Files
twx-linux/include/linux
Al Viro e4e0411221 [PATCH] CVE-2005-2709 sysctl unregistration oops
You could open the /proc/sys/net/ipv4/conf/<if>/<whatever> file, then
wait for interface to go away, try to grab as much memory as possible in
hope to hit the (kfreed) ctl_table.  Then fill it with pointers to your
function. Then do read from file you've opened and if you are lucky,
you'll get it called as ->proc_handler() in kernel mode.

So this is at least an Oops and possibly more.  It does depend on an
interface going away though, so less of a security risk than it would
otherwise be.

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2005-11-08 11:14:00 -08:00
..
2005-09-13 08:22:31 -07:00
2005-10-17 17:03:57 -07:00
2005-10-04 13:22:01 -07:00
2005-10-08 15:00:57 -07:00
2005-09-10 10:06:21 -07:00
2005-09-10 10:16:27 -07:00
2005-09-13 08:22:32 -07:00
2005-09-09 13:57:55 -07:00
2005-09-13 08:22:32 -07:00
2005-10-08 15:00:57 -07:00
2005-10-23 16:38:39 -07:00
2005-09-19 15:41:28 -07:00
2005-09-09 20:14:47 -05:00
2005-10-03 14:13:38 -07:00
2005-10-08 15:00:57 -07:00
2005-09-17 11:50:02 -07:00
2005-10-08 15:00:57 -07:00
2005-10-24 22:16:38 +01:00
2005-09-13 08:22:31 -07:00
2005-09-09 13:57:54 -07:00
2005-10-08 15:00:57 -07:00
2005-09-10 10:06:21 -07:00
2005-09-10 10:06:21 -07:00
2005-10-08 15:00:57 -07:00
2005-09-18 00:18:32 -07:00
2005-09-10 10:06:36 -07:00
2005-09-09 13:57:58 -07:00
2005-10-08 15:00:57 -07:00