On Mon January 23 2012, Jean Weisbuch wrote: > Hello everyone, > > The kernel >=2.6.39 are vulnerable to a privilege escalation exploit > related to /proc/<pid>/mem, i tested one of the available exploit on a > 3.0.9 VServer kernel and it allow any unprivileged user on the host > system but also on guests to gain root privilege ; for more infos about > it : http://blog.zx2c4.com/749 > My reading of that description shows that one of the steps required is to determine a matching self_exec_id - Which is trivial to do, since the id is evidently initialized to a fixed value when it is created. It would be better to also initialize the self_exec_id to a random number when it is created. That is, the same handling of an IV when creating a encrypted block. > I patched a VServer patched base.c with the Linus patch > (http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=e268337dfe26dfc7efd422a804dbb27977a3cccc#patch1) > from the 3.0.17 sources (from the linux-source-3.0.17-vs2.3.2.1-beng > package), i had to manually patch the chunck #1 which was rejected at > first but the others didnt make any complaint. > It does not appear to my from reading that, that self_exec_id is being randomized when created. > Here is the patched base.c file : http://jbboin.phpnet.org/base.c > > I am now compiling a kernel package with this patch, will share the > package as soon as it finished compiling (and if it seems to work). > Sorry, I don't have the skills to test my own suggestion; so it needs to only remain as a suggestion at this point. Mike > > Regards. > >