syscalls/timer_create: Add test for CVE-2017-18344
PATCH v2 1/1 syscalls/timer_create: Add test for CVE-2017-18344
In kernels prior to 4.14.8 (missing commit cef31d9af908) the sigevent.sigev_notify field is not properly checked when creating a timer using timer_create(2). This can be used to read arbitrary kernel memory.
---
Notes:
Patch aplicable after the timer tests got moved to syscalls (see patch on the mailing list).
runtest/syscalls | 1 + testcases/kernel/syscalls/timer_create/.gitignore | 1 + .../kernel/syscalls/timer_create/timer_create03.c | 67 ++++++++++++++++++++++ 3 files changed, 69 insertions(+) create mode 100644 testcases/kernel/syscalls/timer_create/timer_create03.c
runtest/syscalls +1 -0
@@ -1441,6 +1441,7 @@ timerfd_settime01 timerfd_settime01 timer_create01 timer_create01 timer_create02 timer_create02 +timer_create03 timer_create03 timer_delete01 timer_delete01 timer_delete02 timer_delete02
testcases/kernel/syscalls/timer_create/.gitignore +1 -0
@@ -1,2 +1,3 @@ /timer_create01 /timer_create02 +/timer_create03
testcases/kernel/syscalls/timer_create/timer_create03.c new file +67 -0
67 lines not on this page · raw message
Signature · 1 line
2.16.4
PATCH v2 1/1 syscalls/timer_create: Add test for CVE-2017-18344
Quoted 7 lines · Christian Amann
In kernels prior to 4.14.8 (missing commit
cef31d9af908) the sigevent.sigev_notify field is not properly checked when creating a timer usingtimer_create(2). This can be used to read arbitrary kernel memory.Signed-off-by Christian Amann <[email protected]>
Signature · 2 lines
Regards, Li Wang
PATCH v2 1/1 syscalls/timer_create: Add test for CVE-2017-18344
In reply to Christian AmannHi Christian,
Quoted 4 lines
In kernels prior to 4.14.8 (missing commit
cef31d9af908) the sigevent.sigev_notify field is not properly checked when creating a timer usingtimer_create(2). This can be used to read arbitrary kernel memory.
Thanks for your patch, merged into master (with Cyril's and Li's ack).
Kind regards,
Petr