For those who have been living under a rock for the past two days, an exploit exists for Julien Tinnes/Tavis Ormandy's sendpage vulnerability in all Linux kernels since 2001. My exploit works on 2.4, 2.6, x86, x64, 4k stacks, 8k stacks, with/without cred framework, bypasses mmap_min_addr in any public way possible (auto-detecting which method to use). As always, while in ring0 it provides the added convenience of disabling auditing, SELinux, AppArmor, and all other LSM modules. If SELinux is enforcing, it will also rewrite the SELinux code to fool userland into thinking it remains in enforcing mode. And if the machine supports it, it'll play a nice video for you in your terminal. See http://www.youtube.com/watch?v=arAfIp7YzZ4 for a demo. I wanted to implement a more interactive sense of russian roulette in the exploit, with a randomly-generated 1 in 6 chance of hot rebooting the machine into FreeDOS (first exploit to reboot you into a secure operating system) but I don't have time -- I'm off to Miami! "Congrats" Linus on screwing over all the vendors and every Linux user by forcing disclosure of the bug before vendors could ship out updated kernels. Your patch applies well to their binary packages. -Brad
Attachment:
signature.asc
Description: Digital signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/