Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux local privilege escalation 0day, 2.6.37 - 3.8.10

fucksheep.org

Post reply on HN
Print view View original

1–10 of 100 posts

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#2

Post by ezdiy »

Silent patched a while ago:

Kernel must be compiled with PERF_EVENTS (default on most modern distros). Bug fixed in 3.8.10.

This is the kill log:

http://lkml.indiana.edu/hypermail/linux/kernel/1304.1/04302....

This bug got apparently backported from 2.6.37 into centos6 2.6.32 kernels.

patch here: https://patchwork.kernel.org/patch/2441281/

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#3

Post by reiche »

Hm, doubtful.

PS1/ $ w

12:17:27 up 38 days, 17:18, 1 user, load average: 0.44, 0.11, 0.04

USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT

user pts/0 Narnia 07:11 0.00s 0.25s 0.11s w

PS1/ $ uname -a

Linux Rivendell 2.6.32-358.2.1.el6.x86_64 #1 SMP Wed Mar 13 00:26:49 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux

PS1/ $ cat /etc/redhat\-release

CentOS release 6.4 (Final)

PS1/ $ ./a.out

2.6.37-3.x x86_64

sd@fucksheep.org 2010

a.out: sheep.c:81: main: Assertion `p = memmem(code, 1024, &needle, 8)' failed.

Abort(coredump)

PS1/

Seems it is nicely dumped instead of doing weird things in userland.

Under root is doesn't coredump, but returns to the prompt without any hassle.

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#4

Post by buster »

Can we please stop posts like that without a proper introduction? I'm counting myself as proficient in Linux for many years and all i get is that it's some C code and apparently some 0day. What? I'm certainly not starting to decipher that or compile and run it.

p.s.: same should go for all the "x anounces y" where the posted link neither explains what x is nor what y is.

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#7

Post by rdl »

buster wrote: post #4

Can we please stop posts like that without a proper introduction? I'm counting myself as proficient in Linux for many years and all i get is that it's some C code and apparently some 0day. What? I'm certainly not starting to decipher that or compile and run it. p.s.: same should go for all the "x anounces y" where the posted link neither explains what x is nor what y is.

I wish HN would allow both text and links in the same article. Otherwise you basically have to write a blog entry.

Re: Linux local privilege escalation 0day, 2.6.37 - 3.8.10

#8

Post by ezdiy »

reiche wrote: post #3

Hm, doubtful. PS1/ $ w 12:17:27 up 38 days, 17:18, 1 user, load average: 0.44, 0.11, 0.04 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT user pts/0 Narnia 07:11 0.00s 0.25s 0.11s w PS1/ $ uname -a Linux Rivendell 2.6.32-358.2.1.el6.x86_64 #1 SMP Wed Mar 13 00:26:49 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux PS1/ $ cat /etc/redhat\-release CentOS release 6.4 (Final) PS1/ $ ./a.out 2.6.37-3.x x86_64 sd@fucksheep.org 2010 a.out:…

Either your kernel is patched, or the exploit does not work on your system. It certainly fails without -O2, glance over the code indicates horrible reliance on various UB on how gcc compiles it.

$ grep -A 10 'int perf_swevent_init' linux-2.6.32-358.el6/kernel/events/core.c static int perf_swevent_init(struct perf_event *event) { int event_id = event->attr.config;

if (event->attr.type != PERF_TYPE_SOFTWARE) return -ENOENT;

switch (event_id) { case PERF_COUNT_SW_CPU_CLOCK: case PERF_COUNT_SW_TASK_CLOCK: return -ENOENT;

Post reply on HN