Re: [vserver] Patched base.c file for the CVE-2012-0056 root privilege escalation exploit for the 3.0.17 VServer kernel

From: Michael S. Zick <mszick_at_morethan.org>
Date: Tue 24 Jan 2012 - 14:07:24 GMT
Message-Id: <201201240807.27612.mszick@morethan.org>

On Mon January 23 2012, Jean Weisbuch wrote:
> Hello everyone,
>
> The kernel >=2.6.39 are vulnerable to a privilege escalation exploit
> related to /proc/<pid>/mem, i tested one of the available exploit on a
> 3.0.9 VServer kernel and it allow any unprivileged user on the host
> system but also on guests to gain root privilege ; for more infos about
> it : http://blog.zx2c4.com/749
>

My reading of that description shows that one of the steps required
is to determine a matching self_exec_id -

Which is trivial to do, since the id is evidently initialized to a
fixed value when it is created.

It would be better to also initialize the self_exec_id to a random
number when it is created.
That is, the same handling of an IV when creating a encrypted block.
 
> I patched a VServer patched base.c with the Linus patch
> (http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=e268337dfe26dfc7efd422a804dbb27977a3cccc#patch1)
> from the 3.0.17 sources (from the linux-source-3.0.17-vs2.3.2.1-beng
> package), i had to manually patch the chunck #1 which was rejected at
> first but the others didnt make any complaint.
>

It does not appear to my from reading that, that self_exec_id is being
randomized when created.

> Here is the patched base.c file : http://jbboin.phpnet.org/base.c
>
> I am now compiling a kernel package with this patch, will share the
> package as soon as it finished compiling (and if it seems to work).
>

Sorry, I don't have the skills to test my own suggestion;
so it needs to only remain as a suggestion at this point.

Mike
>
> Regards.
>
>
Received on Tue Jan 24 14:07:45 2012

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Tue 24 Jan 2012 - 14:07:46 GMT by hypermail 2.1.8