Red Hat Bugzilla – Bug 190077
CVE-2006-2071 mprotect gives write permission to a readonly attachment
Last modified: 2007-11-30 17:06:55 EST
All of 2.4 and 2.6 kernels have been letting mprotect give write permission to a
readonly attachment of shared memory, whether or not IPC would give the caller
SUS says "The behaviour of this function [mprotect] is unspecified if the
mapping was not established by a call to mmap", but I don't think we can
interpret that as allowing it to subvert IPC permissions.
The upstream fix can be found here:
This is _not_ CVE-2006-1524. The commit message of the upstream fix is wrong.
Created attachment 132028 [details]
Testcase for shmat/mprotect bug. Test should fail with -EPERM.
Fix looks good:
.qa.[root@ia64-21as-bos root]# ./maywrite
shm segment attached at 0x300000
mprotect() failed: Permission denied
.qa.[root@ia64-21as-bos root]# echo $?
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.