Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 2 Dec 2010 00:21:14 -0500
From: Nelson Elhage <>
Subject: kernel: Dangerous interaction between clear_child_tid, set_fs(),
 and kernel oopses

I've discovered an interesting interaction in the Linux kernel between the
clear_child_tid feature of clone(2), and the set_fs() function used internally
in the kernel to temporarily disable access_ok() checking of userspace pointers.

Under some (not totally uncommon) circumstances, it is possible for a user to
leverage this interaction to turn a kernel oops or BUG() into a write of an
integer 0 to a user-controlled address in kernel memory.

I'm not sure if this merits a CVE or not; It is (as far as I can tell) only a
problem in the presence of another security bug, but it potentially makes a
large class of bugs significantly more dangerous (DoS -> privesc).


- Nelson

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.