“Most serious” Linux privilege-escalation bug ever is under active exploit

Re:“Most serious” Linux privilege-escalation bug ever is und... by kentonv on Saturday October 22, 2016 @03:43PM (#12770267)

https://bugzilla.redhat.com/show_bug.cgi?id=1384344#c13

> Please note that this mitigation disables ptrace functionality which debuggers and programs that inspect other processes (virus scanners) use and thus these programs won't be operational.

> The in the wild exploit we are aware of doesn't work on Red Hat Enterprise Linux 5 and 6 out of the box because on one side of the race it writes to /proc/self/mem, but /proc/self/mem is not writable on Red Hat Enterprise Linux 5 and 6.

Is everyone barking up the wrong tree here?

EDIT: All of the PoCs here use ptrace() or /proc/self/mem. Why would they do that if they didn't need to?

https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs

[ Parent | on HN ]

Re:“Most serious” Linux privilege-escalation bug ever is und... by kentonv on Monday October 24, 2016 @09:42PM (#12784569)

I just talked to amluto who explained that the race can only be triggered by a write that uses the "force" flag to get_user_pages() (a kernel function). /proc/pid/mem and ptrace() do this but regular writes and process_vm_writev() do not.

[ Parent | on HN ]