Mr. Magorium's Wunderbar Emporium

[spender () grsecurity net (Brad Spengler)]

For those who have been living under a rock for the past two days, an 
exploit exists for Julien Tinnes/Tavis Ormandy's sendpage vulnerability 
in all Linux kernels since 2001.

My exploit works on 2.4, 2.6, x86, x64, 4k stacks, 8k stacks, 
with/without cred framework, bypasses mmap_min_addr in any public way 
possible (auto-detecting which method to use).
As always, while in ring0 it provides the added convenience of disabling 
auditing, SELinux, AppArmor, and all other LSM modules.  If SELinux is 
enforcing, it will also rewrite the SELinux code to fool userland into 
thinking it remains in enforcing mode.

And if the machine supports it, it'll play a nice video for you in your 
terminal.  See http://www.youtube.com/watch?v=arAfIp7YzZ4 for a demo.

I wanted to implement a more interactive sense of russian roulette in 
the exploit, with a randomly-generated 1 in 6 chance of hot rebooting 
the machine into FreeDOS (first exploit to reboot you into a secure 
operating system) but I don't have time -- I'm off to Miami!

"Congrats" Linus on screwing over all the vendors and every Linux user 
by forcing disclosure of the bug before vendors could ship out updated 
kernels.  Your patch applies well to their binary packages.

-Brad

Attachment: signature.asc
Description: Digital signature

_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://lists.immunitysec.com/mailman/listinfo/dailydave