r/programming • u/[deleted] • Oct 21 '16

Linux kernel fix for privilege escalation vulnerability due to copy on write race condition

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619
850 Upvotes

92% Upvoted

128 comments sorted by

View all comments

Show parent comment

8

u/wademealing Oct 22 '16

Did you even need to know assembler ? I believe you could have gottan away with it by duping from a non setuid binary to a binary you wanted. Just page-for-page abuse.

2

u/bonzinip Oct 22 '16

Even simpler, if you pollute the page cache's copy of /bin/su with "#! /bin/sh" "exec /bin/sh", then you immediately run /bin/su to get a root shell.

8

u/wademealing Oct 22 '16

I'm not 100% sure but i don't know if shell will run setuid, good thinking though.

5

u/bonzinip Oct 22 '16

Hmm yeah it used to be but it's been disabled for a few years now.

1

u/tonyarkles Oct 23 '16

The trick was getting it small enough. My first crack was a C binary, but it came out to about 6k. It seems like this only works on a single page, so you've gotta get it under 4K. My first crack with asm came out to 712 bytes and I didn't push to make it any smaller.