full-disclosure - Mr. Magorium's Wunderbar Emporium

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090814185306.GA11452@grsecurity.net>
Date: Fri, 14 Aug 2009 14:53:06 -0400
From: spender@...ecurity.net (Brad Spengler)
To: dailydave@...ts.immunitysec.com, full-disclosure@...ts.grok.org.uk
Subject: Mr. Magorium's Wunderbar Emporium

For those who have been living under a rock for the past two days, an 
exploit exists for Julien Tinnes/Tavis Ormandy's sendpage vulnerability 
in all Linux kernels since 2001.

My exploit works on 2.4, 2.6, x86, x64, 4k stacks, 8k stacks, 
with/without cred framework, bypasses mmap_min_addr in any public way 
possible (auto-detecting which method to use).
As always, while in ring0 it provides the added convenience of disabling 
auditing, SELinux, AppArmor, and all other LSM modules.  If SELinux is 
enforcing, it will also rewrite the SELinux code to fool userland into 
thinking it remains in enforcing mode.

And if the machine supports it, it'll play a nice video for you in your 
terminal.  See http://www.youtube.com/watch?v=arAfIp7YzZ4 for a demo.

I wanted to implement a more interactive sense of russian roulette in 
the exploit, with a randomly-generated 1 in 6 chance of hot rebooting 
the machine into FreeDOS (first exploit to reboot you into a secure 
operating system) but I don't have time -- I'm off to Miami!

"Congrats" Linus on screwing over all the vendors and every Linux user 
by forcing disclosure of the bug before vendors could ship out updated 
kernels.  Your patch applies well to their binary packages.

-Brad

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/