oss-sec mailing list archives
CLONE_NEWUSER|CLONE_FS root exploit
From: Sebastian Krahmer <krahmer () suse de>
Date: Wed, 13 Mar 2013 16:39:56 +0100
Hi, Seems like CLONE_NEWUSER|CLONE_FS might be a forbidden combination. During evaluating the new user namespace thingie, it turned out that its trivially exploitable to get a (real) uid 0, as demonstrated here: http://stealth.openwall.net/xSports/clown-newuser.c The trick is to setup a chroot in your CLONE_NEWUSER, but also affecting the parent, which is running in the init_user_ns, but with the chroot shared. Then its trivial to get a rootshell from that. Tested on a openSUSE12.1 with a custom build 3.8.2 (x86_64). I hope I didnt make anything wrong, mixing up the UIDs, or disabled important checks during kernel build on my test system. ;) regards, Sebastian -- ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer () suse de - SuSE Security Team
Current thread:
- CLONE_NEWUSER|CLONE_FS root exploit Sebastian Krahmer (Mar 13)
- Re: CLONE_NEWUSER|CLONE_FS root exploit Kees Cook (Mar 13)
- Re: CLONE_NEWUSER|CLONE_FS root exploit Eugene Teo (Mar 13)
- Re: CLONE_NEWUSER|CLONE_FS root exploit Eugene Teo (Mar 13)
- Re: CLONE_NEWUSER|CLONE_FS root exploit Greg KH (Mar 13)
- Re: CLONE_NEWUSER|CLONE_FS root exploit Agostino Sarubbo (Mar 18)
- Re: CLONE_NEWUSER|CLONE_FS root exploit Eugene Teo (Mar 13)
- Re: CLONE_NEWUSER|CLONE_FS root exploit Kurt Seifried (Mar 13)