Re: [gentoo-hardened] about the recent ELF kernel bug

[Pedro Venda]

On Sunday 15 May 2005 16:25, Kevin F. Quinn wrote:
> On 13/5/2005 16:09:23, Pedro Venda (pjvenda@××××××××××××.org) wrote:
> > On a PaX+grsecurity hardened server, it outputs:
> > ...
> > [+] phase2, <RET> to crash Killed
>
> What kernel version?
>
> The hardened 2.6.11.1 kernel is not vulnerable to the exploit as described,
> because the bug used to trigger the feature is not present.  If you read
> all the way through http://isec.pl/vulnerabilities/isec-0023-coredump.txt
> and compare it with the 2.6.11 kernel source, you'll see that although the
> arithmetic error is present (see fill_psinfo()), the bug used to get to it
> is not.  See https://bugs.gentoo.org/show_bug.cgi?id=92264
>
> This doesn't mean necessarily that there is not another way to exploit it.
> Exercise for the reader to find one ;)
>
> > On my laptop, a test server and 2 other workstations (standard 2.6.11.5-8
> > kernels) [...]
> > [+] phase 2, <RET> to crash Segmentation fault (core dumped)
>
> I haven't checked all kernel versions, but the vanilla 2.6.11.7 prevents
> the exploit in the same way as the hardened kernel.  The difference between
> killed and core dump may be due to the grsecurity/pax patches, or could
> simply be differences between 2.6.11.1 and 2.6.11.7 (i.e. nothing to do
> with hardened).  Either way, the exploit fails - not because of anything
> particular in the hardened kernel, but due to better written upstream code
> in create_elf_tables().

thanks for the explanations.

regards,
pedro venda.

-- 

Pedro João Lopes Venda
email: pjvenda < at > arrakis.dhis.org
http://arrakis.dhis.org