Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux local privilege escalation 0day, 2.6.37 - 3.8.10

fucksheep.org

Post reply on HN
Print view View original

41–50 of 100 posts

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#41

Post by sspiff »

wwdevries wrote: post #28

Tested the exploit on CentOS: Linux 2.6.32-358.6.1.el6.x86_64 #1 SMP Tue Apr 23 19:29:00 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux (latest CentOS kernel): [user@centos ~]$ gcc -O2 exploit.c [user@centos ~]$ ./a.out 2.6.37-3.x x86_64 sd@fucksheep.org 2010 -sh-4.1#

I tested on two Ubuntu systems:

* Linux beqbrgbrg1ux006.tpvision.com 3.2.0-29-generic #46-Ubuntu SMP Fri Jul 27 17:03:23 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux

* Linux DrinkCoffee 3.5.0-25-generic #38-Ubuntu SMP Mon Feb 18 23:27:42 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux

And the process gets killed because of a kernel oops in both.

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#44

Post by est »

buster wrote: post #4

Can we please stop posts like that without a proper introduction? I'm counting myself as proficient in Linux for many years and all i get is that it's some C code and apparently some 0day. What? I'm certainly not starting to decipher that or compile and run it. p.s.: same should go for all the "x anounces y" where the posted link neither explains what x is nor what y is.

> I'm counting myself as proficient in Linux for many years

That's the difference between a power user and a hacker.

A power user RTFM, a hacker RTFS.

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#46

Post by tomp »

est wrote: post #44
buster wrote: post #4

Can we please stop posts like that without a proper introduction? I'm counting myself as proficient in Linux for many years and all i get is that it's some C code and apparently some 0day. What? I'm certainly not starting to decipher that or compile and run it. p.s.: same should go for all the "x anounces y" where the posted link neither explains what x is nor what y is.

> I'm counting myself as proficient in Linux for many years That's the difference between a power user and a hacker. A power user RTFM, a hacker RTFS.

The problem is you might be a Windows/Java/ASM/Lisp hacker, and you would be able to understand the general principles, but not the specific (and unfamiliar) source code.

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#48

Post by dalore »

mooism2 wrote: post #11
rdl wrote: post #7

Earlier quoted context omitted.

I wish HN would allow both text and links in the same article. Otherwise you basically have to write a blog entry.

HN encourages you to write a blog post and submit that, yes.

I believe rdl wants HN to be their blog.

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#49

Post by pi18n »

est wrote: post #44
buster wrote: post #4

Can we please stop posts like that without a proper introduction? I'm counting myself as proficient in Linux for many years and all i get is that it's some C code and apparently some 0day. What? I'm certainly not starting to decipher that or compile and run it. p.s.: same should go for all the "x anounces y" where the posted link neither explains what x is nor what y is.

> I'm counting myself as proficient in Linux for many years That's the difference between a power user and a hacker. A power user RTFM, a hacker RTFS.

When you imply that a hacker should read and understand the source, are you referring to the posted code or Linux itself (or both)?

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#50

Post by rommelvr »

sd_ wrote: post #24
ddalex_ro wrote: post #20

Earlier quoted context omitted.

I mean, the fix consists in making sure that attr.config has all the 64 bits cleared - on the 64 bit machines, int is 64bit, so u64 == int, and all the bits are correctly handled. on 32 bit machines, int is 32bit, and the top 32 bit of attr.config is not cleared. I may be wrong though, as I didn't scan through all the affected code.

It's not that hard to port it to 32 bits, just hang on week or two. I'm just too lazy. IGjDf1e4eQxWyBFArYM8HgvCuns6p+GbfHoE3SPxYV59kXnA12BWdMr6D5eAAFgtBSX+/Yi+vLxMmEiszkwHLCA=

Hahaha. Love that you signed your message with your 'jewgold' address. Nice 0day.
Post reply on HN