From: Brad Spengler (spendergrsecurity.net)
Date: Fri Aug 14 2009 - 13:53:06 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

For those who have been living under a rock for the past two days, an
exploit exists for Julien Tinnes/Tavis Ormandy's sendpage vulnerability
in all Linux kernels since 2001.

My exploit works on 2.4, 2.6, x86, x64, 4k stacks, 8k stacks,
with/without cred framework, bypasses mmap_min_addr in any public way
possible (auto-detecting which method to use).
As always, while in ring0 it provides the added convenience of disabling
auditing, SELinux, AppArmor, and all other LSM modules. If SELinux is
enforcing, it will also rewrite the SELinux code to fool userland into
thinking it remains in enforcing mode.

And if the machine supports it, it'll play a nice video for you in your
terminal. See http://www.youtube.com/watch?v=arAfIp7YzZ4 for a demo.

I wanted to implement a more interactive sense of russian roulette in
the exploit, with a randomly-generated 1 in 6 chance of hot rebooting
the machine into FreeDOS (first exploit to reboot you into a secure
operating system) but I don't have time -- I'm off to Miami!

"Congrats" Linus on screwing over all the vendors and every Linux user
by forcing disclosure of the bug before vendors could ship out updated
kernels. Your patch applies well to their binary packages.

-Brad

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFKhbKRmHm2SUJF1GoRAofbAJ4l9+Poi86xpgWaZBG/bHIJURkIFgCfZQs1
po4LPn1tSzV28vZL64CZZtk=
=mAPM
-----END PGP SIGNATURE-----

_______________________________________________
Dailydave mailing list
Dailydavelists.immunitysec.com
http://lists.immunitysec.com/mailman/listinfo/dailydave

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]