Linux local privilege escalation 0day, 2.6.37 - 3.8.10

Post by BoyWizard » Wed, May 15, 2013, 12:39 AM UTC

sspiff wrote: post #41

wwdevries wrote: post #28

Tested the exploit on CentOS: Linux 2.6.32-358.6.1.el6.x86_64 #1 SMP Tue Apr 23 19:29:00 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux (latest CentOS kernel): [user@centos ~]$ gcc -O2 exploit.c [user@centos ~]$ ./a.out 2.6.37-3.x x86_64 sd@fucksheep.org 2010 -sh-4.1#

I tested on two Ubuntu systems: * Linux beqbrgbrg1ux006.tpvision.com 3.2.0-29-generic #46-Ubuntu SMP Fri Jul 27 17:03:23 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux * Linux DrinkCoffee 3.5.0-25-generic #38-Ubuntu SMP Mon Feb 18 23:27:42 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux And the process gets killed because of a kernel oops in both.

Post by drill_sarge » Wed, May 15, 2013, 4:24 AM UTC

Post by [deleted] » Wed, May 15, 2013, 5:54 AM UTC

sd_ wrote: post #24

ddalex_ro wrote: post #20

Earlier quoted context omitted.

I mean, the fix consists in making sure that attr.config has all the 64 bits cleared - on the 64 bit machines, int is 64bit, so u64 == int, and all the bits are correctly handled. on 32 bit machines, int is 32bit, and the top 32 bit of attr.config is not cleared. I may be wrong though, as I didn't scan through all the affected code.

It's not that hard to port it to 32 bits, just hang on week or two. I'm just too lazy. IGjDf1e4eQxWyBFArYM8HgvCuns6p+GbfHoE3SPxYV59kXnA12BWdMr6D5eAAFgtBSX+/Yi+vLxMmEiszkwHLCA=

Post by mooism2 » Wed, May 15, 2013, 10:44 AM UTC

rdl wrote: post #92

dalore wrote: post #48

Earlier quoted context omitted.

I believe rdl wants HN to be their blog.

HN hates "blogspam", so I'd be reluctant to write a 1-3 para intro and then cite a post like this, then submit it to HN. Although I guess if it added context, it wouldn't be horrible.

Post by rei » Thu, May 16, 2013, 6:56 AM UTC

sagarun wrote: post #94

wwdevries wrote: post #36

Earlier quoted context omitted.

You get this error when you compile the exploit incorrectly. Compile like this and it works: gcc -O2 semtex.c && ./a.out

Didn't work [user@host ~]$ uname -a Linux host.company.com 3.8.11-200.fc18.x86_64 #1 SMP Wed May 1 19:44:27 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux [user@host ~]$ gcc -O2 semtex.c && ./a.out a.out: semtex.c:51: sheep: Assertion `!close(fd)' failed. Aborted (core dumped)