Userspace Writes to Swap Files Blocked

userspace writes to swap files blocked From the department of “how did this go unnoticed for so long?”, Darrick J. Wong fixed the kernel to not allow writes from userspace to active swap files. Without this, it was possible for a user (usually root) with write access to a swap file to modify its contents, thereby changing memory contents of a process once it got paged back in. While root normally could just use CAP_PTRACE to modify a running process directly, this was a loophole that allowed lesser-privileged users (e.g. anyone in the “disk” group) without the needed capabilities to still bypass ptrace restrictions.

A screenshot of a technical Linux security write-up explains that userspace writes to active swap files were blocked. The joke is the highlighted reaction “how did this go unnoticed for so long?”, pointing out an absurdly long-standing kernel security loophole that let users alter a process’s memory through its swap file.

• @infosecmemes / 191 2020-02-19