Analysis and Exploitation of a Linux Kernel Vulnerability

Re:Analysis and Exploitation of a Linux Kernel Vulnerability by juhanima on Tuesday January 19, 2016 @01:12PM (#10932569)

Arch seems to be kosher

  $ uname -r
  4.3.3-2-ARCH

No root:

  $ ./cve_2016_0728 PP_KEY
  uid=1000, euid=1000
  Increfing...
  finished increfing
  forking...
  finished forking
  caling revoke...
  uid=1000, euid=1000

Only took about 25 minutes on a Lenovo core i7. That's kind of scary.

EDIT: Actually it seems that atomic_t is 64 bits long with x86_64 these days, so no hope of overflowing.

[ Parent | on HN ]

Re:Analysis and Exploitation of a Linux Kernel Vulnerability by 16 on Tuesday January 19, 2016 @02:24PM (#10933207)

Arch is not kosher. You need to do this: https://news.ycombinator.com/item?id=10931954

[ Parent | on HN ]

Re:Analysis and Exploitation of a Linux Kernel Vulnerability by juhanima on Tuesday January 19, 2016 @04:51PM (#10934362)

I did. I still maintain that the reason why the exploit doesn't work is this:

include/asm-generic/atomic-long.h:

  #if BITS_PER_LONG == 64
  typedef atomic64_t atomic_long_t;
  ...
  #else
  typedef atomic_t atomic_long_t;

Just checking it with a 32-bit VM with the latest upstream kernel.

EDIT: No, I was wrong. atomic_t is 32 bits also with 64 bit architecture. Must be something else then, let's see.

[ Parent | on HN ]