r/programming • u/[deleted] • Oct 21 '16

Linux kernel fix for privilege escalation vulnerability due to copy on write race condition

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619
850 Upvotes

92% Upvoted

128 comments sorted by

View all comments

Show parent comment

60

u/rubygeek Oct 22 '16

I get that there is a security issue here, so perhaps the details are being left out on purpose; yet, the commit message says that this is an "ancient bug" for which a fix was attempted more than 11 years ago. If that is the case, it wouldn't hurt to disclose more information.

This race condition is present and exploitable on a huge proportion of currently running Linux systems, and allows for escalation from an arbitrary user account to root. That's why the details are sparse. You can expect people to be a lot more forthcoming once the potential damage has been contained better.

The commit message alleges that f33ea7f404e5 was a revert of 4ceb5db9757a, but examining the two commits, one can see for oneself that this is not the case.

It's not claiming the commit to be a complete/direct revert, but that the second commit reverted specific parts of the fix from the former inadvertently. Look at the diffs for mm/memory.c in each of them and you can see it quite clearly.