Re: [vserver] Kernel bug

From: Natanael Copa <natanael.copa_at_gmail.com>
Date: Wed 13 Feb 2008 - 07:31:35 GMT
Message-Id: <1202887895.30103.24.camel@nc.nor.wtbts.org>

On Tue, 2008-02-12 at 14:49 +0100, Łukasz Czarniecki wrote:
> Natanael Copa wrote:
> > BTW... the exploit thats out for this bug didnt work on the
> > vserver-grsecurity kernel. A day like this I'm happy I'm using it.
>
> Hi
>
> I'm using 2.6.22.15-grsec2.1.11-vs2.2.0.5 kernel.
> And the exploit works in both vserver and host.

interesting. Here it generates a "PAX: suspicious general protection
fault: 0000 [#1]" and the program segfaults.

> It doesn't let to escape from vserver but it could be possible
> according to http://www.debian.org/security/2008/dsa-1494
> "In the vserver-enabled kernels, a missing access check on certain
> symlinks in /proc enabled local attackers to access resources in other
> vservers"
>
> Did you just set TPE or some other options?

no

> Which grsecurity option protects against this exploit?

as mentioned UDEREF prevents it for good, but KERNEXEC alone should
prevent the code execution that this exploits relies on.

> Can you share your config?

svn cat svn://svn.alpinelinux.org/alpine-builder/trunk/kernel/vsgrsec/config

The patches I use are adapted to gentoo. found here:
http://dev.alpinelinux.org/vsgrsec-sources/

> Lukasz Czarniecki

-nc
Received on Wed Feb 13 07:31:54 2008

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 13 Feb 2008 - 07:32:00 GMT by hypermail 2.1.8