037f750877
The set_robust_list system call request the kernel to record the head of the list of robust futexes owned by the calling thread. The head argument is the list head to record. The get_robust_list system call should return the head of the robust list of the thread whose thread id is specified in pid argument. The list head should be stored in the location pointed to by head argument. In contrast, our implemenattion of get_robust_list system call copies the known portion of memory pointed by recorded in set_robust_list system call pointer to the head of the robust list to the location pointed by head argument. So, it is possible for a local attacker to read portions of kernel memory, which may result in a privilege escalation. Submitted by: mjg Security: SA-16:03.linux |
||
|---|---|---|
| .. | ||
| linux_dummy.c | ||
| linux_genassym.c | ||
| linux_ipc64.h | ||
| linux_locore.s | ||
| linux_machdep.c | ||
| linux_proto.h | ||
| linux_support.s | ||
| linux_syscall.h | ||
| linux_syscalls.c | ||
| linux_sysent.c | ||
| linux_systrace_args.c | ||
| linux_sysvec.c | ||
| linux_vdso.lds.s | ||
| linux.h | ||
| Makefile | ||
| syscalls.conf | ||
| syscalls.master | ||