BugTraq
CAN-2004-0814: Linux terminal layer races Oct 20 2004 10:43PM
Alan Cox (alan lxorguk ukuu org uk) (1 replies)
Re: CAN-2004-0814: Linux terminal layer races Oct 23 2004 05:03PM
Pavel Kankovsky (peak argo troja mff cuni cz)
On Wed, 20 Oct 2004, Alan Cox wrote:

> Firstly a user can cause crashes and other undefined behaviour by
> issuing a TIOCSETLD ioctl on a terminal interface while another thread

1. Did you mean TIOCSETD?
2. Sigh. TIOCSETD should have been restricted to root (+) since 1999. (*)

(*) Since the "user-rawip-attack" vuln reported by Marc Shaefer.
(+) Perhaps with some workaround to address the problem with processes
setting the ldisc, dropping the root, and being unable to restore ldisc
back to N_TTY when they exit.

--Pavel Kankovsky aka Peak [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus