Analysis and Exploitation of a Linux Kernel Vulnerability

Re:Analysis and Exploitation of a Linux Kernel Vulnerability by baghira on Tuesday January 19, 2016 @02:17PM (#10933147)

If you have SMAP, i.e. an Haswell or newer Intel CPU, you should not be vulnerable, so that could be an explanation.

[ Parent | on HN ]

Re:Analysis and Exploitation of a Linux Kernel Vulnerability by javanix on Tuesday January 19, 2016 @04:13PM (#10934080)

Is SMAP required for mitigation, or is SMEP enough?

IIUC SMEP is on Sandy Bridge processors too.

[ Parent | on HN ]

Re:Analysis and Exploitation of a Linux Kernel Vulnerability by benmmurphy on Tuesday January 19, 2016 @06:12PM (#10934853)

SMEP would stop this particular exploit because it returns into usermode but SMEP is trivial to bypass on linux if there is no KASLR or other mitigation (apparently there are compiler plugins that remove popular stack pivot gadgets).

[ Parent | on HN ]

Re:Analysis and Exploitation of a Linux Kernel Vulnerability by baghira on Tuesday January 19, 2016 @04:20PM (#10934133)

According the lwn comments it should be sufficient (and the post by perception-point suggests that it would at least make things more difficult), but I haven't the hardware to test for myself.

[ Parent | on HN ]

Re:Analysis and Exploitation of a Linux Kernel Vulnerability by cmurf on Tuesday January 19, 2016 @05:03PM (#10934449)

I have Sandy Bridge, i7-2820QM. The exploit code has been running for nearly an hour, still "Increfing..."

EDIT:

    [chris@f23m cve20160728]$ ./cve_2016_0728 PP_KEY
    uid=1000, euid=1000
    Increfing...
    finished increfing
    forking...
    finished forking
    caling revoke...
    uid=1000, euid=1000
    sh-4.3$

[ Parent | on HN ]