oss-sec mailing list archives
Re: Qualys Security Advisory - The Stack Clash
From: Qualys Security Advisory <qsa () qualys com>
Date: Wed, 28 Jun 2017 10:45:37 -0700
Hi all, On Mon, Jun 26, 2017 at 02:35:57AM +0200, Solar Designer wrote:
The decision to wait for fixes in major distros that almost certainly do intend to release fixes makes sense to me.
Thank you. Since Fedora and Slackware published their updates, and FreeBSD and NetBSD published their patches (and our *BSD POCs are not full-fledged exploits anyway), we attached our Stack Clash exploits and POCs to this mail (alternatively, they are also available at https://www.qualys.com/research/security-advisories/). A few notes on the Linux ld.so exploits: - Linux_ldso_dynamic's probability of success varies significantly from one SUID binary to another, because it depends on the size of the .dynamic, .data, and .bss sections of the SUID binary. - Linux_ldso_hwcap's probability of success depends on the length of the path to the SUID binary -- as a rule of thumb, the longer the path, the higher the probability of success. - On Fedora and CentOS, Linux_ldso_hwcap_64 may not work against "short-path" SUID binaries, but it works against the "long-path" SUIDs that are installed by default (for example, /usr/lib/polkit-1/polkit-agent-helper-1). Moreover, we wrote a quick-and-dirty version of this exploit that does work against the SUIDs in /usr/bin (it does not hardcode the 96KB/32KB sizes of argv[] pointers/free stack space, but instead optimizes these sizes). However, we wanted to keep the main loop of this exploit as simple as possible, and this improvement is therefore left as an exercise for the interested reader. We are at your disposal for questions, comments, and further discussions. Thank you very much! With best regards, -- the Qualys Security Advisory team Give 'Em Enough ROP --The Clash, second studio album
Attachment:
FreeBSD_CVE-2017-1085.c
Description:
Attachment:
FreeBSD_CVE-2017-FGPE.c
Description:
Attachment:
FreeBSD_CVE-2017-FGPU.c
Description:
Attachment:
Linux_ldso_dynamic.c
Description:
Attachment:
Linux_ldso_hwcap_64.c
Description:
Attachment:
Linux_ldso_hwcap.c
Description:
Attachment:
Linux_offset2lib.c
Description:
Attachment:
NetBSD_CVE-2017-1000375.c
Description:
Attachment:
OpenBSD_at.c
Description:
Attachment:
Solaris_rsh.c
Description:
Current thread:
- Qualys Security Advisory - The Stack Clash Qualys Security Advisory (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash kseifried () redhat com (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash Daniel Micay (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash Marcus Meissner (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash Solar Designer (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash Solar Designer (Jun 20)
- Re: Qualys Security Advisory - The Stack Clash Qualys Security Advisory (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash nospam (Jun 21)
- Re: Re: Qualys Security Advisory - The Stack Clash Franz Pletz (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Solar Designer (Jun 25)
- Re: Qualys Security Advisory - The Stack Clash Qualys Security Advisory (Jun 28)
- Re: Qualys Security Advisory - The Stack Clash Daniel Micay (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash kseifried () redhat com (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash Josh Bressers (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Solar Designer (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Stuart Henderson (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash kseifried () redhat com (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Qualys Security Advisory (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Jeff Law (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Daniel Micay (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Florian Weimer (Jun 22)
- Re: Qualys Security Advisory - The Stack Clash Brad Spengler (Jun 21)