Full Disclosure mailing list archives
Re: Linux Local Root -- CVE-2012-0056 -- Detailed Write-up
From: "Jason A. Donenfeld" <Jason () zx2c4 com>
Date: Mon, 23 Jan 2012 04:13:22 +0100
Hey Mark, For the longest time /proc/pid/mem writing was ifdef'd out. Then for the 2.6.39 kernel release, they deemed that the work they'd been doing to make the writing interface secure was strong enough, so they included the ability to write [1]. So versions before 2.6.39 are not vulnerable, and after it (until 3.3, I guess) are. Hope this clarifies. Jason [1] http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=198214a7 On Mon, Jan 23, 2012 at 04:09, mark cunningham <markcunninghamemail () gmail com> wrote:
Hey great write up on the exploit, sorry for contacting you off list. From your post I gather it's only 2.6.39 that's vulnerable right? http://security-tracker.debian.org/tracker/CVE-2012-0056 is showing that lower versions are "fixed" and just "not vulerable" and I coulnd't get it to work with kernel 2.6.32, but figured maybe there was a chance it still worked for all of 2.6 as i see linus has commited it to 2.6 Mark On Sun, Jan 22, 2012 at 6:19 PM, Jason A. Donenfeld <Jason () zx2c4 com> wrote:Hey Everyone, I did a detailed write-up on exploiting CVE-2012-0056 that some of y'all might appreciate. Pretty fun bug to play with -- dup2ing all over the place for the prize of getting to write arbitrary process memory into su :-). The write up is available on my blog here: http://blog.zx2c4.com/749 . Enjoy. Jason _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Linux Local Root -- CVE-2012-0056 -- Detailed Write-up, (continued)
- Re: Linux Local Root -- CVE-2012-0056 -- Detailed Write-up sd (Jan 23)
- Re: Linux Local Root -- CVE-2012-0056 -- Detailed Write-up Jason A. Donenfeld (Jan 23)
- Re: Linux Local Root -- CVE-2012-0056 -- Detailed Write-up Jason A. Donenfeld (Jan 23)
- Re: Linux Local Root -- CVE-2012-0056 -- Detailed Write-up sd (Jan 24)
- Message not available
- Re: Linux Local Root -- CVE-2012-0056 -- Detailed Write-up Jason A. Donenfeld (Jan 24)
- Re: Linux Local Root -- CVE-2012-0056 -- Detailed Write-up Jason A. Donenfeld (Jan 22)
- Re: Linux Local Root -- CVE-2012-0056 -- Detailed Write-up Jeffrey Walton (Jan 22)
- Re: Linux Local Root -- CVE-2012-0056 -- Detailed Write-up Jason A. Donenfeld (Jan 23)
- Re: Linux Local Root -- CVE-2012-0056 -- Detailed Write-up Jason A. Donenfeld (Jan 22)
- Re: Linux Local Root -- CVE-2012-0056 -- Detailed Write-up halfdog (Jan 23)