fix prctl privilege escalation and suid_dumpable (CVE-2006-2451)
Based on a patch from Ernie Petrides During security research, Red Hat discovered a behavioral flaw in core dump handling. A local user could create a program that would cause a core file to be dumped into a directory they would not normally have permissions to write to. This could lead to a denial of service (disk consumption), or allow the local user to gain root privileges. Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
+1
-1
@@ -1991,7 +1991,7 @@ asmlinkage long sys_prctl(int option, unsigned long arg2, unsigned long arg3,
|
||||
error = current->mm->dumpable;
|
||||
break;
|
||||
case PR_SET_DUMPABLE:
|
||||
if (arg2 < 0 || arg2 > 2) {
|
||||
if (arg2 < 0 || arg2 > 1) {
|
||||
error = -EINVAL;
|
||||
break;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user