Analysis and Exploitation of a Linux Kernel Vulnerability

Re:Analysis and Exploitation of a Linux Kernel Vulnerability by tshtf on Tuesday January 19, 2016 @11:57AM (#10931959)

The blog post specifically thanks the Red Hat Security Team, but according to the Red Hat Bugzilla, no patch has been released yet for RHEL/CentOS:

This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 7 and will be addressed in a future update.

https://bugzilla.redhat.com/show_bug.cgi?id=1297475

Premature blog post?

[ Parent | on HN ]

Re:Analysis and Exploitation of a Linux Kernel Vulnerability by rolandr on Tuesday January 19, 2016 @12:43PM (#10932330)

Given that it looks like commits were just made 12 days ago (https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux....) or possibly as recently as 38 hours ago (https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux....), perhaps only 4.4 has the fix?

[ Parent | on HN ]

Re:Analysis and Exploitation of a Linux Kernel Vulnerability by LinuxBender on Tuesday January 19, 2016 @12:21PM (#10932144)

Tested on CentOS 7, fully patched.

    [ohadmin@localhost shm]$ ./cve_2016_0728 PP_KEY
    uid=99990, euid=99990
    Increfing...

This is taking a long time. I disabled SELinux and it has been cranking away for a while now.

    PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
    1140 ohadmin   20   0    8428    388    296 R 100.0  0.0   9:25.17 cve_2016_0728

No need to test on CentOS 6. Forgot how ancient that kernel is.

Update: I am not having any luck getting this to work on CentOS 7. I even completely disabled SELinux (selinux=0 vs setenforce 0) Anyone else getting this to work?

[ Parent | on HN ]

Re:Analysis and Exploitation of a Linux Kernel Vulnerability by ryanlol on Tuesday January 19, 2016 @12:25PM (#10932178)

That's not how you execute binaries, just "./cve_2016_0728 PP_KEY" is the correct syntax

[ Parent | on HN ]

Re:Analysis and Exploitation of a Linux Kernel Vulnerability by LinuxBender on Tuesday January 19, 2016 @01:36PM (#10932786)

Yes sorry. I will make the cheap excuse that I am recovering from food poisoning and don't quite have it all together. Thankfully I don't manage nuclear weapons, so we are all safe for now.

[ Parent | on HN ]

Re:Analysis and Exploitation of a Linux Kernel Vulnerability by 16 on Tuesday January 19, 2016 @02:25PM (#10933224)

You need to update the addresses of commit_creds() and prepare_kernel_cred() as per this: https://news.ycombinator.com/item?id=10931954

[ Parent | on HN ]

Re:Analysis and Exploitation of a Linux Kernel Vulnerability by LinuxBender on Wednesday January 20, 2016 @03:26PM (#10941068)

The best I can get is an oops panic on CentOS 7.

It appears smaps may be preventing the exploit from working.

[ Parent | on HN ]