037314c9bc
to a memory-mapped file in the traced process's address space even if neither the traced process nor the tracing process had write access to that file. Security: CVE-2013-2171 Security: FreeBSD-SA-13:06.mmap Approved by: so
17 lines
559 B
Diff
17 lines
559 B
Diff
Index: sys/vm/vm_map.c
|
|
===================================================================
|
|
--- sys/vm/vm_map.c (revision 251636)
|
|
+++ sys/vm/vm_map.c (working copy)
|
|
@@ -3761,6 +3761,12 @@ RetryLookup:;
|
|
vm_map_unlock_read(map);
|
|
return (KERN_PROTECTION_FAILURE);
|
|
}
|
|
+ if ((fault_typea & VM_PROT_COPY) != 0 &&
|
|
+ (entry->max_protection & VM_PROT_WRITE) == 0 &&
|
|
+ (entry->eflags & MAP_ENTRY_COW) == 0) {
|
|
+ vm_map_unlock_read(map);
|
|
+ return (KERN_PROTECTION_FAILURE);
|
|
+ }
|
|
|
|
/*
|
|
* If this page is not pageable, we have to get it for all possible
|