RE: Kernel exploit in brk() function.

Stuart Harris - Chief Systems Engineer Intermedia wrote:

> Guess it wasn't just grsec then ;)
> 
> 
>> -----Original Message-----
>> From: [email protected]
>> [mailto:[email protected]] On Behalf Of
>> [IvanK.
>> Sent: 05 December 2003 02:39
>> To: LFS Security Discussion List; Christophe Devine
>> Subject: Re: Kernel exploit in brk() function.
>> 
>> 
>> On a plain kernel straight out of kernel.org:
>> 
>> $ ./a.out
>> [-] Unable to unmap stack: Invalid argument
>> $
>> 
>> IvanK.

Looks like gcc-3.3.1 is somehow stopping the exploit????

>From LFS-5.0:

richis@lfs:~ $ gcc -v
Reading specs from /usr/lib/gcc-lib/i686-pc-linux-gnu/3.3.1/specs
Configured with: ../gcc-3.3.1/configure --prefix=/usr --enable-shared
--enable-threads=posix --enable-__cxa_atexit --enable-clocale=gnu
--enable-languages=c,c++
Thread model: posix
gcc version 3.3.1
richis@lfs:~ $ /opt/gcc-2.95.3/bin/gcc -v
Reading specs from /opt/gcc-2.95.3/lib/gcc-lib/i686-pc-linux-gnu/2.95.3
specs
gcc version 2.95.3 20010315 (release)
richis@lfs:~ $ uname -a
Linux lfs 2.4.22 #6 Tue Sep 2 17:43:01 PDT 2003 i686 unknown unknown
GNU/Linux
richis@lfs:~ $ ls
debian-hatorihanzo-2.95.3  debian-hatorihanzo-3.2.3-slack 
debian-hatorihanzo-3.3.1  debian-hatorihanzo.c
richis@lfs:~ $ ./debian-hatorihanzo-2.95.3
sh-2.05b# id
uid=0(root) gid=0(root)
sh-2.05b# exit
exit
richis@lfs:~ $ ./debian-hatorihanzo-3.2.3-slack
sh-2.05b# id
uid=0(root) gid=0(root)
sh-2.05b# exit
exit
richis@lfs:~ $ ./debian-hatorihanzo-3.3.1
[-] Unable to unmap stack: Invalid argument
richis@lfs:~ $ id
uid=500(richis) gid=100(users) groups=100(users)
richis@lfs:~ $

#######
Now, from Slack 9.1:

richis@matrix:~ $ gcc -v
Leyendo especificaciones de /usr/lib/gcc-lib/i486-slackware-linux/3.2.3
specs
Configurado con: ../gcc-3.2.3/configure --prefix=/usr --enable-shared
--enable-threads=posix --enable-__cxa_atexit --disable-checking
--with-gnu-ld --verbose --target=i486-slackware-linux
--host=i486-slackware-linux
Modelo de hilos: posix
gcc versión 3.2.3
richis@matrix:~ $ uname -a
Linux matrix 2.4.22 #6 Tue Sep 2 17:43:01 PDT 2003 i686 unknown unknown
GNU/Linux
richis@matrix:~ $ ls
debian-hatorihanzo-2.95.3  debian-hatorihanzo-3.2.3-slack
debian-hatorihanzo-3.3.1  debian-hatorihanzo.c
richis@matrix:~ $ ./debian-hatorihanzo-2.95.3
sh-2.05b# id
uid=0(root) gid=0(root)
sh-2.05b# exit
exit
richis@matrix:~ $ ./debian-hatorihanzo-3.2.3-slack
sh-2.05b# id
uid=0(root) gid=0(root)
sh-2.05b# exit
richis@matrix:~ $ ./debian-hatorihanzo-3.3.1
[-] Unable to unmap stack: Invalid argument
richis@matrix:~ $ id
uid=500(richis) gid=100(users) grupos=100(users)
richis@matrix:~ $

Noticed this message?:
[-] Unable to unmap stack: Invalid argument

On the RH servers (check the others posts) we had these:
[-] Unable to change page protection: Cannot allocate memory
[-] Unable to exit, entering neverending loop.

[1]+  Stopped                 ./debian-hatorihanzo

and the process had to be killed.

Cheers.

PS: I'm not a C/C++ programmer, can't even remotely understand the
causes of this behaviuor, but I'm a sysadmin and will gladly help in
testing and researching about this bug if it's worth it.
(sorry if it looks too much like a disclaimer :) )

-- 
Ricardo Barberis
Usuario Linux Nº 250625:           http://counter.li.org
Usuario LFS Nº 5121:               http://www.linuxfromscratch.org
LFS en castellano:                 http://www.lfs-es.org
-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page