Comments on cr0 blog: Interesting vulnerability in udevd

Hello there, I was experimenting with this vulner...

2009-08-15T10:22:50.852-07:00

Hello there,

I was experimenting with this vulnerability on a box that had 'noexec' enabled on all partitions, so, I was unable to use the LD_PRELOAD technique. Instead I coded a python exploit (yeap not affected by noexec) that makes use of all the ideas discussed here :-)

It replaces /dev/urandom with /dev/mem (/dev/sda, /dev/hda are also ok!). What's really interesting is the fact that this always results in a device mode equal to 0666 whithout requiring any specific rules in /etc/udev/rules.d/ :-)

So next step is a /dev/mem backdoor or a debugfs equivalent writen in Python (lol).

./hk

http://seclists.org/fulldisclosure/2009/Apr/att-01...

2009-04-18T13:48:00.000-07:00

http://seclists.org/fulldisclosure/2009/Apr/att-0198/udev_txt :)

did anyone come up with something like this? http...

2009-04-18T13:23:00.000-07:00

did anyone come up with something like this?

http://pastebin.ca/1395979

i have the base code up and running. 50 lines of C...

2009-04-18T10:15:00.000-07:00

i have the base code up and running. 50 lines of C code for me :P. Do we need to send it sh commands or udev command/rules? Thanks.

Yes absolutely, and it's mentioned here too! Where...

2009-04-18T06:57:00.000-07:00

Yes absolutely, and it's mentioned here too! Where else did you see it?

As some people stated in other blog, wouldn't acti...

2009-04-18T06:20:00.000-07:00

As some people stated in other blog,
wouldn't action="remove", RUN+= work like a charm? without any hassle of managing any devices?

You can get access (as far as DAC is concerned) to...

2009-04-18T04:31:00.000-07:00

You can get access (as far as DAC is concerned) to any device you want easily.
However, /dev/kmem is usually otherwise restricted.
/dev/mem will work, but will be more complex than any other way unless you already have this code ready, even without STRICT_DEVMEM on.

What about mapping /dev/mem or /dev/kmem ? ;)

2009-04-18T02:06:00.000-07:00

What about mapping /dev/mem or /dev/kmem ? ;)

And this blog post from the guy who has disclosed this bug.

See http://xorl.wordpress.com/2009/04/17/cve-2009-1186-linux-udev-netlink-missing-checks/

grep -r RUN /etc/udev/rules.d result varies for ev...

2009-04-17T02:16:00.000-07:00

grep -r RUN /etc/udev/rules.d
result varies for every distrib.

people asking to post codes are faggots do it you...

2009-04-16T22:29:00.000-07:00

people asking to post codes are faggots

do it yourself

Post the codes :)

2009-04-16T16:29:00.000-07:00

Post the codes :)

... and where can one get a sample of those lines?...

2009-04-16T15:02:00.000-07:00

... and where can one get a sample of those lines?

5 lines of Python for PhilWe were so used t...

2009-04-16T14:09:00.000-07:00

5 lines of Python for PhilWe were so used to see Scapy one-liners... Kinda disappointing, don't you think ? ;)