oss-sec mailing list archives
Re: Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable
From: Julien Tinnes <jt () cr0 org>
Date: Mon, 20 Jul 2009 11:26:31 -0700
On Mon, Jul 20, 2009 at 4:29 AM, Solar Designer<solar () openwall com> wrote:
Marcus, On Mon, Jul 20, 2009 at 12:01:47PM +0200, Marcus Meissner wrote:- fixed the personality - PER_CLEAR_ON_SETTID inheritance issue (CVE-2009-1895) to work around mmap_min_addr protection. Affects 2.6.23-2.6.30.1What makes you think this does not affect earlier kernels? This does not match my analysis, but maybe I am missing something, hence I ask. BTW, as you're aware, this fix is a hardening measure for/against SUID-root programs with a certain class of design errors in them; it is not exactly a fix for the kernel itself, although it should be in the kernel. I do not mean to downplay the issue, but I think it is important that we distinguish the different types of changes that we are making in response to Brad's exploit.
Hey Alexander, for a SUID-root binary, dropping privileges and giving control back to the user without going through exec to re-set the address space is probably not the best idea indeed. However I still believe this was a kernel issue, if you (really) know what you're doing (bzero-ing your secrets in the address space etc..), this should not be strictly forbidden. Without this patch, you could also disable address space layout randomization in SUID binaries, and in some cases exploit NULL ptr dereferences bugs in SUID-root binaries more easily. Granted, both would be non issues on a sane SUID binary, but this is what security in-depth is about. And being able to map a page in a SUID binary just feels wrong anyway :) Cheers, Julien
Current thread:
- Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable yersinia (Jul 17)
- Re: Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable Marcus Meissner (Jul 20)
- Re: Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable Solar Designer (Jul 20)
- Re: Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable Marcus Meissner (Jul 20)
- Re: Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable Solar Designer (Jul 20)
- Re: Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable Solar Designer (Jul 20)
- Re: Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable Solar Designer (Jul 20)
- Re: Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable Solar Designer (Jul 20)
- Re: Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable Marcus Meissner (Jul 20)
- Re: Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable Julien Tinnes (Jul 20)