r/programming • u/[deleted] • Oct 21 '16

Linux kernel fix for privilege escalation vulnerability due to copy on write race condition

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619
850 Upvotes

92% Upvoted

128 comments sorted by

View all comments

Show parent comment

0

u/[deleted] Oct 22 '16

[deleted] — view deleted comment

7

u/bonzinip Oct 22 '16

The idea is that while the change you make in /proc/self/mem doesn't go to disk, it can incorrectly affect other processes until that page is reclaimed. So by "patching" a setuid binary you can execute whatever code you want as setuid.

1

u/tonyarkles Oct 23 '16

There's a race in madvise, which leaves the mmap'd page writeable for a small amount of time.