Linux mincore() Kernel Heap Page Disclosure
Posted by deepcore on November 25, 2017 – 10:21 pm
Linux mincore() discloses uninitialized kernel heap pages. When __walk_page_range() is used on a VM_HUGETLB VMA, callbacks from the mm_walk structure are only invoked for present pages. However, do_mincore() assumes that it will always get callbacks for all pages in the range passed to walk_page_range(), and when this assumption is violated, sys_mincore() copies uninitialized memory from the page allocator to userspace.
Post a reply
You must be logged in to post a comment.