The exploit allow local users to gain root access using a “proof of concept” exploit. The exploit worked on my machine (Kernel 2.6.22-gentoo-r2).
The bug report:
And here’s a working patch:
--- a/fs/splice.c +++ b/fs/splice.c @@ -1234,7 +1234,7 @@ static int get_iovec_page_array(const struct iovec __user *iov, if (unlikely(!len)) break; error = -EFAULT; - if (unlikely(!base)) + if (!access_ok(VERIFY_READ, base, len)) break; /*

























Leave a Reply