Re: Kernel: 2.6.32+ IP_RETOPTS Buffer Poisoning DoS hemlock.c

[Steven Ciaburri <steve () rack911 com>]

Kurt,

I just loaded a a virtual machine at Rackspace Cloud running RHEL. It is a Xen based VM.

[steven@rhel ~]$ ./a.out
[+] giving ourselves some poison...
[+] polluted kernelspace with more crap
[+] polluted kernelspace with more crap
[+] polluted kernelspace with more crap
[+] polluted kernelspace with more crap
[+] polluted kernelspace with more crap
[+] polluted kernelspace with more crap
[+] polluted kernelspace with more crap

at which point the server kernel paniced. 

The server is running 2.6.32-358.11.1.el6.x86_64
I did discover that it appears with SELINUX enabled the POC can go through a considerable amount of tries before it 
crashes.

On 6/30/2013 4:04 PM, Kurt Seifried wrote:
> On 06/30/2013 05:00 PM, Kurt Seifried wrote:
> > Works great on CentOS 6, can't get it to work on RHEL 6 so far. 
> > Attaching PoC in case the web site goes down or something.
>
> And that wasn't meant to go to oss-sec (sleep deprivation FTW!),
> apologies.