Re: Linux kernel do_mremap() proof-of-concept exploit code

[Alexandre Hautequest]

Christophe Devine wrote:
> The following program can be used to test if a x86 Linux system
> is vulnerable to the do_mremap() exploit; use at your own risk.
>
> $ cat mremap_poc.c

In my 2.6.0, machine promptly booted to bios. No root access but no OS
available.

--
Alexandre Hautequest
Onda Provedor de Serviços S/A -- www.onda.com.br
Tel: +55 (41) 3025-3000
Promovendo segurança para seu negócio!

GPG Key 8CA3 8DEB 62B2 0300 BC6B CDDD 20A5 546A B25F 4E08
www.keyserver.net KeyID B25F4E08

[Bruno Lustosa]

--qMm9M+Fa2AknHoGS
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Christophe Devine <devine@iie.cnam.fr> [06-01-2004 13:45]:
> The following program can be used to test if a x86 Linux system
> is vulnerable to the do_mremap() exploit; use at your own risk.

Tested it under Linux 2.6.1-rc1, and surprisingly, the machine rebooted
instantly. Isn't the mremap bug supposed to be fixed on the 2.6 series?

--=20
Bruno Lustosa, aka Lofofora | Email: bruno@lustosa.net
Network Administrator/Web Programmer | ICQ UIN: 1406477
Rio de Janeiro - Brazil |

--qMm9M+Fa2AknHoGS
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/+txWiNfNvfQ8L5IRAi8aAJ9UJgH8zMu7zhjl5MeAfY8d40T25w CfTIzM
XshhylL2W1Qw9eEHD4Lg0sA=
=A3BV
-----END PGP SIGNATURE-----

--qMm9M+Fa2AknHoGS--

> From: Bruno Lustosa [mailto:bruno@lustosa.net]=20
> Tested it under Linux 2.6.1-rc1, and surprisingly,=20
> the machine rebooted instantly. Isn't the mremap=20
> bug supposed to be fixed on the 2.6 series?

It is, but not in 2.6.1-rc1.

From http://isec.pl/vulnerabilities/isec-0013-mremap.txt:

"Version: 2.2, 2.4 and 2.6 series"

"The exploitability of the discovered vulnerability is possible,
although not a trivial one. We have identified at least two different
attack vectors for the 2.4 kernel series."

And from
http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.1-rc2

"<torvalds@home.osdl.org>
Don't allow mremap of zero-sized areas."

The do_mremap() vulnerability is fixed in the 2.6 kernel only in
2.6.1-rc2, where as you tested on 2.6.1-rc1.

The latest version of the 2.2 kernel is 2.2.25, but there was no
immediate changelog available. However, it was created on January 3 so I
suspect it would have the patch?


Regards

Thor Larholm
Senior Security Researcher
PivX Solutions
24 Corporate Plaza #180
Newport Beach, CA 92660
http://www.pivx.com
thor@pivx.com
949-231-8496

PivX defines "Proactive Threat Mitigation". Get a FREE Beta Version of
Qwik-Fix
<http://www.qwik-fix.net>=20