On Tue, 2008-02-12 at 14:49 +0100, Łukasz Czarniecki wrote:
> Natanael Copa wrote:
> > BTW... the exploit thats out for this bug didnt work on the
> > vserver-grsecurity kernel. A day like this I'm happy I'm using it.
>
> Hi
>
> I'm using 2.6.22.15-grsec2.1.11-vs2.2.0.5 kernel.
> And the exploit works in both vserver and host.
interesting. Here it generates a "PAX: suspicious general protection
fault: 0000 [#1]" and the program segfaults.
> It doesn't let to escape from vserver but it could be possible
> according to http://www.debian.org/security/2008/dsa-1494
> "In the vserver-enabled kernels, a missing access check on certain
> symlinks in /proc enabled local attackers to access resources in other
> vservers"
>
> Did you just set TPE or some other options?
no
> Which grsecurity option protects against this exploit?
as mentioned UDEREF prevents it for good, but KERNEXEC alone should
prevent the code execution that this exploits relies on.
> Can you share your config?
svn cat svn://svn.alpinelinux.org/alpine-builder/trunk/kernel/vsgrsec/config
The patches I use are adapted to gentoo. found here:
http://dev.alpinelinux.org/vsgrsec-sources/
> Lukasz Czarniecki
-nc
Received on Wed Feb 13 07:31:54 2008