A SetUID-root utility with an unchecked copy

Answer

/* installed -rwsr-xr-x root root */ int main(int argc, char *argv[]) { char path[64]; strcpy(path, argv[1]); /* argv[1] is attacker-chosen */ return spool(path); }

The bug is one line, and it is the same bug as in an unprivileged program. What makes it a compromise is the permission bits on the file: the kernel starts this process with effective UID 0, and anything the overflow causes to run inherits that.

Stallings & Brown 5e ch10 §10.1, §10.3–10.4