31–40 of 100 posts
Can we please stop posts like that without a proper introduction? I'm counting myself as proficient in Linux for many years and all i get is that it's some C code and apparently some 0day. What? I'm certainly not starting to decipher that or compile and run it. p.s.: same should go for all the "x anounces y" where the posted link neither explains what x is nor what y is.
umm NSFW, if you work at a school.
CVE-2013-2094
./semtex 2.6.37-3.x x86_64 sd@fucksheep.org 2010 semtex: semtex.c:81: main: Assertion `p = memmem(code, 1024, &needle, 8)' failed. Aborted
[1] - http://elrepo.org/tiki/kmod-tpe
LE: exploit needs to be compiled with -O2 flags to work ...
Works on Debian stable (wheezy). Joy unconfined.
I have an ubuntu precise that has been keeping up with kernel updates, running 3.2.0-41-generic, and it does not give root. Whether the vulnerability is patched or the exploit just doesn't work, I can't say, but I get this: yebyen@oneiric64:~$ gcc -O2 semtex.c yebyen@oneiric64:~$ ./a.out Killed (Don't worry the hostname is oneiric64. It's not running oneiric.)
It's a great day to have kmod-tpe[1] installed. Having said that, after I rmmod-ed tpe the exploit still failed (I'm on 2.6.32-358.6.1.el6.x86_64): ./semtex 2.6.37-3.x x86_64 sd@fucksheep.org 2010 semtex: semtex.c:81: main: Assertion `p = memmem(code, 1024, &needle, 8)' failed. Aborted [1] - http://elrepo.org/tiki/kmod-tpe LE: exploit needs to be compiled with -O2 flags to work ...
Compile like this and it works:
gcc -O2 semtex.c && ./a.outCan we please stop posts like that without a proper introduction? I'm counting myself as proficient in Linux for many years and all i get is that it's some C code and apparently some 0day. What? I'm certainly not starting to decipher that or compile and run it. p.s.: same should go for all the "x anounces y" where the posted link neither explains what x is nor what y is.
CVE-2013-2094
Earlier quoted context omitted.
I have an ubuntu precise that has been keeping up with kernel updates, running 3.2.0-41-generic, and it does not give root. Whether the vulnerability is patched or the exploit just doesn't work, I can't say, but I get this: yebyen@oneiric64:~$ gcc -O2 semtex.c yebyen@oneiric64:~$ ./a.out Killed (Don't worry the hostname is oneiric64. It's not running oneiric.)
Try dmesg.
Want me to pastebin it? edit:
It starts out
[318258.327110] BUG: unable to handle kernel paging request at 0000001781ef7788
[318258.328251] IP: [] atomic_dec_and_mutex_lock+0x15/0x90
[318258.328251] PGD 2b18b067 PUD 0
[318258.328251] Oops: 0000 [#4] SMPEarlier quoted context omitted.
I mean, the fix consists in making sure that attr.config has all the 64 bits cleared - on the 64 bit machines, int is 64bit, so u64 == int, and all the bits are correctly handled. on 32 bit machines, int is 32bit, and the top 32 bit of attr.config is not cleared. I may be wrong though, as I didn't scan through all the affected code.
No, int is the same size on 32-bit and 64-bit Linux: sizeof(int) == 4 sizeof(long) == 4 (32-bit), 8 (64-bit) sizeof(long long) == 8