Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux local privilege escalation 0day, 2.6.37 - 3.8.10

fucksheep.org

Post reply on HN
Print view View original

71–80 of 100 posts

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#71

Post by jaytaylor »

gtklocker wrote: post #60

3.4.2-x86_64-linode25 doesn't seem to suffer from this. gunther> gcc -O2 semtex.c gunther> ./a.out a.out: semtex.c:63: main: Assertion `(map = mmap((void*)0x380000000, 0x010000000, 3, 0x32, 0,0)) == (void*)0x380000000' failed. Aborted gunther> uname -r 3.4.2-x86_64-linode25

3.5.2-linode45 also seems unaffected

$ uname -a Linux li252-14 3.5.2-linode45 #1 SMP Wed Aug 15 14:10:55 EDT 2012 i686 i686 i386 GNU/Linux

$ gcc -O2 semtex.c && ./a.out semtex.c: In function âfuckâ: semtex.c:30:37: warning: cast from pointer to integer of different size semtex.c:30:23: warning: cast to pointer from integer of different size semtex.c:31:21: warning: cast from pointer to integer of different size semtex.c:37:19: warning: cast to pointer from integer of different size semtex.c: In function âmainâ: semtex.c:74:3: warning: cast to pointer from integer of different size semtex.c:74:3: warning: cast to pointer from integer of different size a.out: semtex.c:51: sheep: Assertion `!close(fd)' failed. Aborted

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#72

Post by godgod »

mathnode wrote: post #31
buster wrote: post #4

Can we please stop posts like that without a proper introduction? I'm counting myself as proficient in Linux for many years and all i get is that it's some C code and apparently some 0day. What? I'm certainly not starting to decipher that or compile and run it. p.s.: same should go for all the "x anounces y" where the posted link neither explains what x is nor what y is.

Maybe they drew a picture to explain it, http://fucksheep.org/~sd/mspaint/ umm NSFW, if you work at a school.

Who the F keeps a directory of images like this? I've seen enough internet for the day.

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#73

Post by ars »

rdl wrote: post #7
buster wrote: post #4

Can we please stop posts like that without a proper introduction? I'm counting myself as proficient in Linux for many years and all i get is that it's some C code and apparently some 0day. What? I'm certainly not starting to decipher that or compile and run it. p.s.: same should go for all the "x anounces y" where the posted link neither explains what x is nor what y is.

I wish HN would allow both text and links in the same article. Otherwise you basically have to write a blog entry.

You can simply post a comment to your own submitted story.

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#74

Post by korethr »

Testing this on various boxen I have immediate access to with kernel versions from 3.2, 3.5, 3.7 and 3.8, I get mixed results. On half of them it triggers a kernel bug, but gets killed before it can return a root shell, on the others it aborts without triggering a kernel bug. Either I'm rather lucky or this exploit is fragile. Perhaps both.

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#76

Post by druiid »

Joy. This is going to be a big issue if the major distributions don't have a fixed kernel out in the next day or so (and then lazy admins don't remember to install it).

I would guess anyone with an active php shell they haven't discovered before is going to have a Bad Time.

Also, for any Redhat/CentOS users, here is bugzilla for this issue https://bugzilla.redhat.com/show_bug.cgi?id=962792

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#77

Post by fragmede »

yebyen wrote: post #54
cmars wrote: post #52

Earlier quoted context omitted.

Same here: Linux (redacted) 3.2.0-41-virtual #66-Ubuntu SMP Thu Apr 25 03:47:17 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux [ 413.309308] BUG: unable to handle kernel paging request at 0000001781eef4e8 [ 413.310359] IP: [ ] atomic_dec_and_mutex_lock+0x15/0xa0 [ 413.311025] PGD 1c4ec067 PUD 0 [ 413.311680] Oops: 0000 [#6] SMP [ 413.312007] CPU 0 Edit: disregard the timestamp above, VM has not synced with NTP for some time…

So, the question is, are we safe this time? Or do we just need a better exploit code to be written for us? :)

just need better exploit code
Post reply on HN