lkml.org 
[lkml]   [1999]   [Jul]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subject[security]: kernel ioctl()'s

Hi,

I've started looking at what damage a user can cause with ioctl() - a
disgusting sprawling kernel interface if ever I saw one :-)

My first "find" is FIBMAP, an ioctl available on regular files. FIBMAP
will happily pass out of range blocks to lower level filesystems. In the
case of ext2, a user can easily get the kernel to emit copious
ext2_warning messages. Hardly an ideal situation. As a rule kernel printk
warnings should be used for ASSERT events not "any user can cause at will"
events.

I didn't audit how other filesystems behave when passed random block
indexes but I guarantee some of them won't be happy.

In fact, the program below, operating on a 0 length file, rendered my
machine useless as a non-root user. Note however that this is kernel
2.2.5, so the actual crash could well have been due to the sheer volume of
printk()'s triggering a race in printk() and/or the console driver. Takes
30s or so to get going :-)

Is FIBMAP used by anything? It would seem to me to be offering users
read access to internal filesystem structures - and as such should be
restricted to root (CAP_SYS_ADMIN or something).

Cheers
Chris

#include <unistd.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/ioctl.h>

#include <linux/fs.h>

int
main(int argc, char* const argv[])
{
int fd;
int block;

fd = open("testfile", O_RDWR);

for (block = 0; block < 1024*1024*1024; block++)
{
int val = block;
ioctl(fd, FIBMAP, &val);
}
}



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:52    [W:1.067 / U:0.616 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site