Linux Kernel do_brk() Vulnerability

Overview

A critical security bug has been found in the Linux kernel 2.4.22 (and earlier) memory management subsystem. This bug has been silently fixed for the 2.4.23 as well as in the 2.6.0-test6 release without any notice to the open source community. While performing a regular audit of the Linux kernel the same bug was found at the end of September 2003 and quickly realized its serious impact on the kernel security. Shortly after the authors were ready with a simple proof-of-concept exploit code. This paper presents the technical details of the do_brk() bug found and the results the research done while writing the exploit code.