On Sat, Jun 23, 2012 at 4:21 PM, Eric W. Biederman <ebiederm@xxxxxxxxxxxx> wrote: > Kees Cook <keescook@xxxxxxxxxxxx> writes: > >> When the suid_dumpable sysctl is set to "2", and there is no core >> dump pipe defined in the core_pattern sysctl, a local user can cause >> core files to be written to root-writable directories, potentially >> with user-controlled content. This means an admin can unknowningly >> reintroduce a variation of CVE-2006-2451, allowing local users to gain >> root privileges. > > Is there a security exploit possible if a path is defined in the > core_pattern? > > From the description of the problem so far I don't think there is. > Requiring a program when a simple path will do seems excessive. Having a fully qualified path would be sufficient, yes. Looking at how %e and %E are handled, I'm satisfied (for example, no additional "/" characters can be injected via argv0). In this case, then, I'll adjust this to require either a pipe or a fully qualified core_pattern (i.e. core_pattern must start with "!" or "/" for mode 2). How does that sound? -Kees -- Kees Cook Chrome OS Security -- To unsubscribe from this list: send the line "unsubscribe linux-doc" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
