Ubuntu
linux-source-2.6.15 package

Local root exploit in kernel 2.6.17 - 2.6.24 (vmsplice)

Bug #190587 reported by Hirvinen
408
Affects Status Importance Assigned to Milestone
Linux
Fix Released
High
CentOS
Fix Released
Critical
Debian
Fix Released
Unknown
Gentoo Linux
Fix Released
Undecided
Unassigned
Mandriva
Fix Released
Critical
Ubuntu
Fix Released
Undecided
Unassigned
gplcver (Ubuntu)
Invalid
Undecided
Unassigned
linux (Fedora)
Fix Released
Critical
linux (Ubuntu)
Fix Released
High
Unassigned
Ubuntu hardy-alpha-5
linux-source-2.6.15 (Ubuntu)
Invalid
Undecided
Unassigned
linux-source-2.6.17 (Ubuntu)
Fix Released
High
Jamie Strandboge
linux-source-2.6.20 (Ubuntu)
Fix Released
High
Jamie Strandboge
linux-source-2.6.22 (Ubuntu)
Fix Released
High
Jamie Strandboge

Bug Description

https://bugs.gentoo.org/show_bug.cgi?id=209460 works on at least Hardy 2.6.24-7, Edgy 2.6.17-12, but not on Feisty 2.6.20-16.

Tags: metabug
Revision history for this message
In , slava (slava-linux-kernel-bugs) wrote :

Latest working kernel version:
Earliest failing kernel version: 2.6.17
Distribution: Gentoo
Hardware Environment:
Software Environment:
Problem Description:
Two root exploits have been reported:
http://milw0rm.com/exploits/5093
http://milw0rm.com/exploits/5092

Both exploits cause kernel Oops or (randomly) give root privilegies to the user.

Here is the same bug reported in gentoo bugzilla:
http://bugs.gentoo.org/show_bug.cgi?id=209460

Steps to reproduce:
Compile and run the exploit.

Revision history for this message
In , dsd (dsd-linux-kernel-bugs) wrote :

Assuming this is about CVE-2008-0009/10, this is fixed with "[PATCH] splice: missing user pointer access verification" which is included in 2.6.24.1 and 2.6.23.15. If someone can confirm my assumption, please close this bug.

Revision history for this message
In , tm (tm-linux-kernel-bugs) wrote :

It's not properly fixed in 2.6.24.1. E.g. see http://bugs.gentoo.org/show_bug.cgi?id=209460

Revision history for this message
In , dsd (dsd-linux-kernel-bugs) wrote :

http://bugzilla.kernel.org/show_bug.cgi?id=9924

> It's not properly fixed in 2.6.24.1. E.g. see
> http://bugs.gentoo.org/show_bug.cgi?id=209460

Indeed, I can confirm this.

2.6.24.1 fixes this exploit:
http://milw0rm.com/exploits/5093
(labelled "Diane Lane ...")

but does not fix this one, which still gives me root access on 2.6.24.1:
http://milw0rm.com/exploits/5092
("jessica_biel_naked_in_my_bed.c")

alternative link to the still-working exploit:
http://bugs.gentoo.org/attachment.cgi?id=143059&action=view

Daniel

Revision history for this message
In , rpilar (rpilar-linux-kernel-bugs) wrote :

This is NOT fixed in 2.6.24.1: http://www.securityfocus.com/data/vulnerabilities/exploits/27704.c
But this probably is: http://www.securityfocus.com/data/vulnerabilities/exploits/27704-2.c (at least I can't reproduce it).

Linux Rimmer 2.6.24.1 #4 SMP PREEMPT Sat Feb 9 16:50:17 CET 2008 i686 GNU/Linux

Revision history for this message
In , dsd (dsd-linux-kernel-bugs) wrote :

I have personally tested both exploits under a recent 2.6.22 release,
latest 2.6.23 and latest 2.6.24. Results:

http://milw0rm.com/exploits/5093 ("diane_lane")
This was a bug added in 2.6.23, still present in 2.6.24, but fixed by
the most recent -stable releases for both branches:
- Not exploitable in 2.6.22.10
- Not exploitable in 2.6.23.15
- Not exploitable in 2.6.24.1
so this one is done and dusted...

http://milw0rm.com/exploits/5092 ("jessica_biel")
alt link: http://bugs.gentoo.org/attachment.cgi?id=143059&action=view
This is still exploitable in the latest kernel releases and the exploit
source suggests it has been present since 2.6.17
- Exploitable in 2.6.22.10
- Exploitable in 2.6.23.15
- Exploitable in 2.6.24.1

Revision history for this message
In , anonymous (anonymous-linux-kernel-bugs) wrote :

Reply-To: <email address hidden>

On Sun, Feb 10, 2008 at 11:28:51AM +0000, Daniel Drake wrote:
> I have personally tested both exploits under a recent 2.6.22 release,
> latest 2.6.23 and latest 2.6.24. Results:

There's a fix/explanation proposed for the other one on linux-kernel

127 comments hidden view all 131 comments
Revision history for this message
Heikki Mäntysaari (heikki-mantysaari) wrote :

I can confirm this in Gutsy:

$ gcc exploit.c -o exploit
$ whoami
heikki
$ ./exploit
-----------------------------------
 Linux vmsplice Local Root Exploit
 By qaaz
-----------------------------------
[+] mmap: 0x0 .. 0x1000
[+] page: 0x0
[+] page: 0x20
[+] mmap: 0x4000 .. 0x5000
[+] page: 0x4000
[+] page: 0x4020
[+] mmap: 0x1000 .. 0x2000
[+] page: 0x1000
[+] mmap: 0xb7d90000 .. 0xb7dc2000
[+] root
$ whoami
root

Kernel 2.6.22-14-generic

Revision history for this message
Aapo Rantalainen (aapo-rantalainen) wrote :

I confirm this in Hardy Heron
kernel 2.6.24-7-generic

Revision history for this message
Risto H. Kurppa (risto.kurppa) wrote :

Confirm on Gutsy:
rhk@rubert:~$ gcc exploit2.c -o exploit2
rhk@rubert:~$ ./exploit2
-----------------------------------
 Linux vmsplice Local Root Exploit
 By qaaz
-----------------------------------
[+] mmap: 0x0 .. 0x1000
[+] page: 0x0
[+] page: 0x20
[+] mmap: 0x4000 .. 0x5000
[+] page: 0x4000
[+] page: 0x4020
[+] mmap: 0x1000 .. 0x2000
[+] page: 0x1000
[+] mmap: 0xb7e04000 .. 0xb7e36000
[+] root
root@rubert:~# uname -a
Linux rubert 2.6.22-14-generic #1 SMP Fri Feb 1 04:59:50 UTC 2008 i686 GNU/Linux
root@rubert:~#

Revision history for this message
Martin Peeks (martinp23) wrote :

http://bugzilla.kernel.org/show_bug.cgi?id=9924

Also able to confirm on Hardy.

125 comments hidden view all 131 comments
Revision history for this message
In , dsd (dsd-linux-kernel-bugs) wrote :

fixed in Linus' tree as 712a30e63c8066ed84385b12edbfb804f49cbc44

124 comments hidden view all 131 comments
Revision history for this message
tonfa (bboissin) wrote :

actually the bug exploitable from 2.6.17-2.6.24 is CVE-2008-0600. CVE-2008-0009/10 only affect
.23 and .24 (so only hardy is affected)

see http://lkml.org/lkml/2008/2/10/177 for details

(btw this bug is pretty scary, it works almost anywhere you can have a shell...)

Revision history for this message
Iulian Udrea (iulian) wrote :

Confirmed in Hardy - 2.6.24

Changed in linux-source-2.6.24:
importance: Undecided → Critical
status: New → Confirmed
Revision history for this message
Václav Šmilauer (eudoxos) wrote :

I confirm that on hardy and gutsy. I also confirm that the hotfix referenced in debian bugreport http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464953 which sets the first byte of sys_vmsplice to RET in /dev/mem ( http://www.ping.uio.no/~mortehu/disable-vmsplice-if-exploitable.c ) works and prevents the exploit from functioning. I don't know if having that function returning can otherwise adversely affect the system, though.

84 comments hidden view all 131 comments
Revision history for this message
In , mjc (mjc-redhat-bugs) wrote :

Upstream fix:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=712a30e63c8066ed84385b12edbfb804f49cbc44

83 comments hidden view all 131 comments
Revision history for this message
Paul Sladen (sladen) wrote :

RHEL tracker is at: https://bugzilla.redhat.com/show_bug.cgi?id=432251 but LP won't allow adding a second entry (in addition to the one for Fedora).

84 comments hidden view all 131 comments
Revision history for this message
In , mjc (mjc-redhat-bugs) wrote :

For Red Hat Enterprise Linux 5:
CVSS v2 Base score: 7.2 (High) (AV:L/AC:L/Au:N/C:C/I:C/A:C)

83 comments hidden view all 131 comments
Revision history for this message
Ante Karamatić (ivoks) wrote :

Gutsy/amd64 is affected too.

Revision history for this message
sancheztavo (sancheztavo) wrote :

Confirmed in Gutsy. Kernel 2.6.22-14-generic

Revision history for this message
Ante Karamatić (ivoks) wrote :

Upstream fix:

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=712a30e63c8066ed84385b12edbfb804f49cbc44

Revision history for this message
Andrew Martin (werdz) wrote :

Confirmed on feisty AMD64 (i386 isn't affected, AMD64 is).

81 comments hidden view all 131 comments
Revision history for this message
In , redhat (redhat-redhat-bugs) wrote :

We added a quick and dirty patch for the problem here:
http://home.powertech.no/oystein/ptpatch2008/

It is a kernel module that disables vmsplice, and logs any attempts to exploit
the bug.
As it it a loadable module it can easily be deployed on systems that can not be
updated with a new kernel for various reasons.

80 comments hidden view all 131 comments
Revision history for this message
Ante Karamatić (ivoks) wrote :

I also confirm that suggested hotfix fixes the problem until next reboot, of course.

81 comments hidden view all 131 comments
Revision history for this message
In , seva (seva-redhat-bugs) wrote :

Ola,

I tried that module on a test system and got:
  <name> kernel: general protection fault: 0000 [1] SMP

80 comments hidden view all 131 comments
Revision history for this message
steve.tardonia (steve-tardonia-deactivatedaccount) wrote :

steve@genesis:~/bin$ gcc exploitsrv.c -o exploitsrv
steve@genesis:~/bin$ whoami
steve
steve@genesis:~/bin$ ./exploitsrv
-----------------------------------
 Linux vmsplice Local Root Exploit
 By qaaz
-----------------------------------
[+] mmap: 0x0 .. 0x1000
[+] page: 0x0
[+] page: 0x20
[+] mmap: 0x4000 .. 0x5000
[+] page: 0x4000
[+] page: 0x4020
[+] mmap: 0x1000 .. 0x2000
[+] page: 0x1000
[+] mmap: 0xb7e44000 .. 0xb7e76000
[+] root
root@genesis:~/bin# uname -a
Linux genesis 2.6.22-14-server #1 SMP Fri Feb 1 05:28:54 UTC 2008 i686 GNU/Linux
root@genesis:~/bin#

Revision history for this message
Kees Cook (kees) wrote :

The Security Team is working on getting the fix built up. We should have updated kernels available shortly.

Changed in linux-source-2.6.17:
assignee: nobody → keescook
importance: Undecided → Critical
status: New → In Progress
Changed in linux-source-2.6.20:
assignee: nobody → keescook
importance: Undecided → High
status: New → In Progress
Changed in linux:
importance: Critical → High
milestone: none → hardy-alpha-5
status: Confirmed → In Progress
Changed in linux-source-2.6.17:
importance: Critical → High
Changed in linux-source-2.6.22:
assignee: nobody → keescook
importance: Critical → High
status: Confirmed → In Progress
Revision history for this message
Luis Alcaraz Leal (lalcaraz) wrote :

Luis Alcaraz (Mexico)
Confirmed on Ubuntu 7.10 2.6.22-14-generic
---
lalcaraz@lalcaraz-laptop:~$ vim exploit.c
lalcaraz@lalcaraz-laptop:~$ gcc exploit.c -o exploit
lalcaraz@lalcaraz-laptop:~$ whoami
lalcaraz
lalcaraz@lalcaraz-laptop:~$ ./exploit
-----------------------------------
 Linux vmsplice Local Root Exploit
 By qaaz
-----------------------------------
[+] mmap: 0x0 .. 0x1000
[+] page: 0x0
[+] page: 0x20
[+] mmap: 0x4000 .. 0x5000
[+] page: 0x4000
[+] page: 0x4020
[+] mmap: 0x1000 .. 0x2000
[+] page: 0x1000
[+] mmap: 0xb7e29000 .. 0xb7e5b000
[+] root
root@lalcaraz-laptop:~# whoami
root
root@lalcaraz-laptop:~# uname -a
Linux lalcaraz-laptop 2.6.22-14-generic #1 SMP Fri Feb 1 04:59:50 UTC 2008 i686 GNU/Linux
root@lalcaraz-laptop:~#

79 comments hidden view all 131 comments
Revision history for this message
In , ryan (ryan-redhat-bugs-1) wrote :

The make file required some modification for PAE kernels due to path issues;
once compiled module fails to load with:
insmod: error inserting 'ptpatch2008.ko': -1 Invalid module format

(double checked to confirm the system.map and modules paths are in fact valid to
the current running kernel version on the system)

78 comments hidden view all 131 comments
Revision history for this message
Fadi Kaba (fadi-kaba) wrote :

Hi guys,

Just got a question in regards to the above theory, you have mentioned that kernel 2.6.17-2.6.24 is affected whereas a normal user have the ability to login as root with no password and sudo command,so my question here is that I have two version of Kernel on two separate machines 2.6.15-26 and 2.6.16 are these kernel affected as well.

If they are what patch should we follow to stop this from happening

It will be please of some expert answer my query as I am new to Linux and security topics

Thanks in advanced
Fadi

79 comments hidden view all 131 comments
Revision history for this message
In , agt (agt-redhat-bugs) wrote :

@Ryan, make sure you have kernel-PAE-devel installed, and then undo your
Makefile path changes. The modules compile and insmod properly for me. Thanks,
Ola!

Revision history for this message
In , juanino (juanino-redhat-bugs) wrote :

Created attachment 294535
x86_64 panic on ptpach module load

Revision history for this message
In , juanino (juanino-redhat-bugs) wrote :

to clarify, the module from comment#10 panic's on x86_64 for me.

Revision history for this message
In , ryan (ryan-redhat-bugs-1) wrote :

(In reply to comment #13)
> @Ryan, make sure you have kernel-PAE-devel installed, and then undo your
> Makefile path changes. The modules compile and insmod properly for me. Thanks,
> Ola!

Perfect, that did the trick - had not realized there was a specific pae-devel
package.

81 comments hidden view all 131 comments
Revision history for this message
Ante Karamatić (ivoks) wrote :

Fadi, no, 2.6.15 isn't affected. I can't test 2.6.16, but it also shouldn't be affected.

Revision history for this message
Fadi Kaba (fadi-kaba) wrote : Re: [Bug 190587] Re: Local root exploit in kernel 2.6.17 - 2.6.24 (vmsplice)

Thanks Ante,
How did you test kernel 2.6.15 I have a machine here with kernel 2.6.16 and
might test on it

On Feb 11, 2008 5:47 PM, Ante Karamatić <email address hidden> wrote:

> Fadi, no, 2.6.15 isn't affected. I can't test 2.6.16, but it also
> shouldn't be affected.
>
> --
> Local root exploit in kernel 2.6.17 - 2.6.24 (vmsplice)
> https://bugs.launchpad.net/bugs/190587
> You received this bug notification because you are a direct subscriber
> of the bug.
>
> Status in Source Package "linux" in Ubuntu: In Progress
> Status in Source Package "linux-source-2.6.17" in Ubuntu: In Progress
> Status in Source Package "linux-source-2.6.20" in Ubuntu: In Progress
> Status in Source Package "linux-source-2.6.22" in Ubuntu: In Progress
> Status in Debian GNU/Linux: Unknown
> Status in Source Package "linux" in Fedora: Unknown
> Status in Gentoo Linux: Unknown
> Status in Mandriva Linux: Unknown
>
> Bug description:
> https://bugs.gentoo.org/show_bug.cgi?id=209460 works on at least Hardy
> 2.6.24-7, Edgy 2.6.17-12, but not on Feisty 2.6.20-16.
>

--
Regards,
Fadi Kaba
<email address hidden>

Revision history for this message
Fadi Kaba (fadi-kaba) wrote :

2008/2/11 Fadi Kaba <email address hidden>:

> Thanks Ante,
> How did you test kernel 2.6.15 I have a machine here with kernel 2.6.16and might test on it
>
>
> On Feb 11, 2008 5:47 PM, Ante Karamatić <email address hidden> wrote:
>
> > Fadi, no, 2.6.15 isn't affected. I can't test 2.6.16, but it also
> > shouldn't be affected.
> >
> > --
> > Local root exploit in kernel 2.6.17 - 2.6.24 (vmsplice)
> > https://bugs.launchpad.net/bugs/190587
> > You received this bug notification because you are a direct subscriber
> > of the bug.
> >
> > Status in Source Package "linux" in Ubuntu: In Progress
> > Status in Source Package "linux-source-2.6.17" in Ubuntu: In Progress
> > Status in Source Package "linux-source-2.6.20" in Ubuntu: In Progress
> > Status in Source Package "linux-source-2.6.22" in Ubuntu: In Progress
> > Status in Debian GNU/Linux: Unknown
> > Status in Source Package "linux" in Fedora: Unknown
> > Status in Gentoo Linux: Unknown
> > Status in Mandriva Linux: Unknown
> >
> > Bug description:
> > https://bugs.gentoo.org/show_bug.cgi?id=209460 works on at least Hardy
> > 2.6.24-7, Edgy 2.6.17-12, but not on Feisty 2.6.20-16.
> >
>
>
>
> --
> Regards,
> Fadi Kaba
> <email address hidden>

--
Regards,
Fadi Kaba
<email address hidden>

Revision history for this message
Mathieu Marquer (slasher-fun) wrote :

Temporary fix :

* Download http://www.ping.uio.no/~mortehu/disable-vmsplice-if-exploitable.c
* Compile it using gcc (so "gcc disable-vmsplice-if-exploitable.c -o rm_exploit") as normal user
* Run it as normal user
--> You are now protected until the next reboot of the system

Revision history for this message
Mathieu Marquer (slasher-fun) wrote :

Just some corrections to my previous post :

Line 4 :
* Compile it using gcc (so "gcc disable-vmsplice-if-exploitable.c -o rm_exploit" without the quotes) as normal user
Line 5 :
* Run it as normal user ("./rm_exploit" without the quotes)

Revision history for this message
Kees Cook (kees) wrote :

For record, Dapper (2.6.15) is not affected.

Also, CVEs for these issues are:
CVE-2008-0009 (2.6.22+), CVE-2008-0010 (2.6.17+ -- see get_iovec_page_array prior to 2.6.22), CVE-2008-0600 (2.6.17+).

Changed in linux-source-2.6.15:
status: New → Invalid
Revision history for this message
William Pitcock (nenolod) wrote : Re: [Bug 190587] Re: Local root exploit in kernel 2.6.17 - 2.6.24 (vmsplice)

Hi,

This doesn't work, because it still creates a DoS condition when it
alters your memory map.

On Mon, 2008-02-11 at 07:08 +0000, slasher-fun wrote:
> Temporary fix :
>
> * Download http://www.ping.uio.no/~mortehu/disable-vmsplice-if-exploitable.c
> * Compile it using gcc (so "gcc disable-vmsplice-if-exploitable.c -o rm_exploit") as normal user
> * Run it as normal user
> --> You are now protected until the next reboot of the system
>

Revision history for this message
Kees Cook (kees) wrote :

Fixes for CVE-2008-0009, CVE-2008-0010:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=8811930dc74a503415b35c4a79d14fb0b408a361

Fixes for CVE-2008-0600:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=712a30e63c8066ed84385b12edbfb804f49cbc44

75 comments hidden view all 131 comments
Revision history for this message
In , thoger (thoger-redhat-bugs) wrote :

*** Bug 432308 has been marked as a duplicate of this bug. ***

Revision history for this message
In , thoger (thoger-redhat-bugs) wrote :

*** Bug 432288 has been marked as a duplicate of this bug. ***

Revision history for this message
In , artms (artms-redhat-bugs) wrote :

On kernel-2.6.18-53.1.6.el5xen (x86_64) this exploit makes kernel panic.

Bug Watch Updater (bug-watch-updater)
Changed in linux:
status: Unknown → Fix Committed
Revision history for this message
In , mattdm (mattdm-redhat-bugs) wrote :

Not to detract from the real work, but can someone describe the
access-restricted bugs marked as blocking this? (Bug #432252, Bug #432253). Thanks.

Revision history for this message
In , mbooth (mbooth-redhat-bugs) wrote :

These are simply tracking bugs for specific affected products.

78 comments hidden view all 131 comments
Revision history for this message
Jan M. (fijam7) wrote :

CVE-2008-0600 fixed in 2.6.22.18 [1,2]

[1] http://lkml.org/lkml/2008/2/11/27
[2] http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.22.y.git;a=commitdiff;h=af395d8632d0524be27d8774a1607e68bdb4dd7f

79 comments hidden view all 131 comments
Revision history for this message
In , mjc (mjc-redhat-bugs) wrote :

In reply to comment #20; there are some bugs in the exploit which means that it
doesn't work directly on x86_64 machines, although it can be modified to do so.

Revision history for this message
In , russell (russell-redhat-bugs-1) wrote :

I can confirm the sample exploit will segfault on athlon on a bare system (would
likely be patchable), but will work as supplied on a XenU.

Segfault: Linux xxxx 2.6.23.9-85.fc8 #1 SMP Fri Dec 7 15:49:59 EST 2007 i686
athlon i386 GNU/Linux

Exploitable: Linux xxxx 2.6.21-2952.fc8xen #1 SMP Mon Nov 19 07:06:55 EST 2007
i686 athlon i386 GNU/Linux

Revision history for this message
In , mpeters (mpeters-redhat-bugs) wrote :

The exploit worked for me w/o a segfault on i386 Duron (
kernel-2.6.18-53.1.6.el5 ) and x86_64 Athlon X2 (5200+ - same kernel but x86_64
install)

on i386 it did not consistently work, and I'm guessing related, the machine had
to be rebooted as it kept dropping ssh connections after the exploit was run.

Both boxes are CentOS (opposed to RHEL) if it matters.

80 comments hidden view all 131 comments
Revision history for this message
nabil2199 (nabil2199-gmail) wrote :

confirmed in gutsy 2.6.22-14-generic

Revision history for this message
Tim Gardner (timg-tpi) wrote :

Kees - from what I can tell CVE-2008-0009 and CVE-2008-0010 affect only 2.6.23 through 2.6.24.1. CVE-2008-0600 affects 2.6.17 through 2.6.24.1.

Greg k-h:
"It has been given CVE-2008-0600 to address this issue (09 and 10 only
affect .23 and .24 kernels, and have been fixed.)"

We'll get all 3 CVEs fixed in the 2.6.24.2 stable tree, upon which Hardy 2.6.24-7.13 will be based.

I am packaging fixes for Edgy/Feisty/Gusty .

80 comments hidden view all 131 comments
Revision history for this message
In , donhoover (donhoover-redhat-bugs) wrote :

I verified it working on RHEL5 and RHEL 5.1 32bit boxes using both the older and
newer -53 kernels in both single and SMP installs.

The exploit does seem to make the systems unstable and they have crashed after
running a little longer after someone uses this exploit.

79 comments hidden view all 131 comments
Revision history for this message
Boglizk (boglizk) wrote :

Seems to fail on this part:

        if (!uid || !gid)
                die("!@#$", 0);

-------

boglizk@thebox:~$ gcc linux_vmsplice.c
boglizk@thebox:~$ ./a.out
-----------------------------------
 Linux vmsplice Local Root Exploit
 By qaaz
-----------------------------------
[-] !@#$
boglizk@thebox:~$ uname -a
Linux thebox 2.6.22-14-generic #1 SMP Fri Feb 1 04:59:50 UTC 2008 i686 GNU/Linux

80 comments hidden view all 131 comments
Revision history for this message
In , erek (erek-redhat-bugs) wrote :

I've compiled an interim RPM for my internal use, as I considered this safer
than the kernel module which has caused panics. It's the same as 2.6.18-53
Centos, but with the upstream kernel patch applied. Obviously your mileage may vary.

http://erek.blumenthals.com/blog/2008/02/11/rhel-5-centos-5-kernel-rpms-patched-against-vmsplice-local-root-exploit/

Revision history for this message
In , erek (erek-redhat-bugs) wrote :

That's against 2.6.53.1.6, not 2.6.53 as I said previously.

Revision history for this message
In , jakub (jakub-redhat-bugs-1) wrote :

Hey boys, Debian has already fixed this, where is Red Hat? Thank you very much.

Revision history for this message
In , mattdm (mattdm-redhat-bugs) wrote :

> Hey boys, Debian has already fixed this, where is Red Hat? Thank you very much.

Doing quality control on the produced updates, presumably.

Revision history for this message
In , admin (admin-redhat-bugs) wrote :

RHAT had it fixed on 2/8 see the .79 kernel in:

http://people.redhat.com/dzickus/el5/79.el5

I tested it on i686 and was unable to use millw0rm exploit 5092 or 5093. it also
fixes another NFS issue from bug 431092.

83 comments hidden view all 131 comments
Revision history for this message
®om (rom1v) wrote :

Why priority is "high" but no "critical"?
Is there a higher criticity than a root exploit in 3 seconds?

84 comments hidden view all 131 comments
Revision history for this message
In , amyagi (amyagi-redhat-bugs) wrote :

(In reply to comment #31)
> RHAT had it fixed on 2/8 see the .79 kernel in:
>
> http://people.redhat.com/dzickus/el5/79.el5
>
> I tested it on i686 and was unable to use millw0rm exploit 5092 or 5093. it also
> fixes another NFS issue from bug 431092.

However, keep in mind that it is a TEST kernel. The .78 kernel I tested and
confirmed about the nfs fix is UNstable and some people are experiencing system
instability / crashes.

Revision history for this message
In , mjc (mjc-redhat-bugs) wrote :

The Red Hat Security Response Team is working with engineering and QA on the
updated packages for Red Hat Enterprise Linux 5. We'll release them immediately
to the Red Hat Network once they pass our testing and QA processes.

(Updated Fedora kernels are currently being pushed live and will be available soon)

84 comments hidden view all 131 comments
Revision history for this message
Jan M. (fijam7) wrote :

Yes, a remote root exploit.

Revision history for this message
Tom Lippincott (tom-cs) wrote :

Hi,
I was wondering how others are dealing with this, beyond the runtime patch on bootup. It seems like a tossup between grabbing/patching kernel source and waiting for the security update, does anyone know a rough eta on a safe gutsy kernel package? Thanks for the help, this is new territory for me.

Revision history for this message
yaztromo (tromo) wrote :

Tom, the present hotfix is dangerous. See http://lists.debian.org/debian-kernel/2008/02/msg00387.html

Revision history for this message
Ken Simon (ninkendo) wrote : Re: [Bug 190587] Re: Local root exploit in kernel 2.6.17 - 2.6.24 (vmsplice)

Indeed, I ran the hotfix on my desktop last night (gutsy with latest
updates) and as soon as it finished, running programs began to crash.
I wasn't able to see any error messages to dmesg, but the system was
unstable enough that I had to reboot it. I would *not* recommend
running the hotfix.

Revision history for this message
Jan M. (fijam7) wrote :

Duh. What about using the patch from the upstream? https://bugs.launchpad.net/ubuntu/+source/linux-source-2.6.22/+bug/190587/comments/26

Revision history for this message
Michael Trunner (trunneml) wrote :

@Boglizk: Not run it as root.

80 comments hidden view all 131 comments
Revision history for this message
In , donhoover (donhoover-redhat-bugs) wrote :

The system tap does not seem to catch/deny every run of the exploit in my
testing. They all seem to get logged, but many of them still get a root prompt.

The system is also still unstable, and either the exploit running multiple times
or the system tap eventually cause a kernel crash.

79 comments hidden view all 131 comments
Revision history for this message
Tim Gardner (timg-tpi) wrote :

The fix for this vulnerability is in the 2.6.24.2 tree against which Hardy was recently updated and is in the process of being packaged for upload.

Changed in linux-source-2.6.17:
status: In Progress → Fix Committed
Changed in linux-source-2.6.20:
status: In Progress → Fix Committed
Changed in linux-source-2.6.22:
status: In Progress → Fix Committed
Changed in linux:
status: In Progress → Fix Committed
80 comments hidden view all 131 comments
Revision history for this message
In , jkmoseley (jkmoseley-redhat-bugs) wrote :

(In reply to comment #16)
> (In reply to comment #13)
> > @Ryan, make sure you have kernel-PAE-devel installed, and then undo your
> > Makefile path changes. The modules compile and insmod properly for me.
 Thanks,
> > Ola!
> Perfect, that did the trick - had not realized there was a specific pae-devel
> package.

I was able to successfully compile the module on a FC5 system, but when trying
to add via insmod, I get:

insmod: error inserting 'ptpatch2008.ko': -1 Operation not permitted

79 comments hidden view all 131 comments
Revision history for this message
cybaix (cybaix) wrote :

What about Gutsy, any update when the fix will be released?

80 comments hidden view all 131 comments
Revision history for this message
In , fche (fche-redhat-bugs) wrote :

(In reply to comment #36)
> The system tap does not seem to catch/deny every run of the exploit in my
> testing. They all seem to get logged, but many of them still get a root prompt.

The systemtap script proposed in comment #35 is a poor choice, so is
now hidden in order to avoid misleading the public. It interfered
with multiple functions in fs/splice.c, and did not actually block
the vmsplice attempt but rather just attempt to log and punish it.

If you have the prerequisites for this tool though, try the simpler
script listed in bug #432229 comment #17.

79 comments hidden view all 131 comments
Revision history for this message
Yuri (ycsapo) wrote :

Contrary to what I've been reading, I can confirm this on feisty, at least with AMD processor:

ycsapo@pie:~$ grep "model name" /proc/cpuinfo
model name : Dual-Core AMD Opteron(tm) Processor 2218
model name : Dual-Core AMD Opteron(tm) Processor 2218
model name : Dual-Core AMD Opteron(tm) Processor 2218
model name : Dual-Core AMD Opteron(tm) Processor 2218
ycsapo@pie:~$ uname -a
Linux pie 2.6.20-16-generic #2 SMP Thu Jan 31 22:39:18 UTC 2008 x86_64 GNU/Linux
ycsapo@pie:~$ ./exploit
-----------------------------------
 Linux vmsplice Local Root Exploit
 By qaaz
-----------------------------------
[+] mmap: 0x100000000000 .. 0x100000001000
[+] page: 0x100000000000
[+] page: 0x100000000038
[+] mmap: 0x4000 .. 0x5000
[+] page: 0x4000
[+] page: 0x4038
[+] mmap: 0x1000 .. 0x2000
[+] page: 0x1000
[+] mmap: 0x2ac0a9f0d000 .. 0x2ac0a9f3f000
[+] root
root@pie:~# whoami
root
root@pie:~#

I also confirm the suggested hotfix (disable-vmsplice-if-exploitable.c) works:

ycsapo@pie:~$ cc disable-vmsplice-if-exploitable.c
ycsapo@pie:~$ ./a.out
-----------------------------------
 Linux vmsplice Local Root Exploit
 By qaaz
-----------------------------------
[+] mmap: 0x100000000000 .. 0x100000001000
[+] page: 0x100000000000
[+] page: 0x100000000038
[+] mmap: 0x4000 .. 0x5000
[+] page: 0x4000
[+] page: 0x4038
[+] mmap: 0x1000 .. 0x2000
[+] page: 0x1000
[+] mmap: 0x2acad5163000 .. 0x2acad5195000
[+] root
Exploit gone!
ycsapo@pie:~$ ./exploit
-----------------------------------
 Linux vmsplice Local Root Exploit
 By qaaz
-----------------------------------
[+] mmap: 0x100000000000 .. 0x100000001000
[+] page: 0x100000000000
[+] page: 0x100000000038
[+] mmap: 0x4000 .. 0x5000
[+] page: 0x4000
[+] page: 0x4038
[+] mmap: 0x1000 .. 0x2000
[+] page: 0x1000
[+] mmap: 0x2b010025b000 .. 0x2b010028d000
[-] vmsplice
ycsapo@pie:~$ whoami
ycsapo

Revision history for this message
tonfa (bboissin) wrote : Re: [Bug 190587] Re: Local root exploit in kernel 2.6.17 - 2.6.24 (vmsplice)

On Tue, Feb 12, 2008 at 03:18:36AM -0000, Yuri wrote:
> Contrary to what I've been reading, I can confirm this on feisty, at
> least with AMD processor:

of course feisty is exploitable it works for 2.6.17-2.6.24.1 (and see
the summary of the bug, 2.6.20 is mentionned).

--
:wq

Bug Watch Updater (bug-watch-updater)
Changed in linux:
status: Fix Committed → Fix Released
79 comments hidden view all 131 comments
Revision history for this message
In , mjc (mjc-redhat-bugs) wrote :

Just a quick status update; we have updated kernel packages released for Fedora
(see linked bugs) and are finishing up the QA process for Red Hat Enterprise
Linux 5. We expect this to be completed shortly (pending successful completion
of testing). This will be RHSA-2008:0129.

Launchpad Janitor (janitor)
Changed in linux-source-2.6.22:
status: Fix Committed → Fix Released
Revision history for this message
In , mjc (mjc-redhat-bugs) wrote :

This vulnerability, CVE-2008-0600, did not affect Red Hat Enterprise Linux 2.1,
3, or 4. Updated packages to correct this vulnerability are now available for
Red Hat Enterprise Linux along with our advisory at the URL:

https://rhn.redhat.com/errata/RHSA-2008-0129.html

Since all Red Hat and Fedora products are not updated, closing the bug.

Jamie Strandboge (jdstrand)
Changed in linux-source-2.6.17:
assignee: keescook → jamie-strandboge
status: Fix Committed → Fix Released
Changed in linux-source-2.6.20:
assignee: keescook → jamie-strandboge
status: Fix Committed → Fix Released
Changed in linux-source-2.6.22:
assignee: keescook → jamie-strandboge
Jamie Strandboge (jdstrand)
Changed in linux:
status: Fix Committed → Fix Released
Timo Aaltonen (tjaalton)
Changed in linux-source-2.6.24:
status: New → Fix Released
Revision history for this message
In , lwang (lwang-redhat-bugs) wrote :

*** Bug 432319 has been marked as a duplicate of this bug. ***

Jamie Strandboge (jdstrand)
Changed in gplcver:
status: New → Invalid
Bug Watch Updater (bug-watch-updater)
Changed in linux:
status: Unknown → Fix Released
Bug Watch Updater (bug-watch-updater)
Changed in linux:
importance: Unknown → High
Bug Watch Updater (bug-watch-updater)
Changed in mandriva:
importance: Unknown → Critical
Bug Watch Updater (bug-watch-updater)
Changed in linux (Fedora):
importance: Unknown → Critical
Bug Watch Updater (bug-watch-updater)
Changed in centos:
importance: Unknown → Critical
8 comments hidden view all 131 comments
Revision history for this message
In , ucelsanicin (ucelsanicin-linux-kernel-bugs) wrote :

Possibly similar to 23220 however on 64-bit recent Debian sid with
trivial code I see : https://www.webb-dev.co.uk/category/crypto/

mimas$
mimas$ uname -a http://www.compilatori.com/category/services/
Linux mimas 5.10.0-6-sparc64 #1 Debian 5.10.28-1 (2021-04-09) sparc64 GNU/Linux
mimas$
http://www.acpirateradio.co.uk/category/services/
mimas$
mimas$ /usr/bin/gcc --version http://www.logoarts.co.uk/category/services/
gcc (Debian 10.2.1-6) 10.2.1 20210110
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO http://www.slipstone.co.uk/category/services/
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

mimas$ http://embermanchester.uk/category/services/

mimas$
mimas$ cat -n foo.c http://connstr.net/category/services/
     1
     2 #include <stdio.h>
     3 #include <stdlib.h>
     4 http://joerg.li/category/services/
     5 int main(int argc, char **argv)
     6 {
     7 int a = 1;
     8 http://www.jopspeech.com/category/services/
     9 printf("a = %i\n", a);
    10 http://www.wearelondonmade.com/category/services/
    11 printf("&a = %p\n", &a);
    12
    13 return EXIT_SUCCESS;
    14 https://waytowhatsnext.com/category/crypto/
    15 }
    16
mimas$ http://www.iu-bloomington.com/category/crypto/

mimas$
mimas$ /usr/bin/gcc -std=iso9899:1999 -pedantic -pedantic-errors -fno-builtin https://komiya-dental.com/category/crypto/ -g -m64 -O0 -mno-app-regs -mcpu=ultrasparc -mmemory-model=tso -o foo foo.c
mimas$ http://www-look-4.com/category/services/

mimas$
mimas$ TERM=dumb LC_ALL=C /usr/bin/gdb ./foo
GNU gdb (Debian 10.1-2) 10.1.90.20210103-git

Displaying first 40 and last 40 comments. View all 131 comments or add a comment.
This report contains Public Security information  
Everyone can see this security related information.

Duplicates of this bug

Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.