oss-sec mailing list archives
Re: New Linux LPE via GSMIOC_SETCONF_DLCI?
From: "Dr. Christopher Kunz" <info () christopher-kunz de>
Date: Thu, 11 Apr 2024 16:56:56 +0200
Hi,
The two exploit versions are for different kernels. The 6.5 exploit doesn't compile on the Debian 12 6.1 kernel, and no Debian version currently distributes a 6.5 kernel, AFAICT. I used ExploitGSM_5_15_to_6_1/ExploitGSM and it worked.There are two exploits in Yurii's repo above, according to Yurii for two different bugs. The above is one of them. Perhaps also try the other?
Possibly. I'm definitely out of my depth trying to analyze which bugs are being exploited.I don't know, and apparently it'd need to be two CVEs for two bugs that Yurii exploits.
CVE-2023-52564: Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux" https://lists.openwall.net/linux-cve-announce/2024/03/02/54 Maybe CVE-2023-52564 is one of the bugs Yurii exploits, or maybe not. I didn't look into this closely enough to tell.
Apparently not. Debian 12 "Bookworm" currently runs this kernel:Linux debianexploitgsm 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64 GNU/Linux
According to the changelog, this kernel has the fix for CVE-2023-52564 included:
- Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"(from https://metadata.ftp-master.debian.org/changelogs//main/l/linux-signed-amd64/linux-signed-amd64_6.1.76+1_changelog)
Still, the exploit works, so it must exploit a different issue. Just my two cents, --cku
Current thread:
- New Linux LPE via GSMIOC_SETCONF_DLCI? Dr. Christopher Kunz (Apr 10)
- Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Solar Designer (Apr 10)
- Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Solar Designer (Apr 16)
- Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Greg KH (Apr 16)
- Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Dr. Christopher Kunz (Apr 17)
- Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Solar Designer (Apr 16)
- Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Donald Buczek (Apr 11)
- Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Dr. Christopher Kunz (Apr 11)
- Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Solar Designer (Apr 11)
- Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Dr. Christopher Kunz (Apr 11)
- Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Kyle Zeng (Apr 11)
- Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Kyle Zeng (Apr 11)
- Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Solar Designer (Apr 11)
- Re: New Linux LPE via GSMIOC_SETCONF_DLCI? Solar Designer (Apr 10)