Fixing Linux

[ Thanks to Steven J. Vaughan-Nichols for this link. ]

"What he found was that in some network code, there was a procedure that included a variable that could be set to NULL (no value at all). Now, this didn't appear to be a problem because the programmer also included a test which would return an error-message if the variable turned out to have a NULL value.

"So far, so good. Unfortunately, the gcc code optimizer on finding that a variable has been assigned a NULL value removed the test! This left a hole, that didn't exist in the original program. Using this hole, and code provided by Spengler, any cracker with sufficient access to a Linux computer could get into the computer's memory and, from there, get into all kinds of mischief."

Complete Story

Related Stories:

• Torvalds bashes vendor-sec private Linux security list(Aug 17, 2009)
• Linux NULL pointer dereference due to incorrect proto_ops initializations(Aug 14, 2009)
• Fun with NULL pointers, part 2(Jul 31, 2009)
• Fun with NULL pointers, part 1(Jul 31, 2009)
• A Linux security story(Jul 17, 2009)