Linux Kernel 2.6 Local Root Exploit

aquatix writes "This local root exploit (Debian, Ubuntu) seems to work everywhere I try it, as long as it's a Linux kernel version 2.6.17 to 2.6.24.1. If you don't trust your users (which you shouldn't), better compile a new kernel without vmsplice." Here is millw0rm's proof-of-concept code.

Comments

The sound you hear...

[downix]

And the next sound you shall hear are millions of nerds rushing into their offices to compile a new kernel on a sunday afternoon... along with the millions of cell phones ringing as the bosses read this...

jessica_biel_naked_in_my_bed.c ?

[Anonymous Coward]

I strongly suspect this code doesn't do what it says on the tin.

Re:jessica_biel_naked_in_my_bed.c ?

[LiquidCoooled]

Thats because you are compiling it with the wrong target.

You need to include justin_timberlake.h and link it with the millionaires library.

Re:jessica_biel_naked_in_my_bed.c ?

[BJH]

realdoll_and_a_tube_of_lube_on_my_inflatable_mattress.c ?

Thank God

[Zoxed]

Phew, lucky I run MS Windows then !!

Re:Thank God

[Anonymous Coward]

That's like finding out there's a new 24-hour flu going around, and thanking God the AIDS will kill you first.

Re:Thank God

[monkeySauce]

Phew, lucky I run MS Windows then !!

I know what you mean. It's nice not having to freak out periodically like this since you live in a constant state of panic anyway.

Re:Misleading

[fo0bar]

This is not an universal problem. It only occurs for those kernels with a specific function compiled in that most installations won't need, and which halfway decent sysadmins won't have as part of the kernel anyhow when they don't need it.

Yet another good example of why you shouldn't hire the sysadmins who blindly use what the vendors ship, but security and performance minded sysadmins who reduce installations to what's actually needed.

Which reminds me, have you done your emerge -abuop6QvvvvVVvVVxz world yet today?

Re:Beauty of OSS

[caluml]

I don't think I'm the first of us to say "Ah shit". No, you are, you really are! Google confirms it!

Your search - "Ah shit" - did not match any documents.

Re:Misleading

[BasharTeg]

Quick, cue the Linux apologists! Damage control! Spin it! Only noobs and bad administrators would be affected!

Re:Before the inevitable occurs:

[QuantumG]

Yeah, this is an example of one of the millions of Linux kernel holes there are out there. Every now and then, a blackhat gets a job and wants to impress his employer so he pulls out some of his old code and polishes it up. You can tell when it happens because they are so childish that they make the exploit trivial to demonstrate and distribute it far and wide. And you just know that every blackhat who had a variant of this exploit in their personal collection are like "well thanks asshole, now I've got one less Linux kernel exploit.. bastard."

Re:ssh

[Wakko Warner]

Thankfully, nobody runs Linux on enterprise-class hardware.

Re:Beauty of OSS

[LizardKing]

However, bricks = shat.

Come on now, that simply assigns shat to bricks (and that's some nasty use of the comma operator to separate statements). I think you meant:

while (exploitable) {
Bricks *bricks = malloc(sizeof(Bricks));
shit(bricks);
sleep(1);
}

Note that we don't have to dispose of the bricks we shit, as that's taken care of elsewhere. And of course, if we all still wrote VAX assembler we would be able to optimise this by using the SHTBRCKS instruction.

Re:Beauty of OSS

[XenoPhage]

So while it may not be difficult to spot some wayward code if you are a geek, it might not be if you are a 65 year old hippie who knows almost nothing about computers. What does RMS have to do with this?