Subject: Re: [vserver] Kernel bug
From: Natanael Copa <natanael.copa@gmail.com>
Date: Wed, 13 Feb 2008 08:31:35 +0100


On Tue, 2008-02-12 at 14:49 +0100, Łukasz Czarniecki wrote:
> Natanael Copa wrote:
> > BTW... the exploit thats out for this bug didnt work on the
> > vserver-grsecurity kernel. A day like this I'm happy I'm using it. 
> 
> Hi
> 
> I'm using 2.6.22.15-grsec2.1.11-vs2.2.0.5 kernel.
> And the exploit works in both vserver and host.

interesting. Here it generates a "PAX: suspicious general protection
fault: 0000 [#1]" and the program segfaults.

> It doesn't let to escape from vserver but it could be possible
> according to http://www.debian.org/security/2008/dsa-1494
> "In the vserver-enabled kernels, a missing access check on certain 
> symlinks in /proc enabled local attackers to access resources in other 
> vservers"
> 
> Did you just set TPE or some other options?

no

> Which grsecurity option protects against this exploit?

as mentioned UDEREF prevents it for good, but KERNEXEC alone should
prevent the code execution that this exploits relies on.

> Can you share your config?

svn cat svn://svn.alpinelinux.org/alpine-builder/trunk/kernel/vsgrsec/config

The patches I use are adapted to gentoo. found here:
http://dev.alpinelinux.org/vsgrsec-sources/


> Lukasz Czarniecki

-nc