Re:Oss-sec: Linux kernel futex local privilege escalation (C...
by haberman on Thursday June 05, 2014 @05:23PM
(#7854629)
Nice. I didn't quite understand though:
> Specifically, the futex syscall can leave a queued kernel waiter hanging
on the stack. By manipulating the stack with further syscalls, the waiter
structure can be altered.
Is the bug that the waiter is left on the stack, or that other syscalls can alter the stack?
Allowing syscalls to alter the stack seems like a vulnerability regardless of what happens to be on the stack when it's altered.
Re:Oss-sec: Linux kernel futex local privilege escalation (C...
by dalias on Thursday June 05, 2014 @11:29PM
(#7856071)
Is there any proper information on this issue? The patches do not apply cleanly against the latest stable kernel (3.14.5) and there's no indication I can find as to what version they're intended to be applied to.
> Specifically, the futex syscall can leave a queued kernel waiter hanging on the stack. By manipulating the stack with further syscalls, the waiter structure can be altered.
Is the bug that the waiter is left on the stack, or that other syscalls can alter the stack?
Allowing syscalls to alter the stack seems like a vulnerability regardless of what happens to be on the stack when it's altered.