Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20130108065321.GA5525@cachalot>
Date: Tue, 8 Jan 2013 10:53:21 +0400
From: Vasily Kulikov <segoon@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: /dev/ptmx timing

On Tue, Jan 08, 2013 at 06:43 +0400, Dmitry V. Levin wrote:
> On Mon, Jan 07, 2013 at 08:11:11PM -0500, adam swanda wrote:
> > Don't you need to be running as root for this to be possible?
> 
> You certainly haven't followed the link listed below, have you?
> 
> The elegance of this timing attack is that all you need is
> inotify_add_watch(fd, "/dev/ptmx", IN_MODIFY)
> which is usually available to everybody who has read access to /dev/ptmx.

FWIW, more harmless ways to (ab)use inotify were posted to ossec 2
years ago:

http://www.openwall.com/lists/kernel-hardening/2011/07/22/1

Thanks,

-- 
Vasily Kulikov
http://www.openwall.com - bringing security into open computing environments

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.