Analysis and Exploitation of a Linux Kernel Vulnerability
perception-point.io
Analysis and Exploitation of a Linux Kernel Vulnerability
1–10 of 70 posts
Re: Analysis and Exploitation of a Linux Kernel Vulnerability
#2This vulnerability is a great advertisement for grsecurity/PaX, which mitigates it at the source of the issue thanks to PAX_REFCOUNT.
Re: Analysis and Exploitation of a Linux Kernel Vulnerability
#3Is there a reason that there's no overflow check on these refcounts? I suppose it's something like, these are hot paths in general and there's no good hardware support for atomic-increment-if-not-overflow?
Re: Analysis and Exploitation of a Linux Kernel Vulnerability
#4Well, the exploit doesn't seem to work on my kernel 4.1.0 system, so that's good.
Re: Analysis and Exploitation of a Linux Kernel Vulnerability
#5Well, the exploit doesn't seem to work on my kernel 4.1.0 system, so that's good.
Did you update the addresses of commit_creds() and prepare_kernel_cred() to match your running kernel before you compiled/ran it?
Re: Analysis and Exploitation of a Linux Kernel Vulnerability
#6The blog post specifically thanks the Red Hat Security Team, but according to the Red Hat Bugzilla, no patch has been released yet for RHEL/CentOS:
This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 7 and will be addressed in a future update.
https://bugzilla.redhat.com/show_bug.cgi?id=1297475
Premature blog post?
Re: Analysis and Exploitation of a Linux Kernel Vulnerability
#7This vulnerability is a great advertisement for grsecurity/PaX, which mitigates it at the source of the issue thanks to PAX_REFCOUNT.
Unfortunately no major distributions ship those patches by default.
Re: Analysis and Exploitation of a Linux Kernel Vulnerability
#8This vulnerability is a great advertisement for grsecurity/PaX, which mitigates it at the source of the issue thanks to PAX_REFCOUNT.
Unfortunately no major distributions ship those patches by default.
Why don't they? There are not that much performance downsides to PaX/grsecurity AFAIK. And it doesn't break the ABI monthly like OpenBSD does. (Don't get me wrong, I like OpenBSD personally, but this is not suitable for enterprises)
I don't agree with Torvalds, but at least I can understand him. I don't understand why distros don't implement it.
http://www.washingtonpost.com/sf/business/2015/11/05/net-of-...
Re: Analysis and Exploitation of a Linux Kernel Vulnerability
#9The blog post specifically thanks the Red Hat Security Team, but according to the Red Hat Bugzilla, no patch has been released yet for RHEL/CentOS: This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 7 and will be addressed in a future update. https://bugzilla.redhat.com/show_bug.cgi?id=1297475 Premature blog post?
Tested on CentOS 7, fully patched.
[ohadmin@localhost shm]$ ./cve_2016_0728 PP_KEY
uid=99990, euid=99990
Increfing...
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
1140 ohadmin 20 0 8428 388 296 R 100.0 0.0 9:25.17 cve_2016_0728
Update: I am not having any luck getting this to work on CentOS 7. I even completely disabled SELinux (selinux=0 vs setenforce 0) Anyone else getting this to work?
Re: Analysis and Exploitation of a Linux Kernel Vulnerability
#10Would a properly setup SELinux able to capture a local program that exploit this kind of bug?
Is there any other other of Linux/Mac/Windows/Android dist that have some type of security framework capture this kind of issue?