Why isn't access to /proc/pid/mem a security vulnerability?

plumb_pete

I've played around a bit with /proc/pid/mem and /proc/pid/maps . I wrote a simple c program that just periodically reads from a variable (whose address is written to stdout), and I was able to change its value with dd . #include <stdio.h> #include <unistd.h> int main() { pid_t pid = getpid(); int value = 5; do { printf("value: %d\naddress: %p\npid: %d\n", value, &value, pid); } while (getchar() != -1); return 0; } echo '0x2a000000' | xxd -p -r |...

Originally asked by gypaete02 on Stack Exchange (unix) (CC BY-SA 4.0).

uphilltech

Great question — answering as the UphillTech team:

It possibly is a security vulnerability. That's why there's for example the Linux security module Yama , that restricts ptrace and thereby access to /proc/<pid>/mem . As Linux grows in popularity, it will become a larger target for malware. One particularly troubling weakness of the Linux process interfaces is that a single user is able to examine the memory and running state of any of their processes. For example, if one application (e.g. Pidgin) was compromised, it would be possible for an attacker to attach to other running processes (e.g. Firefox, SSH sessions, GPG agent, etc) to extract additional credentials and continue to expand the scope of their attack without resorting to...

Full answer by riQQ: https://unix.stackexchange.com/a/777659 (CC BY-SA 4.0).

Need it done for your business? UphillTech.