In this weeks Security Alerts, we look at a security vulnerability in LIDS; buffer overflows in CUPS, jgroff, Sun Solstice Enterprise Master Agent, and Ettercap; and problems in Sawmill, Faq-O-Matic, pforum, GNAT, Taylor UUCP, and IRIX O2 Video.

http://linux.oreillynet.com/pub/a/li...ecurities.html

..the stuff they're talking about writing to /dev/kmem has been explained quite a while ago by someone called Silvio (author of a few proof of concept Linux viruses, IIRC).

I was trying to assess how vulnerable a box would be when using a GRSecurity patched 2.4 kernel with module loading enabled, and how to somewhat control the damage using Linux Capabilities.
On boot, after loading modules and doing the GRSecurity sysctl stuff, I figured using Lcap to unset the loading of modules (CAP_SYS_MODULE) would be enough. Not, cuz when CAP_SYS_RAWIO isn't disabled they'll be able to write to /dev/kmem.

Doing some further readups also stated writing /dev/kmem as A Clever Way for a cracker to load module code when faced with a kernel w/o module support (when CAP_SYS_RAWIO hasn't been taken away).

* I haven't got a clear view on what would be b0rken when CAP_SYS_RAWIO is taken away tho...