This is the mail archive of the
glibc-bugs@sourceware.org
mailing list for the glibc project.
[Bug libc/15763] New: shm_open/unlink let you write outside SHMDIR
- From: "corbellini.andrea at gmail dot com" <sourceware-bugzilla at sourceware dot org>
- To: glibc-bugs at sourceware dot org
- Date: Sat, 20 Jul 2013 10:53:33 +0000
- Subject: [Bug libc/15763] New: shm_open/unlink let you write outside SHMDIR
- Auto-submitted: auto-generated
http://sourceware.org/bugzilla/show_bug.cgi?id=15763
Bug ID: 15763
Summary: shm_open/unlink let you write outside SHMDIR
Product: glibc
Version: 2.18
Status: NEW
Severity: normal
Priority: P2
Component: libc
Assignee: unassigned at sourceware dot org
Reporter: corbellini.andrea at gmail dot com
CC: drepper.fsp at gmail dot com
shm_open() and shm_unlink() accept relative paths. As the test case below
demonstrates, if you give a relative path to shm_open, you will be able to open
files anywhere in the system (assuming that you have the right permissions).
Test case:
#include <fcntl.h>
int main (void)
{
shm_open ("../../tmp/abc", O_CREAT | O_RDWR, 0666);
perror ("shm_open");
}
Expected output:
shm_open: Invalid argument
Actual output:
shm_open: Success
--
You are receiving this mail because:
You are on the CC list for the bug.