)]}'
{
  "commit": "f9fabcb58a6d26d6efde842d1703ac7cfa9427b6",
  "tree": "3bab868d1db85521932b77897983e7c673f7a669",
  "parents": [
    "a137802ee839ace40079bebde24cfb416f73208a"
  ],
  "author": {
    "name": "Julien Tinnes",
    "email": "jt@cr0.org",
    "time": "Fri Jun 26 20:27:40 2009 +0200"
  },
  "committer": {
    "name": "Linus Torvalds",
    "email": "torvalds@linux-foundation.org",
    "time": "Sun Jul 12 12:21:33 2009 -0700"
  },
  "message": "personality: fix PER_CLEAR_ON_SETID\n\nWe have found that the current PER_CLEAR_ON_SETID mask on Linux doesn\u0027t\ninclude neither ADDR_COMPAT_LAYOUT, nor MMAP_PAGE_ZERO.\n\nThe current mask is READ_IMPLIES_EXEC|ADDR_NO_RANDOMIZE.\n\nWe believe it is important to add MMAP_PAGE_ZERO, because by using this\npersonality it is possible to have the first page mapped inside a\nprocess running as setuid root.  This could be used in those scenarios:\n\n - Exploiting a NULL pointer dereference issue in a setuid root binary\n - Bypassing the mmap_min_addr restrictions of the Linux kernel: by\n   running a setuid binary that would drop privileges before giving us\n   control back (for instance by loading a user-supplied library), we\n   could get the first page mapped in a process we control.  By further\n   using mremap and mprotect on this mapping, we can then completely\n   bypass the mmap_min_addr restrictions.\n\nLess importantly, we believe ADDR_COMPAT_LAYOUT should also be added\nsince on x86 32bits it will in practice disable most of the address\nspace layout randomization (only the stack will remain randomized).\n\nSigned-off-by: Julien Tinnes \u003cjt@cr0.org\u003e\nSigned-off-by: Tavis Ormandy \u003ctaviso@sdf.lonestar.org\u003e\nCc: stable@kernel.org\nAcked-by: Christoph Hellwig \u003chch@infradead.org\u003e\nAcked-by: Kees Cook \u003ckees@ubuntu.com\u003e\nAcked-by: Eugene Teo \u003ceugene@redhat.com\u003e\n[ Shortened lines and fixed whitespace as per Christophs\u0027 suggestion ]\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "a84e9ff9b27e9d59cfd1f2d0e8b3403e21b07ca0",
      "old_mode": 33188,
      "old_path": "include/linux/personality.h",
      "new_id": "126120819a0dba4aeb931094094c27d3d80f9aa0",
      "new_mode": 33188,
      "new_path": "include/linux/personality.h"
    }
  ]
}