diff options
| author | des <des@FreeBSD.org> | 2013-06-18 07:02:35 +0000 |
|---|---|---|
| committer | des <des@FreeBSD.org> | 2013-06-18 07:02:35 +0000 |
| commit | f5b61fedc22097e0cad65f9e709c47367c42d22a (patch) | |
| tree | 128a935a2ea1cc348d2df9fe239a666ee16d9f5d /sys/vm/vm_map.c | |
| parent | 4d601c587e46dd558eb1f9adc278ec81d0810c8a (diff) | |
| download | FreeBSD-src-f5b61fedc22097e0cad65f9e709c47367c42d22a.zip FreeBSD-src-f5b61fedc22097e0cad65f9e709c47367c42d22a.tar.gz | |
Fix a bug that allowed a tracing process (e.g. gdb) to write
to a memory-mapped file in the traced process's address space
even if neither the traced process nor the tracing process had
write access to that file.
Security: CVE-2013-2171
Security: FreeBSD-SA-13:06.mmap
Approved by: so
Diffstat (limited to 'sys/vm/vm_map.c')
| -rw-r--r-- | sys/vm/vm_map.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/sys/vm/vm_map.c b/sys/vm/vm_map.c index a9ae803..1fee839 100644 --- a/sys/vm/vm_map.c +++ b/sys/vm/vm_map.c @@ -3807,6 +3807,12 @@ RetryLookup:; vm_map_unlock_read(map); return (KERN_PROTECTION_FAILURE); } + if ((fault_typea & VM_PROT_COPY) != 0 && + (entry->max_protection & VM_PROT_WRITE) == 0 && + (entry->eflags & MAP_ENTRY_COW) == 0) { + vm_map_unlock_read(map); + return (KERN_PROTECTION_FAILURE); + } /* * If this page is not pageable, we have to get it for all possible |
