Messages in this thread Patch in this message | | | Date | Thu, 4 Feb 1999 20:12:30 -0200 (EDT) | From | Augusto Cesar <> | Subject | sys_set*id confusion in 2.2.0 |
| |
Hi,
I was testing the kernel 2.2.0 then I saw that old sys_set*id bug. Why this isnt patched? If a user have id 131072 is a root. Can be used to hide root users. This bug was found by Michael Zalewski some time ago and I port his patch to 2.2.0, Im attaching in the message.
-- Augusto Cesar Sekure SDI
bishop@sekure.org pgp key at: http://bishop.sekure.org/bishop.key http://www.sekure.org diff -ru linux.orig/kernel/sys.c linux/kernel/sys.c --- linux.orig/kernel/sys.c Thu Feb 4 17:52:39 1999 +++ linux/kernel/sys.c Thu Feb 4 18:01:45 1999 @@ -256,6 +256,8 @@ int old_rgid = current->gid; int old_egid = current->egid; + if (rgid>0xffff || egid>0xffff) return -EINVAL; + if (rgid != (gid_t) -1) { if ((old_rgid == rgid) || (current->egid==rgid) || @@ -293,6 +295,8 @@ { int old_egid = current->egid; + if (gid>0xffff) return -EINVAL; + if (capable(CAP_SETGID)) current->gid = current->egid = current->sgid = current->fsgid = gid; else if ((gid == current->gid) || (gid == current->sgid)) @@ -359,6 +363,8 @@ { int old_ruid, old_euid, old_suid, new_ruid; + if (ruid>0xffff || euid>0xffff) return -EINVAL; + new_ruid = old_ruid = current->uid; old_euid = current->euid; old_suid = current->suid; @@ -422,6 +428,8 @@ int old_euid = current->euid; int old_ruid, old_suid, new_ruid; + if (uid>0xffff) return -EINVAL; + old_ruid = new_ruid = current->uid; old_suid = current->suid; if (capable(CAP_SETUID)) @@ -459,6 +467,8 @@ int old_euid = current->euid; int old_suid = current->suid; + if (ruid>0xffff || euid>0xffff || suid>0xffff) return -EINVAL; + if (!capable(CAP_SETUID)) { if ((ruid != (uid_t) -1) && (ruid != current->uid) && (ruid != current->euid) && (ruid != current->suid)) @@ -508,6 +518,8 @@ */ asmlinkage int sys_setresgid(gid_t rgid, gid_t egid, gid_t sgid) { + if (rgid>0xffff || egid>0xffff || sgid>0xffff) return -EINVAL; + if (!capable(CAP_SETGID)) { if ((rgid != (gid_t) -1) && (rgid != current->gid) && (rgid != current->egid) && (rgid != current->sgid)) @@ -554,6 +566,8 @@ { int old_fsuid; + if (uid>0xffff) return -EINVAL; + old_fsuid = current->fsuid; if (uid == current->uid || uid == current->euid || uid == current->suid || uid == current->fsuid || @@ -591,6 +605,8 @@ { int old_fsgid; + if (gid>0xffff) return -EINVAL; + old_fsgid = current->fsgid; if (gid == current->gid || gid == current->egid || gid == current->sgid || gid == current->fsgid || @@ -634,6 +650,8 @@ struct task_struct * p; int err = -EINVAL; + if (pid>0xffff || pgid>0xffff) return -EINVAL; + if (!pid) pid = current->pid; if (!pgid)
| |