[SOLVED] Dirty cow kernel exploit

hitest · 10-21-2016, 11:40 AM

Reading about this today. I'm guessing we'll have a patch for this kernel exploit in the near future. Are we vulnerable to this?

http://www.theregister.co.uk/2016/10...calation_hole/

GazL · 10-21-2016, 12:49 PM

Yes, I think it's safe to assume that if you're using one of the currently shipping slackware kernels you're vulnerable. This thing sounds like it's been lurking in the kernel for the best part of a decade.

The fix is included in the latest kernel.org releases (though judging by some of the comments in the lwn thread it looks like they tried to slip it in under the radar, which is not at-all good!):
http://lwn.net/Articles/704078/

I don't use Pat's kernels, and have already updated to 4.8.3 because of this.

hitest · 10-21-2016, 01:27 PM

Quote:

Originally Posted by GazL

Yes, I think it's safe to assume that if you're using one of the currently shipping slackware kernels you're vulnerable.

Thanks mate! I'll be booting into my BSD partition until this is dealt with.

jmccue · 10-21-2016, 02:02 PM

From what I have seen, this is a local exploit. Am I wrong ?

Granted it is serious, but for workstation use I would say nothing to worry about if you trust your users (or yourself if single user

)

John

GazL · 10-21-2016, 03:23 PM

The concern is that an exploit for this vulnerability may be included in the payload of an unrelated web-browser, media player, java, flashplayer, pdf-reader, etc. exploit. The upshot being that until this is patched you're effectively flying without your usual "Well, at least I'm not root" safety-net.

hitest · 10-21-2016, 05:08 PM

Quote:

Originally Posted by GazL

The concern is that an exploit for this vulnerability may be included in the payload of an unrelated web-browser, media player, java, flashplayer, pdf-reader, etc. exploit. The upshot being that until this is patched you're effectively flying without your usual "Well, at least I'm not root" safety-net.

Thanks for the clarification.

Drakeo · 10-21-2016, 06:23 PM

The only people that know or known about that exploit are the people that test against it. Those people are part of the kernel team look it up.
so this is why linus never talks about these problems. Why should his best hackers work for him. relax. Let the cow come home.

Contrak · 10-21-2016, 07:25 PM

Quote:

Originally Posted by Drakeo

The only people that know or known about that exploit are the people that test against it. Those people are part of the kernel team look it up.
so this is why linus never talks about these problems. Why should his best hackers work for him. relax. Let the cow come home.

There's probably more problems in the linux kernel than we want to know. They said this exploit has been in the linux kernel for the past 9 years.

hitest · 10-21-2016, 07:27 PM

Quote:

Originally Posted by Drakeo

relax. Let the cow come home.

Thanks for your concern. I'm okay.

Richard Cranium · 10-21-2016, 08:45 PM

According to the initial article, if /proc/self/mem is writable then you can be exploited.

Drakeo · 10-21-2016, 08:55 PM

"how do you write to mem" According to the initial article, if /proc/self/mem is writable then you can be exploited. Let me explain how to write to mem. you must be 0. That means sitting at your computer. Buffer over flow oh you think that is happening mmmmm chew on some grass look at the code it is open. if you use ubuntu better watch out. sheep chewing.

hitest · 10-21-2016, 09:10 PM

Quote:

Originally Posted by Drakeo

if you use ubuntu better watch out. sheep chewing.

Ubuntu has offered a patch for the vulnerability.

STDOUBT · 10-21-2016, 09:21 PM

Quote:

Originally Posted by Drakeo

"how do you write to mem" According to the initial article, if /proc/self/mem is writable then you can be exploited. Let me explain how to write to mem. you must be 0. That means sitting at your computer. Buffer over flow oh you think that is happening mmmmm chew on some grass look at the code it is open. if you use ubuntu better watch out. sheep chewing.

Is that supposed to be a poem? Are we not all sheep for continuing to use The Torvalds kernel? How many of these are lurking in the deep? Answer: we may never know thanks to his design philosophy.

Richard Cranium · 10-21-2016, 10:15 PM

Quote:

Originally Posted by Drakeo

"how do you write to mem" According to the initial article, if /proc/self/mem is writable then you can be exploited. Let me explain how to write to mem. you must be 0. That means sitting at your computer. Buffer over flow oh you think that is happening mmmmm chew on some grass look at the code it is open. if you use ubuntu better watch out. sheep chewing.

The article described the exploit rather well.

Unlike your comment.

Darth Vader · 10-22-2016, 01:13 AM

The Dirty COW shit was cleaned up on 4.4.26.

Upgrade yourself to, or come all of yours with loaded guns on Pat's virtual porch, to ask him to be kind do it.