Red Hat Bugzilla – Bug 1534893
RHEL7: util-linux: mount/unmount ASLR bypass via environment variable in libmount
Last modified: 2018-04-10 13:28:02 EDT
+++ This bug was initially created as a clone of Bug #1534076 +++ Debugging of libmount can be activated, also in SUID binaries, thus spilling out the heap addresses. This allows to create a local domain socket with only 4k buffer size, fill it up until writes are blocking and then start umount with that socket as stdout. This allows race-free reading of the address output before umount accesses other user-controlled resource. Thus any error during the downstream procedure creating some kind of write-where vulnerability will always find the correct target. References: https://www.spinics.net/lists/util-linux-ng/msg14978.html --- Additional comment from Laura Pardo on 2018-01-12 19:14:03 EST --- Created util-linux tracking bugs for this issue: Affects: fedora-all [bug 1534077]
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0936