Linux Kernel 2.6 Local Root Exploit by vmsplice?

Inuit-Uprising · 02-10-2008, 05:02 PM

I was just reading about this and apparently it has something to do with vmsplice. Some have suggested that you recompile the kernel without it. Does anyone know where the kernel option is? Does this issue even affect Slackware? Should I even worry about this? I would appreciate it if someone smarter than I could tell me if I should even care about this.

leonscape · 02-10-2008, 05:21 PM

Do you have more than one person using your machine? Will this person do something nasty and ry to get root access to do damage or change stuff?

Its a LOCAL root exploit not a remote exploit, so its local you have to worry about. and its kernel versions between 2.6.17 and 2.6.24.1 If you haven't got one of those kernels you've got nothing to worry about ( do a uname -r to find out the version ).

Plus so far we have a proof of concept, nothings been seen in the wild to expoit this... yet.

Inuit-Uprising · 02-10-2008, 07:41 PM

I am the only one that uses this computer (as far as I know). So I'm not too worried about it. Thanks for your reply.

leitao · 02-11-2008, 07:33 AM

Pre build packets could be found at:
http://134.2.34.20/blank/debian/linux-2.6/
as referenced in the debian mailing list http://lists.debian.org/debian-kerne.../msg00363.html

Take care,
Breno Leitao

willysr · 02-11-2008, 08:22 AM

2.6.24.2 has been released to fix this
here's the changelog

Code:

commit 1617e66d11d6621824f642728d62f242272fd063
Author: Bastian Blank <bastian@waldi.eu.org>
Date:   Sun Feb 10 16:47:57 2008 +0200

    splice: fix user pointer access in get_iovec_page_array()
    
    patch 712a30e63c8066ed84385b12edbfb804f49cbc44 in mainline.
    
    Commit 8811930dc74a503415b35c4a79d14fb0b408a361 ("splice: missing user
    pointer access verification") added the proper access_ok() calls to
    copy_from_user_mmap_sem() which ensures we can copy the struct iovecs
    from userspace to the kernel.
    
    But we also must check whether we can access the actual memory region
    pointed to by the struct iovec to fix the access checks properly.

MannyNix · 02-11-2008, 11:00 AM

Quote:

Originally Posted by Inuit-Uprising

Does anyone know where the kernel option is?

I was reading on gentoo's forums and they say:

Quote:

..there is no way to disable vmsplice in your .config .You can disable it quite easily by modifying the kernel source, open fs/splice.c, search for sys_vmsplice() and then make the following modification to the function

Here's the OP if still interested.
Good day

lazylogic · 02-13-2008, 04:32 AM

Quote:

Originally Posted by leonscape

Do you have more than one person using your machine? Will this person do something nasty and ry to get root access to do damage or change stuff?

Its a LOCAL root exploit not a remote exploit, so its local you have to worry about. and its kernel versions between 2.6.17 and 2.6.24.1 If you haven't got one of those kernels you've got nothing to worry about ( do a uname -r to find out the version ).

Plus so far we have a proof of concept, nothings been seen in the wild to expoit this... yet.

Most of us who comes to forum for help probably would be using Linux for personnal use, so this exploit shouldn't worry us much.

However, if any experts around here can help to do a simple step by step howto to :
1. test out the exploit and
2. patch the affected kernel

it would really be a great learning exercise and definitely benefit a lot of forumers here

jong357 · 02-13-2008, 06:21 AM

Yea, it works. I don't see the point tho seeing as how there are more obvious ways to gain root access if your sitting at someones computer. That's definately quicker tho...

shadowsnipes · 02-13-2008, 09:01 AM

For a lot of Slackware users that use the stock kernels, they can just install the newest package for their kernel and they don't need to patch anything.

See this other related thread for more information about all of this.

hitest · 02-13-2008, 09:41 AM

Quote:

Originally Posted by shadowsnipes

For a lot of Slackware users that use the stock kernels, they can just install the newest package for their kernel and they don't need to patch anything.

Yeah, that's what I did. Here's a quote from the installation instructions from the slackware security e-mail.

Quote:

Installation instructions:
+------------------------+

Upgrade the appropriate package as root:
# upgradepkg kernel-generic-smp-2.6.21.5_smp-i686-2_slack12.0.tgz

Then, if you use lilo rerun it to update the boot loader.