buffer overflow vulnerability

最新推荐文章于 2021-12-05 11:33:37 发布

siuyang

最新推荐文章于 2021-12-05 11:33:37 发布

阅读量522

点赞数

文章标签： vulnerability buffer overflow linux

本文链接：https://blog.csdn.net/siuyang/article/details/38312305

版权

CVE-2013-4512

Overview: Buffer overflow in the exitcode_proc_write function in arch/um/kernel/exitcode.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact by leveraging root privileges for a write operation.

cause：                                                                                                                    We don't cap the size of buffer from the user so we could write past the
end of the array here.  Only root can write to this file.

source code:

const char __user *buffer, size_t count, loff_t *pos)
{
	char *end, buf[sizeof("nnnnn\0")];
	size_t size;
	int tmp;

	//buffer overflow occurred without the statement
	size = min(count, sizeof(buf));  
	if (copy_from_user(buf, buffer, size))
		return -EFAULT;

	tmp = simple_strtol(buf, &end, 0);
	if ((*end != '\0') && !isspace(*end))
		return -EINVAL;

	uml_exitcode = tmp;
	return count;
}