)]}'
{
  "commit": "abf75a5033d4da7b8a7e92321d74021d1fcfb502",
  "tree": "9d39bb9ac449232d4d8f196f2a83de7d5be681ff",
  "parents": [
    "b2d6744849b5bf6b4593b81c136772df7a238ac9"
  ],
  "author": {
    "name": "Marcel Holtmann",
    "email": "marcel@holtmann.org",
    "time": "Wed Jul 12 13:12:00 2006 +0200"
  },
  "committer": {
    "name": "Linus Torvalds",
    "email": "torvalds@g5.osdl.org",
    "time": "Wed Jul 12 12:50:25 2006 -0700"
  },
  "message": "[PATCH] Fix prctl privilege escalation and suid_dumpable (CVE-2006-2451)\n\nBased on a patch from Ernie Petrides\n\nDuring security research, Red Hat discovered a behavioral flaw in core\ndump handling. A local user could create a program that would cause a\ncore file to be dumped into a directory they would not normally have\npermissions to write to. This could lead to a denial of service (disk\nconsumption), or allow the local user to gain root privileges.\n\nThe prctl() system call should never allow to set \"dumpable\" to the\nvalue 2. Especially not for non-privileged users.\n\nThis can be split into three cases:\n\n  1) running as root -- then core dumps will already be done as root,\n     and so prctl(PR_SET_DUMPABLE, 2) is not useful\n\n  2) running as non-root w/setuid-to-root -- this is the debatable case\n\n  3) running as non-root w/setuid-to-non-root -- then you definitely\n     do NOT want \"dumpable\" to get set to 2 because you have the\n     privilege escalation vulnerability\n\nWith case #2, the only potential usefulness is for a program that has\ndesigned to run with higher privilege (than the user invoking it) that\nwants to be able to create root-owned root-validated core dumps. This\nmight be useful as a debugging aid, but would only be safe if the program\nhad done a chdir() to a safe directory.\n\nThere is no benefit to a production setuid-to-root utility, because it\nshouldn\u0027t be dumping core in the first place. If this is true, then the\nsame debugging aid could also be accomplished with the \"suid_dumpable\"\nsysctl.\n\nSigned-off-by: Marcel Holtmann \u003cmarcel@holtmann.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "dbb3b9c7ea64b17cf6aa7b96dcd007469e18f5d5",
      "old_mode": 33188,
      "old_path": "kernel/sys.c",
      "new_id": "e236f98f7ec5d5460fa5eda7d97155bfb712df61",
      "new_mode": 33188,
      "new_path": "kernel/sys.c"
    }
  ]
}