Linux kernel do_brk() privilege escalation
Published:		02.12.2003
Source:		FULL-DISCLOSURE
SecurityVulns ID:		3289
Type:		local
Level:		8/10
Description:		Function may be used for allocation virtual memory exceeding user accessible memory limit, givin access to kernel internal structures.

Affected:

LINUX : kernel 2.4

Original document		Paul Starzetz, [Full-Disclosure] [iSEC] Linux kernel do_brk() lacks argument bound checking (02.12.2003)
		DEBIAN, [Full-Disclosure] [SECURITY] [DSA-403-1] userland can access Linux kernel memory (02.12.2003)

Files:		Linux kernel do_brk() proof-of-concept exploit code
		Linux kernel do_brk(), another proof-of-concept code for i386
Discuss:		Read or add your comments to this news (0 comments)