| 1 |
-----BEGIN PGP SIGNED MESSAGE----- |
| 2 |
Hash: SHA1 |
| 3 |
|
| 4 |
|
| 5 |
Hi everyone, |
| 6 |
|
| 7 |
All kernels before Sept 14 are vulnerable to the "IA32 Syscall Entry |
| 8 |
Point Privilege Escalation" and "IA32 Emulation Stack Underflow". See |
| 9 |
|
| 10 |
http://bugs.gentoo.org/show_bug.cgi?id=337645 |
| 11 |
http://bugs.gentoo.org/show_bug.cgi?id=337659 |
| 12 |
|
| 13 |
Also see |
| 14 |
|
| 15 |
https://bugs.gentoo.org/show_bug.cgi?id=326885#c10 |
| 16 |
|
| 17 |
|
| 18 |
As a result, certain configurations of hardened-sources are also |
| 19 |
vulnerable. As a work around until I get the fix into the tree and fast |
| 20 |
track stabilization, keep the following in mind: |
| 21 |
|
| 22 |
|
| 23 |
1) Whether hardened or not, if you don't have CONFIG_IA32_EMULATION, the |
| 24 |
exploits fail. |
| 25 |
|
| 26 |
|
| 27 |
2) If you hide kernel symbols in /proc/kallsyms, the proof-of-concept |
| 28 |
code won't work. You can do that by either not enabling CONFIG_KALLSYMS |
| 29 |
on non-hardened kernels, or just set CONFIG_GRKERNSEC_HIDESYM=y on |
| 30 |
hardened. |
| 31 |
|
| 32 |
(However, there may still be ways of making the exploit work even |
| 33 |
without symbol info.) |
| 34 |
|
| 35 |
|
| 36 |
3) On hardened systems, if you enable CONFIG_PAX_MEMORY_UDEREF=y, the |
| 37 |
exploits fail even with access to symbol info. If possible, I would |
| 38 |
also recommend enabling CONFIG_PAX_KERNEXEC=y. |
| 39 |
|
| 40 |
|
| 41 |
- -- |
| 42 |
Anthony G. Basile, Ph.D. |
| 43 |
Gentoo Developer |
| 44 |
-----BEGIN PGP SIGNATURE----- |
| 45 |
Version: GnuPG v2.0.16 (GNU/Linux) |
| 46 |
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ |
| 47 |
|
| 48 |
iEYEARECAAYFAkySiOIACgkQl5yvQNBFVTUZzQCeMolKjTKql6/ShNRtYSH/K1DM |
| 49 |
thUAmwTJOrYbB1wJ4A+FlPDu78tc55AT |
| 50 |
=xfQc |
| 51 |
-----END PGP SIGNATURE----- |
Archives