oss-sec mailing list archives
Re: CVE-2014-7975: 0-day umount denial of service
From: Andy Lutomirski <luto () amacapital net>
Date: Thu, 09 Oct 2014 08:56:20 -0700
On 10/09/2014 04:06 AM, rf-PKu+Ek1N2UGzQB+pC5nmwQ () public gmane org wrote:
"Andy" == Andy Lutomirski <luto-kltTT9wpgjJwATOyAt5JVQ () public gmane org> writes:Andy> I just screwed up and typoed my git send-email command, so Andy> there's now a publicly available exploit for a new umount bug. Andy> Fortunately this one isn't terribly serious, but it might be Andy> usable for more than just DoS if some daemon reacts poorly to Andy> being unable to write to the filesystem. Andy> http://thread.gmane.org/gmane.linux.kernel.stable/109312 Hmm, what damage is this supposed to do? I get (3.12.29): ql-front-t:/dev/pts# /root/remount-exploit /dev remount_ro, a DoS by Andy Lutomirski remount-exploit: umount: Device or resource busy Maybe you should specify what versions are supposed to be vulnerable
The PoC does pretty much the same thing as # mount -o remount,ro TARGET but it doesn't require privilege to run. Due to the way that Linux handles filesystem business, it is unlikely to work on filesystems that have anything open for writing. (It works on my Fedora system targetting /dev.) The upshot is that it may be difficult to exploit in any meaningful way on some systems. It may also work more reliably against network filesystems. I'm not really sure. That output means that you're vulnerable. You would have gotten something like "Permission denied" if you weren't vulnerable. --Andy
Current thread:
- CVE-2014-7975: 0-day umount denial of service Andy Lutomirski (Oct 08)
- Re: CVE-2014-7975: 0-day umount denial of service rf (Oct 09)
- Re: CVE-2014-7975: 0-day umount denial of service Andy Lutomirski (Oct 09)
- Re: CVE-2014-7975: 0-day umount denial of service rf (Oct 09)