Comments on cr0 blog: Linux NULL pointer dereference due to incorrect pr...

I have no idea

2009-11-30T10:28:05.134-08:00

I have no idea

@John: I have no idea what you're talking abou...

2009-09-27T12:41:41.973-07:00

@John: I have no idea what you're talking about. We also worked on the patch, which was released even before the advisory.

I even link to it from the blog post.

Is it not normal procedure to inform the Kernel ma...

2009-09-26T14:59:35.565-07:00

Is it not normal procedure to inform the Kernel maintainers before publishing an exploit to the world? It took until 13th August for a patch to be released.

oo thanx bro. good bilgi..

2009-09-07T14:15:24.640-07:00

oo thanx bro. good bilgi..

http://www.doecirc.energy.gov/bulletins/t-217.shtm...

2009-08-27T03:33:01.888-07:00

http://www.doecirc.energy.gov/bulletins/t-217.shtml
Julien can u give more info about this vuln and how to trigger it.
thanks

It did exploit Fedora SELinux up until August 13, ...

2009-08-16T17:23:01.449-07:00

It did exploit Fedora SELinux up until August 13, then was patched. I successfully exploited Kernel 2.6.29.6-213.fc11.i586 with this mechanism.

my fedora 11 with SELinux enforcing is also safe, ...

2009-08-16T02:30:29.104-07:00

my fedora 11 with SELinux enforcing is also safe, the exploit doesnt work or did i miss something?

This definetly does not work on fedora with selinu...

2009-08-15T23:43:41.435-07:00

This definetly does not work on fedora with selinux enforcing.

Here's a reply to some of the comments (not al...

2009-08-15T09:13:07.778-07:00

Here's a reply to some of the comments (not all, sorry):

- @Anonymous: you're correct, about SPARC. Interestingly, IA32 could also be safe but is not for performances reasons (unless you use Linux 2.0 or PaX KERNEXEC/UDEREF). x86_64 however killed segmentation :(
- About mapping to Null. This should be protected by mmap_min_addr since Linux 2.6.23. Last month, Tavis and I published a way to bypass it by using personalities and Pulseaudio. Brad Spengler then implemented this technique in an exploit and noticed that it worked even without the Pulseaudio trick. The reason was the default SELinux policy allowing unconfined users to mmap at address zero.

So there's actually two bugs. One is NULL poin...

2009-08-15T08:06:25.221-07:00

So there's actually two bugs. One is NULL pointer dereference and the other is allowing to mmap (presumably unmmapable) memory at 0x0 location (even if /proc/sys/vm/mmap_min_addr > 0).

Fedora's SELinux policy (asuuming you leave it...

2009-08-15T03:00:53.346-07:00

Fedora's SELinux policy (asuuming you leave it enforcing) protects from the exploit (runcon can't change the type).

Doesn't work with SELinux, although you claim ...

2009-08-14T13:43:16.343-07:00

Doesn't work with SELinux, although you claim the opposite in the source:

sh wunderbar_emporium.sh
runcon: invalid context:
unconfined_u:unconfined_r:initrc_t:s0-s0:c0.c1023: Invalid argument
UNABLE TO MAP ZERO PAGE!

and the raw audit message for this:
localhost.localdomain type=AVC msg=audit(1250278420.753:27501): avc: denied { mmap_zero } for pid=16933 comm="exploit" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=memprotect

So obviously you were to fast when you thanked Dan for "great SELinux bypass".

Looks like you where to fast when you thanked Dan,...

2009-08-14T12:46:38.877-07:00

Looks like you where to fast when you thanked Dan, because SELinux does indeed stop this:

$ LANG=C sh wunderbar_emporium.sh
runcon: invalid context:
unconfined_u:unconfined_r:initrc_t:s0-s0:c0.c1023: Invalid argument
UNABLE TO MAP ZERO PAGE!

Why can't the kernel track the process that ma...

2009-08-14T12:29:18.170-07:00

Why can't the kernel track the process that map page zero and does extra stuff when switching from user mode to kernel mode (update mmu to make it not excecutable, ...)

Of course this will slowdown these processes but are there performance program that depend of that ?
Wine ?

UNABLE TO MAP ZERO PAGE! on up to date Fedora with...

2009-08-14T12:04:12.233-07:00

UNABLE TO MAP ZERO PAGE! on up to date Fedora with SELinux. Problem addressed by Red Hat when fixing CVE-2009-1895 recently?

Don't use the one from securityfocus, they hav...

2009-08-14T08:32:18.250-07:00

Don't use the one from securityfocus, they have an old version of the exploit.

Looks like it's finally kernel upgrade time! G...

2009-08-14T07:13:50.390-07:00

Looks like it's finally kernel upgrade time!
Goodbye Linux_2.6.19, I'll miss you.

Codifex

Yet another reason to use some alternative with be...

2009-08-14T03:42:32.834-07:00

Yet another reason to use some alternative with better track record wrt security, like Solaris or *BSD.

Congrats for the discover !

2009-08-14T01:20:42.120-07:00

Congrats for the discover !

Can anybody explain why http://www.securityfocus.c...

2009-08-14T01:12:17.499-07:00

Can anybody explain why http://www.securityfocus.com/bid/36038/exploit only works once?

Exploit code has been available at http://grsecuri...

2009-08-13T21:39:50.614-07:00

Exploit code has been available at http://grsecurity.net/~spender/wunderbar_emporium.tgz

Works on all affected kernels: both x86 and x64, 4k stacks or 8k stacks, cred framework or not. Disables SELinux, AppArmor, LSM, and auditing. Also plays an embedded movie if the host is up to it.

-Brad

Good find, great work.

2009-08-13T19:23:24.738-07:00

Good find, great work.

> This is one reason so many 64b systems > (...

2009-08-13T18:04:52.123-07:00

> This is one reason so many 64b systems
> (Tru64 on Alpha being a good example
> prevent mapping the first 32 bits of
> address space. Surprising that Linux
> doesn't do the same.

?? First of all - the whole problem has nothing to do with architecture of the used CPU (intel, non-intel, 32bit, 64bit).

Secondly - Linux also offers such protection, but it was somehow flawed until one of the kernel versions

3rdly - It is guaranteed on some systems (SVR4) that the fisrt page is always mapped (PROT_READ afair), so linux tries to emulate that behavior via the personality mechanism - http://linux.die.net/man/2/personality - and that is where the bug lied (the one with mapping zero page).

This is one reason so many 64b systems (Tru64 on A...

2009-08-13T15:59:16.515-07:00

This is one reason so many 64b systems (Tru64 on Alpha being a good example) prevent mapping the first 32 bits of address space. Surprising that Linux doesn't do the same.

http://www.securityfocus.com/bid/36038/exploit bee...

2009-08-13T14:56:18.788-07:00

http://www.securityfocus.com/bid/36038/exploit
beer please now