Bugtraq mailing list archives
Re: Linux kernel ELF core dump privilege elevation
From: codeQ <newsclient () teamq info>
Date: Thu, 12 May 2005 19:52:53 +0200
I wasn't able to make it work either, getting exactly the same output (without GCC's warnings). I'm on a Debian 2.6.11-7 kernel. I just tested but really didn't even look what it failed, not even gdb'ed the core. If someone notices what's wrong on the POC please, let me know. Thanks, Pablo Fernandez
--- Begin Message --- From: Bruno Lustosa <bruno.lists () gmail com>
Date: Wed, 11 May 2005 16:34:58 -0300
On 5/11/05, Paul Starzetz <ihaquer () isec pl> wrote:since it became clear from the discussion in January about the uselib() vulnerability, that the Linux community prefers full, non-embargoed disclosure of kernel bugs, I release full details right now. However to follows at least some of the responsable disclosure rules, no exploit code will be released. Instead, only a proof-of-concept code is released to demonstrate the vulnerability.Paul, I was unable to make it work on my amd64. Running Gentoo on kernel 2.6.11. This was the output: [+] Compiling...elfcd1.c: In function `main': elfcd1.c:48: warning: implicit declaration of function `strlen' elfcd1.c:54: warning: implicit declaration of function `memset' elfcd1.c:60: warning: implicit declaration of function `strcmp' /usr/lib/gcc/x86_64-pc-linux-gnu/3.4.3/../../../../x86_64-pc-linux-gnu/bin/ld: warning: i386:x86-64 architecture of input file `/tmp/ccSCdKeo.o' is incompatible with i386 output [+] ./elfcd1 argv_start=0x7ffffffff451 argv_end=0x7ffffffff459 ESP: 0xfffff0e0 [+] phase 1 [+] AAAA argv_start=0x7fffffff6fea argv_end=0x7fffffff6fee ESP: 0xffff6de0 [+] phase 2, <RET> to crash Segmentation fault (core dumped) -- Bruno Lustosa, aka Lofofora | Email: bruno () lustosa net Network Administrator/Web Programmer | ICQ: 1406477 Rio de Janeiro - Brazil |
--- End Message ---
Current thread:
- Linux kernel ELF core dump privilege elevation Paul Starzetz (May 11)
- Re: Linux kernel ELF core dump privilege elevation Bruno Lustosa (May 11)
- Re: Linux kernel ELF core dump privilege elevation codeQ (May 13)
- Re: Linux kernel ELF core dump privilege elevation Greg KH (May 11)
- Re: Linux kernel ELF core dump privilege elevation Greg KH (May 11)
- Re: Linux kernel ELF core dump privilege elevation Paul Starzetz (May 11)
- Re: Linux kernel ELF core dump privilege elevation (kernel module workaround) Andrew Griffiths (May 12)
- Re: Linux kernel ELF core dump privilege elevation antoine (May 12)
- Re: Linux kernel ELF core dump privilege elevation Pedro Venda (May 13)
- Re: Linux kernel ELF core dump privilege elevation Bruno Lustosa (May 11)