Re: [Full-Disclosure] [SECURITY] [DSA-403-1] userland can access Linux kernel memory

[Wojciech Purczynski <cliph@isec.pl>]

> > Recently multiple servers of the Debian project were compromised using a
> > Debian developers account and an unknown root exploit. Forensics
> > revealed a burneye encrypted exploit. Robert van der Meulen managed to
> > decrypt the binary which revealed a kernel exploit. Study of the exploit
> > by the RedHat and SuSE kernel and security teams quickly revealed that
> > the exploit used an integer overflow in the brk system call. Using
> > this bug it is possible for a userland program to trick the kernel into
> > giving access to the full kernel address space. This problem was found
> > in September by Andrew Morton, but unfortunately that was too late for
> > the 2.4.22 kernel release.

This is not an integer overflow bug. do_brk() doesn't verify its arguments
at all, allowing to create arbitrarily large virtual memory mapping (vma)
consuming kernel memory.

Regards,
wp

-- 
Wojciech Purczynski
iSEC Security Research
http://isec.pl/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html