InfoSect's Month of Pointless Bugs (#16)

Dr Silvio Cesare

InfoSect, Canberra's hackerspace, regularly runs public group sessions to perform code review and vulnerability discovery. Over the next 30 days, I'll highlight the source code of 30 unknown vulnerabilities.

Bug #16

bsdgames/sail doesn't check dropping privs - see http://blog.infosectcbr.com.au/2018/02/infosects-month-of-pointless-bugs-3.html

E.g,

int
main(int argc, char **argv)
{
        char *p;
        int a,i;
        int fd;

        gid = getgid();
        egid = getegid();
        setegid(gid);

Comments

Popular posts from this blog

Linux Heap TCache Poisoning

Linux Heap glibc 2.27 Double Free Exploitation