A Security bug in Linux kernel

My morning started as usual, woke up at 7:30, turned the PC one, went to kitchen to bring some food and make coffee, then back to the PC to check emails, facebook, forums, and RSS. So one of the news reports was a Linux kernel bug that existed for about eight years! Can you imagine it?

So in short:

Linux kernel implements different sockets. Each socket have a struct assigned to it called proto_ops. The only thing this struct hold is pointers to implementation of different functions like bind, accept, and so on. Some might not implement one of the functions, in this case they should send a pointer to stub function. But even if the pointer left NULL, most of the times the kernel will validate that it is null.

So where is the bug? In function sock_sendpage(). This function does not validate the pointer and therefore can call for a NULL pointer. In this case an attacker can place a code at page 0 and the kernel will execute this code in SUPERVISOR mode!

I haven’t heard about any patch yet, but I’m sure that there will be one soon.