full-disclosure - Re: Linux Local Root -- CVE-2012-0056 -- Detailed Write-up

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 23 Jan 2012 04:13:22 +0100
From: "Jason A. Donenfeld" <Jason@...c4.com>
To: mark cunningham <markcunninghamemail@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Linux Local Root -- CVE-2012-0056 -- Detailed
	Write-up

Hey Mark,

For the longest time /proc/pid/mem writing was ifdef'd out. Then for
the 2.6.39 kernel release, they deemed that the work they'd been doing
to make the writing interface secure was strong enough, so they
included the ability to write [1]. So versions before 2.6.39 are not
vulnerable, and after it (until 3.3, I guess) are. Hope this
clarifies.

Jason

[1] http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=198214a7

On Mon, Jan 23, 2012 at 04:09, mark cunningham
<markcunninghamemail@...il.com> wrote:
> Hey great write up on the exploit, sorry for contacting you off list.
> From your post I gather it's only 2.6.39 that's vulnerable right?
> http://security-tracker.debian.org/tracker/CVE-2012-0056 is showing
> that lower versions are "fixed" and just "not vulerable" and I
> coulnd't get it to work with kernel 2.6.32, but figured maybe there
> was a chance it still worked for all of 2.6 as i see linus has
> commited it to 2.6
>
> Mark
>
> On Sun, Jan 22, 2012 at 6:19 PM, Jason A. Donenfeld <Jason@...c4.com> wrote:
>> Hey Everyone,
>>
>> I did a detailed write-up on exploiting CVE-2012-0056 that some of
>> y'all might appreciate. Pretty fun bug to play with -- dup2ing all
>> over the place for the prize of getting to write arbitrary process
>> memory into su :-).
>>
>> The write up is available on my blog here: http://blog.zx2c4.com/749 . Enjoy.
>>
>> Jason
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/