full-disclosure - Re: Linux kernel i386 SMP page fault handler privilege escalation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44.0501131723110.4954-100000@isec.pl>
From: ihaquer at isec.pl (Paul Starzetz)
Subject: Re: Linux kernel i386 SMP page fault handler
	privilege escalation

On Thu, 13 Jan 2005, Christophe Devine wrote:

> Exploiting the race condition itself is quite tricky, especially if the
> system load is high. The following proof-of-concept code may be used to
> check if an x86 SMP kernel is vulnerable; it is a bit unreliable though.

That is not really correct. Exploiting this race condition is very easy, 
however it is always difficult to exploit SMP race conditions if the load 
is high, since you must achieve parallel execution of two threads and the 
scheduler may prevent you from parallel execution in that case.

-- 
Paul Starzetz
iSEC Security Research
http://isec.pl/