Red Hat Bugzilla – Bug 190074
CVE-2006-2071 mprotect gives write permission to a readonly attachment
Last modified: 2007-11-30 17:07:09 EST
All of 2.4 and 2.6 kernels have been letting mprotect give write permission to a
readonly attachment of shared memory, whether or not IPC would give the caller
SUS says "The behaviour of this function [mprotect] is unspecified if the
mapping was not established by a call to mmap", but I don't think we can
interpret that as allowing it to subvert IPC permissions.
The upstream fix can be found here:
This is _not_ CVE-2006-1524. The commit message of the upstream fix is wrong.
Fix posted for internal review on 31-Jul-2006.
A fix for this problem has just been committed to the RHEL3 U9
patch pool this evening (in kernel version 2.4.21-47.1.EL).
A fix for this problem has also been committed to the RHEL3 E9
patch pool this evening (in kernel version 2.4.21-47.0.1.EL).
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.