Leaking path for set_task_comm

Tong Zhang ztong at vt.edu
Tue Sep 25 17:27:08 UTC 2018


Kernel Version: 4.18.5

Problem Description:

When using prctl(PR_SET_NAME) to set the thread name, it is checked by security_task_prctl.

We discovered a leaking path that can also use method implemented in 
fs/proc/base.c:1526 comm_write(), to do similar thing without asking LSM’s decision.

- Tong



More information about the Linux-security-module-archive mailing list