Andreas Kling 37d8faf1b4 ProcFS: Fix /proc/PID/* hardening bypass ...

This enabled trivial ASLR bypass for non-dumpable programs by simply
opening /proc/PID/vm before exec'ing.

We now hold the target process's ptrace lock across the refresh/write
operations, and deny access if the process is non-dumpable. The lock
is necessary to prevent a TOCTOU race on Process::is_dumpable() while
the target is exec'ing.

Fixes #5270.

2021-02-19 09:46:36 +01:00

59 KiB

Raw Blame History

View Raw