full-disclosure - Linux kernel brk() log reports

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200312042246.hB4MkHps019817@turing-police.cc.vt.edu>
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: Linux kernel brk() log reports 

On Thu, 04 Dec 2003 12:49:47 PST, David Hane <dlhane@...global.net>  said:
> I am using logcheck to report unusual system events on several systems. I was
> wondering if anyone could give me an example of a log message showing an
> attempt to make use this exploit? I would like to put a sample in my
> logcheck.hacking file.

One of two things happens:

1) The exploit works correctly.  You probably don't get any log messages that
logcheck can report.

2) The exploit bombs.  Your kernel OOPSes.  Your logcheck should already be
making note of OOPS and PANIC anyhow.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20031204/1bf9a9b1/attachment.bin