[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20090814185306.GA11452@grsecurity.net>
Date: Fri, 14 Aug 2009 14:53:06 -0400
From: spender@...ecurity.net (Brad Spengler)
To: dailydave@...ts.immunitysec.com, full-disclosure@...ts.grok.org.uk
Subject: Mr. Magorium's Wunderbar Emporium
For those who have been living under a rock for the past two days, an
exploit exists for Julien Tinnes/Tavis Ormandy's sendpage vulnerability
in all Linux kernels since 2001.
My exploit works on 2.4, 2.6, x86, x64, 4k stacks, 8k stacks,
with/without cred framework, bypasses mmap_min_addr in any public way
possible (auto-detecting which method to use).
As always, while in ring0 it provides the added convenience of disabling
auditing, SELinux, AppArmor, and all other LSM modules. If SELinux is
enforcing, it will also rewrite the SELinux code to fool userland into
thinking it remains in enforcing mode.
And if the machine supports it, it'll play a nice video for you in your
terminal. See http://www.youtube.com/watch?v=arAfIp7YzZ4 for a demo.
I wanted to implement a more interactive sense of russian roulette in
the exploit, with a randomly-generated 1 in 6 chance of hot rebooting
the machine into FreeDOS (first exploit to reboot you into a secure
operating system) but I don't have time -- I'm off to Miami!
"Congrats" Linus on screwing over all the vendors and every Linux user
by forcing disclosure of the bug before vendors could ship out updated
kernels. Your patch applies well to their binary packages.
-Brad
Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists