Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux local privilege escalation 0day, 2.6.37 - 3.8.10

fucksheep.org

Post reply on HN
Print view View original

61–70 of 100 posts

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#61

Post by jstanley »

lawl wrote: post #56
buster wrote: post #4

Can we please stop posts like that without a proper introduction? I'm counting myself as proficient in Linux for many years and all i get is that it's some C code and apparently some 0day. What? I'm certainly not starting to decipher that or compile and run it. p.s.: same should go for all the "x anounces y" where the posted link neither explains what x is nor what y is.

Well, to be fair it's rather easy to spot what this is doing. Looking at the last two lines of code: assert(!setuid(0)); return execl("/bin/bash", "-sh", NULL); It spawns a root shell, so it's (probably) a (local) privilege escalation.

That doesn't explain anything about how it works though.

Anybody could submit some unreadable C code that finishes up with setuid(0) and exec("/bin/sh") - it isn't interesting without an explanation of what it's doing.

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#62

Post by dfc »

rommelvr wrote: post #50
sd_ wrote: post #24

Earlier quoted context omitted.

It's not that hard to port it to 32 bits, just hang on week or two. I'm just too lazy. IGjDf1e4eQxWyBFArYM8HgvCuns6p+GbfHoE3SPxYV59kXnA12BWdMr6D5eAAFgtBSX+/Yi+vLxMmEiszkwHLCA=

Hahaha. Love that you signed your message with your 'jewgold' address. Nice 0day.

Me too. I love latent antisemitism.

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#63

Post by buster »

est wrote: post #44
buster wrote: post #4

Can we please stop posts like that without a proper introduction? I'm counting myself as proficient in Linux for many years and all i get is that it's some C code and apparently some 0day. What? I'm certainly not starting to decipher that or compile and run it. p.s.: same should go for all the "x anounces y" where the posted link neither explains what x is nor what y is.

> I'm counting myself as proficient in Linux for many years That's the difference between a power user and a hacker. A power user RTFM, a hacker RTFS.

The difference is that i don't know if this is worthy to invest time and effort or not. Does this have an impact on a wide install base of servers? Apparently some HNers can't reproduce this. So it's not worth my time? I would assume it's just common sense (or courtesy) to put a little bit of text around it. How often do you read a news article about quantum mechanics that is just some lines of advanced math without any explanation at all?

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#66

Post by buster »

zwp wrote: post #27
buster wrote: post #4

Can we please stop posts like that without a proper introduction? I'm counting myself as proficient in Linux for many years and all i get is that it's some C code and apparently some 0day. What? I'm certainly not starting to decipher that or compile and run it. p.s.: same should go for all the "x anounces y" where the posted link neither explains what x is nor what y is.

Minimal explanation (allegedly by author "sd") at: http://packetstormsecurity.com/files/121616/semtex.c

I would have loved to have THIS as the link target, the three short sentences make a big difference, imo.

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#67

Post by astrodust »

rdl wrote: post #7
buster wrote: post #4

Can we please stop posts like that without a proper introduction? I'm counting myself as proficient in Linux for many years and all i get is that it's some C code and apparently some 0day. What? I'm certainly not starting to decipher that or compile and run it. p.s.: same should go for all the "x anounces y" where the posted link neither explains what x is nor what y is.

I wish HN would allow both text and links in the same article. Otherwise you basically have to write a blog entry.

I'm sure that's nearly impossible to manage in this day and age. If only someone could create a service that made such a thing easy.

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#68

Post by ezdiy »

ezdiy wrote: post #2

Silent patched a while ago: Kernel must be compiled with PERF_EVENTS (default on most modern distros). Bug fixed in 3.8.10. This is the kill log: http://lkml.indiana.edu/hypermail/linux/kernel/1304.1/04302.... This bug got apparently backported from 2.6.37 into centos6 2.6.32 kernels. patch here: https://patchwork.kernel.org/patch/2441281/

Spender did excellent write-up about how it exactly works: http://www.reddit.com/r/netsec/comments/1eb9iw/sdfucksheepor...

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#69

Post by lawl »

jstanley wrote: post #61
lawl wrote: post #56

Earlier quoted context omitted.

Well, to be fair it's rather easy to spot what this is doing. Looking at the last two lines of code: assert(!setuid(0)); return execl("/bin/bash", "-sh", NULL); It spawns a root shell, so it's (probably) a (local) privilege escalation.

That doesn't explain anything about how it works though. Anybody could submit some unreadable C code that finishes up with setuid(0) and exec("/bin/sh") - it isn't interesting without an explanation of what it's doing.

Well, that's a different question. A fully fledged analysis of this exploit would certainly be interesting. But it's an 0day, I think it's more important to patch vulnerable servers first. And I don't see what's stopping anyone from submitting an analysis of this a few days later.
Post reply on HN