Bug 250972 (CVE-2007-3848)

Reported by Vulnerability Research Labs, COSEINC PTE Ltd.

An unprivileged user may send arbitrary signal to a child process even
if it is running with higher privileges.

When a parent process dies or exits its child processes may receive a
signal.  Each child process may choose and set its own "parent process
death signal" using PR_SET_PDEATHSIG function of the prctl() system
call. 

        PARENT          CHILD
        ----------------------------------------------------------------
        fork()
                        prctl(PR_SET_PDEATHSIG)
        exit()'ed or killed
                        child receives the signal

The parent process death signal is not reset over execve() system call
and is inherited by spawned process:

        PARENT          CHILD
        ----------------------------------------------------------------
        fork()
                        prctl(PR_SET_PDEATHSIG)
                        execve("./a.out")
        exit()'ed or killed
                        child receives the signal

The signal gets delivered only if parent process has sufficient
privileges to send signals to child processes. Typically any child
process running with higher privilege than its parent will receive no
signal. 

        PARENT          CHILD
        ----------------------------------------------------------------
        fork()
                        prctl(PR_SET_PDEATHSIG)
                        execve("/bin/setuid-binary")
        exit()'ed or killed
                        child receives NO signal this time

However, above restriction may be bypassed if parent process execute
setuid-root binary which dies afterwards.

        PARENT          CHILD
        ----------------------------------------------------------------
        fork()
                        prctl(PR_SET_PDEATHSIG)
                        execve("/bin/setuid-binary")
        execve("/bin/setuid-binary")
        exit()'ed or killed
                        privileged process receives the signal