<br><div class="gmail_quote"><blockquote style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;" class="gmail_quote"><div>
<div>
<h3>
Linux Kernel 2.6 Local Root Exploit
</h3>
</div>
</div><div>
<b>Posted by
kdawson
on Sunday February 10, @03:23PM</b><br>
<b>from the <b>batten-the-hatches</b> dept.</b>
</div><div>
<a href="http://it.slashdot.org/search.pl?tid=172" target="_blank">
<br></a><a href="http://it.slashdot.org/search.pl?tid=106" target="_blank">
</a>
</div><div>
<a href="http://aquariusoft.org/" rel="nofollow" target="_blank">aquatix</a> writes <i>"This local root exploit (<a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464953" target="_blank">Debian</a>, <a href="https://bugs.launchpad.net/ubuntu/+source/linux-source-2.6.22/+bug/190587" target="_blank">Ubuntu</a>)
seems to work everywhere I try it, as long as it's a Linux kernel
version 2.6.17 to <a href="http://2.6.24.1" target="_blank">2.6.24.1</a>. If you don't trust your users (which you
shouldn't), better compile a new kernel without vmsplice."</i> Here is <a href="http://www.milw0rm.com/exploits/5092" target="_blank">millw0rm's proof-of-concept code</a>.
</div><br><br clear="all"></blockquote>
<br>works on all my boxes. <br><br>This patch was posted on the debian bug tracker <br><br><blockquote style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;" class="gmail_quote">
<pre>a modification of the exploit that finds the address of sys_vmsplice in the<br>kernel (using /proc/kallsyms) and replaces the first byte with a RET instruction<br>(using mmap of /dev/kmem) is available at<br>
<br> <a href="http://www.ping.uio.no/%7Emortehu/disable-vmsplice-if-exploitable.c" target="_blank">http://www.ping.uio.no/~mortehu/disable-vmsplice-if-exploitable.c</a></pre></blockquote>This patch seems to work well. although as its just a memory patch it wont survive a reboot.<br>
another person has posted an unoficial kernel with vmsplice. if someone will do same for ubuntu or other distros is unknown. <br><br>although best bet seems to recompile the kernel without vmsplice.<br><font color="#888888"><br>
<br><br>-- <br>
Umbrella Corporation :-<br>
"They are the fear within all of that there is a company. The Corporation controlling everything that is Umbrella.<br>A combination of Microsoft and the US Military. At some level there is a board of directors who meet once a<br>
month and decide all of our fates."<br>-- Jeremy Bolt - Producer - Resident Evil : Apocalypse
</font></div><br><br clear="all"><br>-- <br>Umbrella Corporation :-<br>"They are the fear within all of that there is a company. The Corporation controlling everything that is Umbrella.<br>A combination of Microsoft and the US Military. At some level there is a board of directors who meet once a<br>
month and decide all of our fates."<br>-- Jeremy Bolt - Producer - Resident Evil : Apocalypse