-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, it does not work on 2.6.38.8-vs2.3.0.37-rc17 . - -Nik On 01/24/2012 04:07 PM, Michael S. Zick wrote: > On Mon January 23 2012, Jean Weisbuch wrote: >> Hello everyone, >> >> The kernel >=2.6.39 are vulnerable to a privilege escalation exploit >> related to /proc/<pid>/mem, i tested one of the available exploit on a >> 3.0.9 VServer kernel and it allow any unprivileged user on the host >> system but also on guests to gain root privilege ; for more infos about >> it : http://blog.zx2c4.com/749 >> > > My reading of that description shows that one of the steps required > is to determine a matching self_exec_id - > > Which is trivial to do, since the id is evidently initialized to a > fixed value when it is created. > > It would be better to also initialize the self_exec_id to a random > number when it is created. > That is, the same handling of an IV when creating a encrypted block. > >> I patched a VServer patched base.c with the Linus patch >> (http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=e268337dfe26dfc7efd422a804dbb27977a3cccc#patch1) >> from the 3.0.17 sources (from the linux-source-3.0.17-vs2.3.2.1-beng >> package), i had to manually patch the chunck #1 which was rejected at >> first but the others didnt make any complaint. >> > > It does not appear to my from reading that, that self_exec_id is being > randomized when created. > >> Here is the patched base.c file : http://jbboin.phpnet.org/base.c >> >> I am now compiling a kernel package with this patch, will share the >> package as soon as it finished compiling (and if it seems to work). >> > > Sorry, I don't have the skills to test my own suggestion; > so it needs to only remain as a suggestion at this point. > > Mike >> >> Regards. >> >> > > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJPH63fAAoJEDFLYVOGGjgXNJUH/RsyZVrVjnnMOjkOdvjZK6tw HqbvYDMBU458dvFoDd7oZVZUHrW25ANR3C3P9/tDospTWFpEOjjeVeFC4i3tGLbn k0/J1ltLK8+qgDNxsdyTUzTic0DKin8HsVKtAdWahnTjTihXP8HJgo152W9q9JwA BnTteMJn8VVA8ABE+1qMjraxgZEqgs6199gEDPZTRf7xNAF8FGrRGymAEJJ9xeg6 yDrtZ3RvR7uQkncy+BlwYD4YcocH0gLYmFjTqCVUZDg18U12NXcehVTOVni9V+kW ASQYqOFqLByiupVvNcpb0zNldOQEGCBJSMWrZhGEyb1O4ibNPy4LWLLy4Up4Buo= =TBip -----END PGP SIGNATURE-----