From: Al Viro Date: Fri, 4 Nov 2005 10:18:40 +0000 (+0000) Subject: [PATCH] Fix sysctl unregistration oops (CVE-2005-2709) X-Git-Tag: v2.6.15-rc1~401 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=330d57fb98a916fa8e1363846540dd420e99499a;p=pandora-kernel.git [PATCH] Fix sysctl unregistration oops (CVE-2005-2709) You could open the /proc/sys/net/ipv4/conf// file, then wait for interface to go away, try to grab as much memory as possible in hope to hit the (kfreed) ctl_table. Then fill it with pointers to your function. Then do read from file you've opened and if you are lucky, you'll get it called as ->proc_handler() in kernel mode. So this is at least an Oops and possibly more. It does depend on an interface going away though, so less of a security risk than it would otherwise be. Signed-off-by: Greg Kroah-Hartman Signed-off-by: Linus Torvalds --- Reading git-diff-tree failed