full-disclosure - linux bugs (survival stories)?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200504130212.j3D2CNvC009470@turing-police.cc.vt.edu>
Date: Wed Apr 13 03:12:42 2005
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: linux bugs (survival stories)? 

On Tue, 12 Apr 2005 22:21:43 -0000, Eduardo Tongson said:

> % sudo mount -o remount,noexec /tmp
> % wget http://pornadmin.net/~tongson/linux/helloworld.bin -O /tmp/helloworld.
bin
> % /lib/ld-linux.so.2 /tmp/helloworld.bin
> Hello world!

# uname -a
Linux turing-police.cc.vt.edu 2.6.12-rc2-mm3 #1 PREEMPT Mon Apr 11 23:01:01 EDT 2005 i686 i686 i386 GNU/Linux
# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) context=root:sysadm_r:sysadm_t
# mount -o remount,noexec /tmp
# cat > hello2.c
##include <stdio.h>
int main(int argc, char *argv[])   
{       
  printf("Hello world!\n");
  return 0;
}
# gcc -o /tmp/helloworld hello2.c
# ls -l /tmp/helloworld
-rwxr-xr-x  1 root root 4704 Apr 12 22:05 /tmp/helloworld
# /lib/ld-linux.so.2 /tmp/helloworld
/tmp/helloworld: error while loading shared libraries: /tmp/helloworld: failed to map segment from shared object: Operation not permitted
# chmod 644 /tmp/helloworld
# /lib/ld-linux.so.2 /tmp/helloworld
/tmp/helloworld: error while loading shared libraries: /tmp/helloworld: failed to map segment from shared object: Operation not permitted

Like I said, this one was closed with Ulrich Drepper's patch applied in 2.6.0,
which was released on Dec 17, 2003.  So it's only been fixed for some 15 months
or so in the current stable kernel.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050412/04f8137d/attachment.bin