Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux local privilege escalation 0day, 2.6.37 - 3.8.10

fucksheep.org

Post reply on HN
Print view View original

21–30 of 100 posts

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#21

Post by ah- »

ddalex_ro wrote: post #20
0x0 wrote: post #16

Earlier quoted context omitted.

Can you back that up? The exploit states x86_64, and even if there is only an x86 exploit published, it's likely the same vulnerability is present on an x86_64 kernel (in general). Lack of exploit code doesn't imply a lack of vulnerability :)

I mean, the fix consists in making sure that attr.config has all the 64 bits cleared - on the 64 bit machines, int is 64bit, so u64 == int, and all the bits are correctly handled. on 32 bit machines, int is 32bit, and the top 32 bit of attr.config is not cleared. I may be wrong though, as I didn't scan through all the affected code.

I just tried it on a 64bit machine and it works.

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#22

Post by jbaiter »

ddalex_ro wrote: post #20
0x0 wrote: post #16

Earlier quoted context omitted.

Can you back that up? The exploit states x86_64, and even if there is only an x86 exploit published, it's likely the same vulnerability is present on an x86_64 kernel (in general). Lack of exploit code doesn't imply a lack of vulnerability :)

I mean, the fix consists in making sure that attr.config has all the 64 bits cleared - on the 64 bit machines, int is 64bit, so u64 == int, and all the bits are correctly handled. on 32 bit machines, int is 32bit, and the top 32 bit of attr.config is not cleared. I may be wrong though, as I didn't scan through all the affected code.

I just ran the exploit on a 64bit machine and it worked as expected, I got root privileges.

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#24

Post by sd_ »

ddalex_ro wrote: post #20
0x0 wrote: post #16

Earlier quoted context omitted.

Can you back that up? The exploit states x86_64, and even if there is only an x86 exploit published, it's likely the same vulnerability is present on an x86_64 kernel (in general). Lack of exploit code doesn't imply a lack of vulnerability :)

I mean, the fix consists in making sure that attr.config has all the 64 bits cleared - on the 64 bit machines, int is 64bit, so u64 == int, and all the bits are correctly handled. on 32 bit machines, int is 32bit, and the top 32 bit of attr.config is not cleared. I may be wrong though, as I didn't scan through all the affected code.

It's not that hard to port it to 32 bits, just hang on week or two. I'm just too lazy.

IGjDf1e4eQxWyBFArYM8HgvCuns6p+GbfHoE3SPxYV59kXnA12BWdMr6D5eAAFgtBSX+/Yi+vLxMmEiszkwHLCA=

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#25

Post by edwintorok »

ddalex_ro wrote: post #20
0x0 wrote: post #16

Earlier quoted context omitted.

Can you back that up? The exploit states x86_64, and even if there is only an x86 exploit published, it's likely the same vulnerability is present on an x86_64 kernel (in general). Lack of exploit code doesn't imply a lack of vulnerability :)

I mean, the fix consists in making sure that attr.config has all the 64 bits cleared - on the 64 bit machines, int is 64bit, so u64 == int, and all the bits are correctly handled. on 32 bit machines, int is 32bit, and the top 32 bit of attr.config is not cleared. I may be wrong though, as I didn't scan through all the affected code.

No, int is the same size on 32-bit and 64-bit Linux: sizeof(int) == 4 sizeof(long) == 4 (32-bit), 8 (64-bit) sizeof(long long) == 8

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#27

Post by zwp »

buster wrote: post #4

Can we please stop posts like that without a proper introduction? I'm counting myself as proficient in Linux for many years and all i get is that it's some C code and apparently some 0day. What? I'm certainly not starting to decipher that or compile and run it. p.s.: same should go for all the "x anounces y" where the posted link neither explains what x is nor what y is.

Minimal explanation (allegedly by author "sd") at: http://packetstormsecurity.com/files/121616/semtex.c

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#28

Post by wwdevries »

Tested the exploit on CentOS:

Linux 2.6.32-358.6.1.el6.x86_64 #1 SMP Tue Apr 23 19:29:00 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux (latest CentOS kernel):

  [user@centos ~]$ gcc -O2 exploit.c 
  [user@centos ~]$ ./a.out 
  2.6.37-3.x x86_64
  sd@fucksheep.org 2010
  -sh-4.1#

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#29

Post by wwdevries »

reiche wrote: post #3

Hm, doubtful. PS1/ $ w 12:17:27 up 38 days, 17:18, 1 user, load average: 0.44, 0.11, 0.04 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT user pts/0 Narnia 07:11 0.00s 0.25s 0.11s w PS1/ $ uname -a Linux Rivendell 2.6.32-358.2.1.el6.x86_64 #1 SMP Wed Mar 13 00:26:49 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux PS1/ $ cat /etc/redhat\-release CentOS release 6.4 (Final) PS1/ $ ./a.out 2.6.37-3.x x86_64 sd@fucksheep.org 2010 a.out:…

You get this error when you compile the exploit incorrectly. Compile like this and it works:

  gcc -O2 sheep.c && ./a.out

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#30

Post by yebyen »

pja wrote: post #6

Works on Debian stable (wheezy). Joy unconfined.

I have an ubuntu precise that has been keeping up with kernel updates, running 3.2.0-41-generic, and it does not give root.

Whether the vulnerability is patched or the exploit just doesn't work, I can't say, but I get this:

  yebyen@oneiric64:~$ gcc -O2 semtex.c 
  yebyen@oneiric64:~$ ./a.out 
  Killed
(Don't worry the hostname is oneiric64. It's not running oneiric.)
Post reply on HN