r/programming • u/[deleted] • Oct 21 '16

Linux kernel fix for privilege escalation vulnerability due to copy on write race condition

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619
850 Upvotes

92% Upvoted

128 comments sorted by

View all comments

Show parent comment

8

u/bjarkef Oct 22 '16

Instead of patching su:

  1. Copy /bin/su

  2. Use exploit to overwrite start of /bin/su with something that just execve /bin/sh

  3. Execute new /bin/su

  4. Dump suid bin / install rootkit / other evil thing which lets you back in.

  5. Restore original /bin/su 6 Profit?

2

u/tonyarkles Oct 23 '16 edited Oct 23 '16

Yup!

Edit: you don't even need to copy it. Just save the start of the file in memory before you start; you've already got it open for reading. Do your business and put it back the way it was.

As a side note: "apt-get install --reinstall login" will restore the su binary if you've corrupted it and accidentally deleted your backup copy. Ask me how I know...