From: Chris Wright <chrisw@sous-sol.org>
To: Dave Jones <davej@codemonkey.org.uk>,
Andrew Morgan <morgan@kernel.org>,
Linux Kernel <linux-kernel@vger.kernel.org>,
bojan@rexursive.com
Subject: Re: capget() overflows buffers.
Date: Thu, 22 May 2008 10:58:03 -0700 [thread overview]
Message-ID: <20080522175744.GE4018@sequoia.sous-sol.org> (raw)
In-Reply-To: <20080522140402.GB2071@codemonkey.org.uk>
* Dave Jones (davej@codemonkey.org.uk) wrote:
> We had a user file a bug report recently that sys_capget is overflowing
> a user buffer.
>
> More details and test program are available at
> https://bugzilla.redhat.com/show_bug.cgi?id=447518
>
> The only recent change in this area was e338d263a76af78fe8f38a72131188b58fceb591
> "Add 64-bit capability support to the kernel".
Yes, this thing is broken.
Trouble is, it's expecting an array of 2, and getting an array of 1.
The userspace fix is to do this (note, this does not fix the fact that
the ABI is broken, it's so opaque that it's difficult to follow).
cap_user_data_t data=malloc(sizeof(*data)*_LINUX_CAPABILITY_U32S);
Bojan, is there a capset involved as well, because that will pull in
garbage and set caps accordingly?
next prev parent reply other threads:[~2008-05-22 17:58 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-05-22 14:04 Dave Jones
2008-05-22 17:58 ` Chris Wright [this message]
2008-05-22 20:53 ` Chris Wright
2008-05-22 22:52 ` Andrew G. Morgan
2008-05-22 23:37 ` Chris Wright
2008-05-23 7:09 ` Andrew G. Morgan
2008-05-23 15:57 ` Chris Wright
2008-05-24 6:25 ` Andrew G. Morgan
2008-05-24 8:07 ` Chris Wright
2008-05-27 1:17 ` [PATCH] security: was "Re: capget() overflows buffers." Andrew G. Morgan
2008-05-27 21:42 ` Chris Wright
2008-05-28 3:33 ` Andrew Morton
2008-05-23 18:26 ` capget() overflows buffers Chris Wright
2008-05-24 0:02 ` Andrew G. Morgan
2008-05-24 1:09 ` Chris Wright
2008-05-24 4:40 ` Andrew G. Morgan
2008-05-24 8:17 ` Chris Wright
2008-05-23 1:20 ` Bojan Smojver
2008-05-23 2:06 ` Chris Wright
2008-05-23 4:01 ` Bojan Smojver
2008-05-22 21:20 ` Bojan Smojver
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20080522175744.GE4018@sequoia.sous-sol.org \
--to=chrisw@sous-sol.org \
--cc=bojan@rexursive.com \
--cc=davej@codemonkey.org.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=morgan@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome