• Alexey Dobriyan's avatar
    [PATCH] do_coredump() and not stopping rewrite attacks? (CVE-2006-6304) · a526d58e
    Alexey Dobriyan authored
    On Sat, Dec 02, 2006 at 11:47:44PM +0300, Alexey Dobriyan wrote:
    > David Binderman compiled 2.6.19 with icc and grepped for "was set but never
    > used". Many warnings are on
    > 	http://coderock.org/kj/unused-2.6.19-fs
    
    Heh, the very first line:
    fs/exec.c(1465): remark #593: variable "flag" was set but never used
    
    fs/exec.c:
      1477		/*
      1478		 *	We cannot trust fsuid as being the "true" uid of the
      1479		 *	process nor do we know its entire history. We only know it
      1480		 *	was tainted so we dump it as root in mode 2.
      1481		 */
      1482		if (mm->dumpable == 2) {	/* Setuid core dump mode */
      1483			flag = O_EXCL;		/* Stop rewrite attacks */
      1484			current->fsuid = 0;	/* Dump root private */
      1485		}
    
    And then filp_open follows with "flag" totally ignored.
    Signed-off-by: default avatarChris Wright <chrisw@sous-sol.org>
    a526d58e
exec.c 34.9 KB