Linux io_submit L2TP Sendmsg Integer Overflow
Posted by deepcore on February 25, 2016 – 9:51 am
In certain kernel versions it is possible to use the AIO subsystem (io_submit syscall) to pass size values larger than MAX_RW_COUNT to the networking subsystem’s sendmsg implementation. In the L2TP PPP sendmsg implementation, a large size parameter can lead to an integer overflow and kernel heap corruption during socket buffer allocation. This could be exploited to allow local privilege escalation from an unprivileged user account.
Post a reply
You must be logged in to post a comment.