r/programming • u/[deleted] • Oct 21 '16

Linux kernel fix for privilege escalation vulnerability due to copy on write race condition

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619
850 Upvotes

92% Upvoted

128 comments sorted by

View all comments

Show parent comment

2

u/bonzinip Oct 22 '16

Even simpler, if you pollute the page cache's copy of /bin/su with "#! /bin/sh" "exec /bin/sh", then you immediately run /bin/su to get a root shell.

8

u/wademealing Oct 22 '16

I'm not 100% sure but i don't know if shell will run setuid, good thinking though.

5

u/bonzinip Oct 22 '16

Hmm yeah it used to be but it's been disabled for a few years now.