Re: Kernel exploit in brk() function.
"IvanK." <[email protected]>
| Newsgroups | gmane.linux.lfs.security |
|---|---|
| Message-ID | <[email protected]> |
On a plain kernel straight out of kernel.org: $ ./a.out [-] Unable to unmap stack: Invalid argument $ IvanK. On Thursday 04 December 2003 09:01 pm, Christophe Devine wrote: > Ian Molton <[email protected]> wrote: > > > Seems this is how the debian servers got rooted last week. Fixed in > > > 2.4.23. > > > > Impressive. fixed before release of a broken version, then discovered ;-) > > The team that created the exploit just released the source, which is an > impressive piece of work, and actually works. I tested it on Debian 3.0: > > bash-2.05a$ gcc -static hatorihanzo.c > bash-2.05a$ ./a.out > sh-2.05a# id > uid=0(root) gid=0(root) > > You can download the code at http://www.cr0.net:8040/misc/hatorihanzo.c -- http://linuxfromscratch.org/mailman/listinfo/lfs-security FAQ: http://www.linuxfromscratch.org/faq/ Unsubscribe: See the above information page