:49:58 -07:00