Local root exploit with kmod and modutils > 2.1.121
Hi,
as modprobe (insmod) args parsing seems POSIX compliant, we should put a "--" before
what should be interpreted only as a textual argument, not as an option. This is a lot safer: whatever is passed, modprobe will take it as a module name.
kernel/kmod.c Thu Nov 16 19:57:45 2000 renamed from kernel/kmod.c Tue Sep 26 01:18:55 2000 +0 -0
@@ -133,7 +133,7 @@ static int exec_modprobe(void * module_name) { static char * envp[] = { "HOME=/", "TERM=linux",
"PATH=/sbin:/usr/sbin:/bin:/usr/bin", NULL };
- char *argv[] = { modprobe_path, "-s", "-k", (char*)module_name,
NULL };
+ char *argv[] = { modprobe_path, "-s", "-k", "--",
(char*)module_name, NULL };
int ret;
ret = exec_usermodehelper(modprobe_path, argv, envp);-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/
Quoted 5 lines · Xavier Bestel
as modprobe (insmod) args parsing seems POSIX compliant, we should put a "--" before
what should be interpreted only as a textual argument, not as an option. This is a lot safer: whatever is passed, modprobe will take it as a module name.
That only solves one of the two exploit methods. modutils 2.3.20 solves both without any kernel changes, mainly so it fixes the problem on all kernels, including 2.2.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/
Followup to: <[email protected]> By author: Keith Owens <[email protected]> In newsgroup: linux.dev.kernel
Quoted 9 lines
Quoted 5 lines · Xavier Bestel
as modprobe (insmod) args parsing seems POSIX compliant, we should put a "--" before
what should be interpreted only as a textual argument, not as an option. This is a lot safer: whatever is passed, modprobe will take it as a module name.
Quoted 4 lines
That only solves one of the two exploit methods. modutils 2.3.20 solves both without any kernel changes, mainly so it fixes the problem on all kernels, including 2.2.
However, the kernel change is probably still a good idea.
-hpa
Signature · 7 lines
<[email protected]> at work, <[email protected]> in private! "Unix gives you enough rope to shoot yourself in the foot." http://www.zytor.com/~hpa/puzzle.txt - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] Please read the FAQ at http://www.tux.org/lkml/