Al Viro 330d57fb98 [PATCH] Fix sysctl unregistration oops (CVE-2005-2709) ... You could open the /proc/sys/net/ipv4/conf/<if>/<whatever> file, then wait for interface to go away, try to grab as much memory as possible in hope to hit the (kfreed) ctl_table. Then fill it with pointers to your function. Then do read from file you've opened and if you are lucky, you'll get it called as ->proc_handler() in kernel mode. So this is at least an Oops and possibly more. It does depend on an interface going away though, so less of a security risk than it would otherwise be. Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Linus Torvalds <torvalds@osdl.org>		2005-11-08 17:57:30 -08:00
..
irq	[PATCH] more kernel-doc cleanups, additions	2005-11-07 07:53:55 -08:00
power	[PATCH] swsusp: remove unused variable	2005-11-07 07:53:29 -08:00
acct.c	[PATCH] saner handling of auto_acct_off() and DQUOT_OFF() in umount	2005-11-07 18:18:09 -08:00
audit.c	[PATCH] gfp_t: kernel/*	2005-10-28 08:16:49 -07:00
auditsc.c	[PATCH] gfp_t: kernel/*	2005-10-28 08:16:49 -07:00
capability.c
compat.c
configs.c
cpu.c	[PATCH] create and destroy cpufreq sysfs entries based on cpu notifiers	2005-10-30 17:37:14 -08:00
cpuset.c	[PATCH] cpusets: automatic numa mempolicy rebinding	2005-10-30 17:37:22 -08:00
crash_dump.c
dma.c
exec_domain.c
exit.c	[PATCH] Process Events Connector	2005-11-07 07:53:35 -08:00
extable.c
fork.c	[SPARC64] mm: context switch ptlock	2005-11-07 14:09:01 -08:00
futex.c	[PATCH] FUTEX_WAKE_OP: enhanced error handling	2005-11-07 07:53:38 -08:00
intermodule.c
itimer.c
kallsyms.c	[PATCH] fix missing includes	2005-10-30 17:37:32 -08:00
Kconfig.hz
Kconfig.preempt
kexec.c	[PATCH] mm: split page table lock	2005-10-29 21:40:42 -07:00
kfifo.c
kmod.c	[PATCH] Keys: Get rid of warning in kmod.c if keys disabled	2005-10-30 17:37:23 -08:00
kprobes.c	[PATCH] Kprobes: preempt_disable/enable() simplification	2005-11-07 07:53:46 -08:00
ksysfs.c
kthread.c	[PATCH] Add kthread_stop_sem()	2005-10-30 17:37:17 -08:00
Makefile	[PATCH] RCU torture-testing kernel module	2005-10-30 17:37:27 -08:00
module.c	[PATCH] fix remaining missing includes	2005-11-07 07:53:41 -08:00
panic.c
params.c	[PATCH] fix missing includes	2005-10-30 17:37:32 -08:00
pid.c
posix-cpu-timers.c	[PATCH] posix-timers `unlikely' rejig	2005-11-07 07:53:24 -08:00
posix-timers.c	[PATCH] posix-timers: use schedule_timeout() in common_nsleep()	2005-10-30 17:37:20 -08:00
printk.c	[PATCH] unexport console_unblank	2005-11-07 07:54:07 -08:00
profile.c
ptrace.c	[PATCH] consolidate sys_ptrace()	2005-11-07 07:53:42 -08:00
rcupdate.c	[PATCH] RCU torture-testing kernel module	2005-10-30 17:37:27 -08:00
rcutorture.c	[PATCH] RCU torture-testing kernel module	2005-10-30 17:37:27 -08:00
resource.c
sched.c	[PATCH] unexport idle_cpu	2005-11-07 07:54:07 -08:00
seccomp.c
signal.c	[PATCH] Remove duplicate code in signal.c	2005-10-30 17:37:32 -08:00
softirq.c	[PATCH] cpu hoptlug: avoid usage of smp_processor_id() in preemptible code	2005-11-07 07:53:29 -08:00
softlockup.c	[PATCH] cpu hoptlug: avoid usage of smp_processor_id() in preemptible code	2005-11-07 07:53:29 -08:00
spinlock.c
stop_machine.c
sys_ni.c
sys.c	[PATCH] unexport uts_sem	2005-11-07 07:54:07 -08:00
sysctl.c	[PATCH] Fix sysctl unregistration oops (CVE-2005-2709)	2005-11-08 17:57:30 -08:00
time.c	[PATCH] NTP shift_right cleanup	2005-10-30 17:37:18 -08:00
timer.c	[PATCH] jiffies_64 cleanup	2005-10-30 17:37:25 -08:00
uid16.c
user.c
wait.c
workqueue.c	[PATCH] cpu hoptlug: avoid usage of smp_processor_id() in preemptible code	2005-11-07 07:53:29 -08:00