Re: Patched base.c file for the CVE-2012-0056 root privilege escalation exploit for the 3.0.17 VServer kernel

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,
it does not work on 2.6.38.8-vs2.3.0.37-rc17 .

- -Nik

On 01/24/2012 04:07 PM, Michael S. Zick wrote:
> On Mon January 23 2012, Jean Weisbuch wrote:
>> Hello everyone,
>>
>> The kernel >=2.6.39 are vulnerable to a privilege escalation exploit 
>> related to /proc/<pid>/mem, i tested one of the available exploit on a 
>> 3.0.9 VServer kernel and it allow any unprivileged user on the host 
>> system but also on guests to gain root privilege ; for more infos about 
>> it : http://blog.zx2c4.com/749
>>
> 
> My reading of that description shows that one of the steps required
> is to determine a matching self_exec_id -
> 
> Which is trivial to do, since the id is evidently initialized to a
> fixed value when it is created.
> 
> It would be better to also initialize the self_exec_id to a random
> number when it is created.
> That is, the same handling of an IV when creating a encrypted block.
>  
>> I patched a VServer patched base.c with the Linus patch 
>> (http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=e268337dfe26dfc7efd422a804dbb27977a3cccc#patch1) 
>> from the 3.0.17 sources (from the linux-source-3.0.17-vs2.3.2.1-beng 
>> package), i had to manually patch the chunck #1 which was rejected at 
>> first but the others didnt make any complaint.
>>
> 
> It does not appear to my from reading that, that self_exec_id is being
> randomized when created.
> 
>> Here is the patched base.c file : http://jbboin.phpnet.org/base.c
>>
>> I am now compiling a kernel package with this patch, will share the 
>> package as soon as it finished compiling (and if it seems to work).
>>
> 
> Sorry, I don't have the skills to test my own suggestion;
> so it needs to only remain as a suggestion at this point.
> 
> Mike
>>
>> Regards.
>>
>>
> 
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJPH63fAAoJEDFLYVOGGjgXNJUH/RsyZVrVjnnMOjkOdvjZK6tw
HqbvYDMBU458dvFoDd7oZVZUHrW25ANR3C3P9/tDospTWFpEOjjeVeFC4i3tGLbn
k0/J1ltLK8+qgDNxsdyTUzTic0DKin8HsVKtAdWahnTjTihXP8HJgo152W9q9JwA
BnTteMJn8VVA8ABE+1qMjraxgZEqgs6199gEDPZTRf7xNAF8FGrRGymAEJJ9xeg6
yDrtZ3RvR7uQkncy+BlwYD4YcocH0gLYmFjTqCVUZDg18U12NXcehVTOVni9V+kW
ASQYqOFqLByiupVvNcpb0zNldOQEGCBJSMWrZhGEyb1O4ibNPy4LWLLy4Up4Buo=
=TBip
-----END PGP SIGNATURE-----