aboutsummaryrefslogtreecommitdiffstats
path: root/include/linux/sysctl.h
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2005-11-04 05:18:40 -0500
committerLinus Torvalds <torvalds@g5.osdl.org>2005-11-08 20:57:30 -0500
commit330d57fb98a916fa8e1363846540dd420e99499a (patch)
tree841d5e5eeda46fd95ac03c36964919818a9bc3a6 /include/linux/sysctl.h
parent8546df6f357dadf1989ad8da9309c9524fd56cdf (diff)
[PATCH] Fix sysctl unregistration oops (CVE-2005-2709)
You could open the /proc/sys/net/ipv4/conf/<if>/<whatever> file, then wait for interface to go away, try to grab as much memory as possible in hope to hit the (kfreed) ctl_table. Then fill it with pointers to your function. Then do read from file you've opened and if you are lucky, you'll get it called as ->proc_handler() in kernel mode. So this is at least an Oops and possibly more. It does depend on an interface going away though, so less of a security risk than it would otherwise be. Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'include/linux/sysctl.h')
-rw-r--r--include/linux/sysctl.h3
1 files changed, 3 insertions, 0 deletions
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index fc8e367f671e..fc131d6602b9 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -24,6 +24,7 @@
24#include <linux/compiler.h> 24#include <linux/compiler.h>
25 25
26struct file; 26struct file;
27struct completion;
27 28
28#define CTL_MAXNAME 10 /* how many path components do we allow in a 29#define CTL_MAXNAME 10 /* how many path components do we allow in a
29 call to sysctl? In other words, what is 30 call to sysctl? In other words, what is
@@ -925,6 +926,8 @@ struct ctl_table_header
925{ 926{
926 ctl_table *ctl_table; 927 ctl_table *ctl_table;
927 struct list_head ctl_entry; 928 struct list_head ctl_entry;
929 int used;
930 struct completion *unregistering;
928}; 931};
929 932
930struct ctl_table_header * register_sysctl_table(ctl_table * table, 933struct ctl_table_header * register_sysctl_table(ctl_table * table,