lkml.org 
[lkml]   [1999]   [Feb]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subjectsys_set*id confusion in 2.2.0

Hi,

I was testing the kernel 2.2.0 then I saw that old sys_set*id bug.
Why this isnt patched? If a user have id 131072 is a root. Can be used to
hide root users. This bug was found by Michael Zalewski some time ago and
I port his patch to 2.2.0, Im attaching in the message.


--
Augusto Cesar
Sekure SDI

bishop@sekure.org
pgp key at: http://bishop.sekure.org/bishop.key
http://www.sekure.org
diff -ru linux.orig/kernel/sys.c linux/kernel/sys.c
--- linux.orig/kernel/sys.c Thu Feb 4 17:52:39 1999
+++ linux/kernel/sys.c Thu Feb 4 18:01:45 1999
@@ -256,6 +256,8 @@
int old_rgid = current->gid;
int old_egid = current->egid;

+ if (rgid>0xffff || egid>0xffff) return -EINVAL;
+
if (rgid != (gid_t) -1) {
if ((old_rgid == rgid) ||
(current->egid==rgid) ||
@@ -293,6 +295,8 @@
{
int old_egid = current->egid;

+ if (gid>0xffff) return -EINVAL;
+
if (capable(CAP_SETGID))
current->gid = current->egid = current->sgid = current->fsgid = gid;
else if ((gid == current->gid) || (gid == current->sgid))
@@ -359,6 +363,8 @@
{
int old_ruid, old_euid, old_suid, new_ruid;

+ if (ruid>0xffff || euid>0xffff) return -EINVAL;
+
new_ruid = old_ruid = current->uid;
old_euid = current->euid;
old_suid = current->suid;
@@ -422,6 +428,8 @@
int old_euid = current->euid;
int old_ruid, old_suid, new_ruid;

+ if (uid>0xffff) return -EINVAL;
+
old_ruid = new_ruid = current->uid;
old_suid = current->suid;
if (capable(CAP_SETUID))
@@ -459,6 +467,8 @@
int old_euid = current->euid;
int old_suid = current->suid;

+ if (ruid>0xffff || euid>0xffff || suid>0xffff) return -EINVAL;
+
if (!capable(CAP_SETUID)) {
if ((ruid != (uid_t) -1) && (ruid != current->uid) &&
(ruid != current->euid) && (ruid != current->suid))
@@ -508,6 +518,8 @@
*/
asmlinkage int sys_setresgid(gid_t rgid, gid_t egid, gid_t sgid)
{
+ if (rgid>0xffff || egid>0xffff || sgid>0xffff) return -EINVAL;
+
if (!capable(CAP_SETGID)) {
if ((rgid != (gid_t) -1) && (rgid != current->gid) &&
(rgid != current->egid) && (rgid != current->sgid))
@@ -554,6 +566,8 @@
{
int old_fsuid;

+ if (uid>0xffff) return -EINVAL;
+
old_fsuid = current->fsuid;
if (uid == current->uid || uid == current->euid ||
uid == current->suid || uid == current->fsuid ||
@@ -591,6 +605,8 @@
{
int old_fsgid;

+ if (gid>0xffff) return -EINVAL;
+
old_fsgid = current->fsgid;
if (gid == current->gid || gid == current->egid ||
gid == current->sgid || gid == current->fsgid ||
@@ -634,6 +650,8 @@
struct task_struct * p;
int err = -EINVAL;

+ if (pid>0xffff || pgid>0xffff) return -EINVAL;
+
if (!pid)
pid = current->pid;
if (!pgid)
\
 
 \ /
  Last update: 2005-03-22 13:50    [W:0.054 / U:0.764 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site