full-disclosure - Re: Second critical mremap() bug found in all Linux kernels

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: devine at iie.cnam.fr (Christophe Devine)
Subject: Re: Second critical mremap() bug found in all Linux kernels

Paul Starzetz <ihaquer@...c.pl> wrote:

> > This PoC exploit can be used to check if a Linux system is vulnerable
> > to the second do_mremap() bug; the code has only been tested on Linux
> > version 2.4.22 so far

> please do not post any exploit code(s) before a proper grace period.

Of course, I have no intention of releasing a local root exploit so early -
in fact I'm not even sure exactly how to exploit this bug in order to gain
elevated privileges. By the way, I'd like to apologize for not giving proper
credits to iSEC in the last two do_mremap() proof-of-concept exploit codes
I've posted on full-disclosure.

Christophe.