Re: [vserver] Patched base.c file for the CVE-2012-0056 root privilege escalation exploit for the 3.0.17 VServer kernel

From: Nikolay Kichukov <hijacker_at_oldum.net>
Date: Wed 25 Jan 2012 - 07:23:11 GMT
Message-ID: <4F1FADDF.5050603@oldum.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,
it does not work on 2.6.38.8-vs2.3.0.37-rc17 .

- -Nik

On 01/24/2012 04:07 PM, Michael S. Zick wrote:
> On Mon January 23 2012, Jean Weisbuch wrote:
>> Hello everyone,
>>
>> The kernel >=2.6.39 are vulnerable to a privilege escalation exploit
>> related to /proc/<pid>/mem, i tested one of the available exploit on a
>> 3.0.9 VServer kernel and it allow any unprivileged user on the host
>> system but also on guests to gain root privilege ; for more infos about
>> it : http://blog.zx2c4.com/749
>>
>
> My reading of that description shows that one of the steps required
> is to determine a matching self_exec_id -
>
> Which is trivial to do, since the id is evidently initialized to a
> fixed value when it is created.
>
> It would be better to also initialize the self_exec_id to a random
> number when it is created.
> That is, the same handling of an IV when creating a encrypted block.
>
>> I patched a VServer patched base.c with the Linus patch
>> (http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=e268337dfe26dfc7efd422a804dbb27977a3cccc#patch1)
>> from the 3.0.17 sources (from the linux-source-3.0.17-vs2.3.2.1-beng
>> package), i had to manually patch the chunck #1 which was rejected at
>> first but the others didnt make any complaint.
>>
>
> It does not appear to my from reading that, that self_exec_id is being
> randomized when created.
>
>> Here is the patched base.c file : http://jbboin.phpnet.org/base.c
>>
>> I am now compiling a kernel package with this patch, will share the
>> package as soon as it finished compiling (and if it seems to work).
>>
>
> Sorry, I don't have the skills to test my own suggestion;
> so it needs to only remain as a suggestion at this point.
>
> Mike
>>
>> Regards.
>>
>>
>
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJPH63fAAoJEDFLYVOGGjgXNJUH/RsyZVrVjnnMOjkOdvjZK6tw
HqbvYDMBU458dvFoDd7oZVZUHrW25ANR3C3P9/tDospTWFpEOjjeVeFC4i3tGLbn
k0/J1ltLK8+qgDNxsdyTUzTic0DKin8HsVKtAdWahnTjTihXP8HJgo152W9q9JwA
BnTteMJn8VVA8ABE+1qMjraxgZEqgs6199gEDPZTRf7xNAF8FGrRGymAEJJ9xeg6
yDrtZ3RvR7uQkncy+BlwYD4YcocH0gLYmFjTqCVUZDg18U12NXcehVTOVni9V+kW
ASQYqOFqLByiupVvNcpb0zNldOQEGCBJSMWrZhGEyb1O4ibNPy4LWLLy4Up4Buo=
=TBip
-----END PGP SIGNATURE-----
Received on Wed Jan 25 07:23:27 2012

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 25 Jan 2012 - 07:23:28 GMT by hypermail 2.1.8