heya,
if you want to protect yourself from this bug:
Prevent invalid userland pointer dereference
CONFIG_PAX_MEMORY_UDEREF=y in the kernel config
it makes the exploit "not work", but it does corrupt memory, and you
will need to reboot. but at least you won't get rooted ;)
i haven't tried it myself, but that's what i've been told... i will do
some test myself later
greetz,
harry
On Tue, 2008-02-12 at 14:49 +0100, Ćukasz Czarniecki wrote:
> Natanael Copa wrote:
> > BTW... the exploit thats out for this bug didnt work on the
> > vserver-grsecurity kernel. A day like this I'm happy I'm using it.
>
> Hi
>
> I'm using 2.6.22.15-grsec2.1.11-vs2.2.0.5 kernel.
> And the exploit works in both vserver and host.
>
> It doesn't let to escape from vserver but it could be possible
> according to http://www.debian.org/security/2008/dsa-1494
> "In the vserver-enabled kernels, a missing access check on certain
> symlinks in /proc enabled local attackers to access resources in other
> vservers"
>
> Did you just set TPE or some other options?
> Which grsecurity option protects against this exploit?
> Can you share your config?
>
> Lukasz Czarniecki
>
> Here is my config:
> #
> # Kernel hacking
> #
> CONFIG_TRACE_IRQFLAGS_SUPPORT=y
> CONFIG_PRINTK_TIME=y
> CONFIG_ENABLE_MUST_CHECK=y
> CONFIG_MAGIC_SYSRQ=y
> CONFIG_UNUSED_SYMBOLS=y
> CONFIG_DEBUG_FS=y
> # CONFIG_HEADERS_CHECK is not set
> CONFIG_DEBUG_KERNEL=y
> # CONFIG_DEBUG_SHIRQ is not set
> CONFIG_DETECT_SOFTLOCKUP=y
> # CONFIG_SCHEDSTATS is not set
> # CONFIG_TIMER_STATS is not set
> # CONFIG_DEBUG_SLAB is not set
> # CONFIG_DEBUG_RT_MUTEXES is not set
> # CONFIG_RT_MUTEX_TESTER is not set
> # CONFIG_DEBUG_SPINLOCK is not set
> # CONFIG_DEBUG_MUTEXES is not set
> # CONFIG_DEBUG_LOCK_ALLOC is not set
> # CONFIG_PROVE_LOCKING is not set
> # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
> # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
> # CONFIG_DEBUG_KOBJECT is not set
> CONFIG_DEBUG_BUGVERBOSE=y
> # CONFIG_DEBUG_INFO is not set
> # CONFIG_DEBUG_VM is not set
> # CONFIG_DEBUG_LIST is not set
> # CONFIG_FRAME_POINTER is not set
> # CONFIG_FORCED_INLINING is not set
> # CONFIG_RCU_TORTURE_TEST is not set
> # CONFIG_FAULT_INJECTION is not set
> # CONFIG_DEBUG_RODATA is not set
> # CONFIG_IOMMU_DEBUG is not set
> # CONFIG_DEBUG_STACKOVERFLOW is not set
> # CONFIG_DEBUG_STACK_USAGE is not set
>
> #
> # Linux VServer
> #
> # CONFIG_VSERVER_LEGACY is not set
> # CONFIG_VSERVER_LEGACYNET is not set
> CONFIG_VSERVER_REMAP_SADDR=y
> CONFIG_VSERVER_COWBL=y
> # CONFIG_VSERVER_VTIME is not set
> CONFIG_VSERVER_PROC_SECURE=y
> CONFIG_VSERVER_HARDCPU=y
> CONFIG_VSERVER_IDLETIME=y
> CONFIG_VSERVER_IDLELIMIT=y
> # CONFIG_TAGGING_NONE is not set
> # CONFIG_TAGGING_UID16 is not set
> # CONFIG_TAGGING_GID16 is not set
> CONFIG_TAGGING_ID24=y
> # CONFIG_TAGGING_INTERN is not set
> # CONFIG_TAG_NFSD is not set
> CONFIG_PROPAGATE=y
> CONFIG_VSERVER_PRIVACY=y
> CONFIG_VSERVER_CONTEXTS=768
> CONFIG_VSERVER_WARN=y
> CONFIG_VSERVER_DEBUG=y
> CONFIG_VSERVER_HISTORY=y
> CONFIG_VSERVER_HISTORY_SIZE=64
> # CONFIG_VSERVER_MONITOR is not set
> CONFIG_VSERVER=y
> CONFIG_VSERVER_NGNET=y
>
> #
> # Security options
> #
>
> #
> # Grsecurity
> #
> CONFIG_GRKERNSEC=y
> # CONFIG_GRKERNSEC_LOW is not set
> # CONFIG_GRKERNSEC_MEDIUM is not set
> # CONFIG_GRKERNSEC_HIGH is not set
> CONFIG_GRKERNSEC_CUSTOM=y
>
> #
> # Address Space Protection
> #
> CONFIG_GRKERNSEC_KMEM=y
> CONFIG_GRKERNSEC_IO=y
> CONFIG_GRKERNSEC_PROC_MEMMAP=y
> CONFIG_GRKERNSEC_BRUTE=y
> CONFIG_GRKERNSEC_MODSTOP=y
> CONFIG_GRKERNSEC_HIDESYM=y
>
> #
> # Role Based Access Control Options
> #
> CONFIG_GRKERNSEC_ACL_HIDEKERN=y
> CONFIG_GRKERNSEC_ACL_MAXTRIES=3
> CONFIG_GRKERNSEC_ACL_TIMEOUT=30
>
> #
> # Filesystem Protections
> #
> CONFIG_GRKERNSEC_PROC=y
> CONFIG_GRKERNSEC_PROC_USER=y
> CONFIG_GRKERNSEC_PROC_ADD=y
> CONFIG_GRKERNSEC_LINK=y
> CONFIG_GRKERNSEC_FIFO=y
> CONFIG_GRKERNSEC_CHROOT=y
> # CONFIG_GRKERNSEC_CHROOT_MOUNT is not set
> # CONFIG_GRKERNSEC_CHROOT_DOUBLE is not set
> CONFIG_GRKERNSEC_CHROOT_PIVOT=y
> # CONFIG_GRKERNSEC_CHROOT_CHDIR is not set
> # CONFIG_GRKERNSEC_CHROOT_CHMOD is not set
> CONFIG_GRKERNSEC_CHROOT_FCHDIR=y
> CONFIG_GRKERNSEC_CHROOT_MKNOD=y
> CONFIG_GRKERNSEC_CHROOT_SHMAT=y
> CONFIG_GRKERNSEC_CHROOT_UNIX=y
> # CONFIG_GRKERNSEC_CHROOT_FINDTASK is not set
> CONFIG_GRKERNSEC_CHROOT_NICE=y
> CONFIG_GRKERNSEC_CHROOT_SYSCTL=y
> # CONFIG_GRKERNSEC_CHROOT_CAPS is not set
>
> #
> # Kernel Auditing
> #
> # CONFIG_GRKERNSEC_AUDIT_GROUP is not set
> # CONFIG_GRKERNSEC_EXECLOG is not set
> CONFIG_GRKERNSEC_RESLOG=y
> # CONFIG_GRKERNSEC_CHROOT_EXECLOG is not set
> # CONFIG_GRKERNSEC_AUDIT_CHDIR is not set
> # CONFIG_GRKERNSEC_AUDIT_MOUNT is not set
> # CONFIG_GRKERNSEC_AUDIT_IPC is not set
> CONFIG_GRKERNSEC_SIGNAL=y
> CONFIG_GRKERNSEC_FORKFAIL=y
> CONFIG_GRKERNSEC_TIME=y
> CONFIG_GRKERNSEC_PROC_IPADDR=y
> # CONFIG_GRKERNSEC_AUDIT_TEXTREL is not set
>
> #
> # Executable Protections
> #
> CONFIG_GRKERNSEC_EXECVE=y
> CONFIG_GRKERNSEC_SHM=y
> CONFIG_GRKERNSEC_DMESG=y
> # CONFIG_GRKERNSEC_TPE is not set
>
> #
> # Network Protections
> #
> CONFIG_GRKERNSEC_RANDNET=y
> # CONFIG_GRKERNSEC_SOCKET is not set
>
> #
> # Sysctl support
> #
> CONFIG_GRKERNSEC_SYSCTL=y
> CONFIG_GRKERNSEC_SYSCTL_ON=y
>
> #
> # Logging Options
> #
> CONFIG_GRKERNSEC_FLOODTIME=10
> CONFIG_GRKERNSEC_FLOODBURST=4
>
> #
> # PaX
> #
> CONFIG_PAX=y
>
> #
> # PaX Control
> #
> CONFIG_PAX_SOFTMODE=y
> CONFIG_PAX_EI_PAX=y
> CONFIG_PAX_PT_PAX_FLAGS=y
> CONFIG_PAX_NO_ACL_FLAGS=y
> # CONFIG_PAX_HAVE_ACL_FLAGS is not set
> # CONFIG_PAX_HOOK_ACL_FLAGS is not set
>
> #
> # Non-executable pages
> #
> CONFIG_PAX_NOEXEC=y
> CONFIG_PAX_PAGEEXEC=y
> CONFIG_PAX_MPROTECT=y
> CONFIG_PAX_NOELFRELOCS=y
>
> #
> # Address Space Layout Randomization
> #
> CONFIG_PAX_ASLR=y
> CONFIG_PAX_RANDUSTACK=y
> CONFIG_PAX_RANDMMAP=y
>
> #
> # Miscellaneous hardening features
> #
> CONFIG_PAX_MEMORY_SANITIZE=y
> CONFIG_KEYS=y
> # CONFIG_KEYS_DEBUG_PROC_KEYS is not set
> # CONFIG_SECURITY is not set
>
Received on Tue Feb 12 22:23:34 2008