full-disclosure - [SECURITY] [DSA-403-1] userland can access Linux kernel memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44.0312021207090.1682-100000@isec.pl>
From: cliph at isec.pl (Wojciech Purczynski)
Subject: [SECURITY] [DSA-403-1] userland can access
 Linux kernel memory

> > Recently multiple servers of the Debian project were compromised using a
> > Debian developers account and an unknown root exploit. Forensics
> > revealed a burneye encrypted exploit. Robert van der Meulen managed to
> > decrypt the binary which revealed a kernel exploit. Study of the exploit
> > by the RedHat and SuSE kernel and security teams quickly revealed that
> > the exploit used an integer overflow in the brk system call. Using
> > this bug it is possible for a userland program to trick the kernel into
> > giving access to the full kernel address space. This problem was found
> > in September by Andrew Morton, but unfortunately that was too late for
> > the 2.4.22 kernel release.

This is not an integer overflow bug. do_brk() doesn't verify its arguments
at all, allowing to create arbitrarily large virtual memory mapping (vma)
consuming kernel memory.

Regards,
wp

-- 
Wojciech Purczynski
iSEC Security Research
http://isec.pl/