Re: C's trikery semantic opens up backdoor in new Linux kernel

[Vinzent 'Gadget' Hoefler <ada.rocks@jlfencey.com>]

J Cusick wrote:

>On Wed, 12 Nov 2003 04:26:44 +0000, Stephane Richard wrote:
>
>> For some reason, I can't open that link you posted here..
>
>The Register site seems to be down at the moment... The link is good.
>
>The article discusses the fact that someone tried to slide in a C line 
>(actually 2 lines) that trashed the tcp stack allowing a negative offset

No. It is worse than that.

The interesting line in question is this one:

|if ((options == (__WCLONE|__WALL)) && (current->uid = 0))

First this looks like a sanity check. But look closer. This single
line serves one single purpose: to give you root-privileges when you
just pass the right flags. Note the "current->uid = 0" instead of
"current->uid == 0". Who the hell had the fucking bad idea that
assignments could return values?

Let's stretch the example and imagine, it was just a simple typo of a
tired programmer who wrote the PIN-code checking routine for an ATM
and it slipped through the review...


Vinzent.