Re:Analysis and Exploitation of a Linux Kernel Vulnerability
by baghira on Tuesday January 19, 2016 @04:35PM
(#10934238)
That only hides the pid directories of others users, and indeed on my system remounting /proc with hidepid=2 I'm still able to see the same values for kallsyms. Maybe your kernel is compiled without the CONFIG_KEYS=y option? (I'm spitballing here).
[ Parent
| on HN ]
Re:Analysis and Exploitation of a Linux Kernel Vulnerability
by Maran on Tuesday January 19, 2016 @04:44PM
(#10934300)
It is indeed compiled with CONFIG_KEYS=y. Does this protect me against this issue? I'm not sure what this means.
Re:Analysis and Exploitation of a Linux Kernel Vulnerability
by baghira on Tuesday January 19, 2016 @05:32PM
(#10934626)
No, the bug is in the kernel keyring facility, so if I'm not mistaken compiling with CONFIG_KEYS=n option should protect you (I haven't tested though). As for the /proc/kallsyms, I honestly don't know how come you only get zeroes.
EDIT: The obvious question I should have asked is which distro you are running. Also, as others have pointed out, hoping that the attacker can't read kallsyms from the machine he's attacking is not really a good defense plan.
Re:Analysis and Exploitation of a Linux Kernel Vulnerability
by Maran on Wednesday January 20, 2016 @03:12AM
(#10936652)
I'm running Ubuntu 14.04 which should be affected. I just hoped it would be harder without having the correct kallsyms version. It seems I will have no options except to reboot my cluster :)