Onderwerp: Hotfix for new mremap vulnerability

Greetings,

=09Here (http://wizard.ath.cx/fixmremap2.tar.gz) is small hotfix for newly
discovered mremap() vulnerability. It
doesn't directly change do_mremap() code, it just overwrites syscall
handler with LKM. In my opinion it is enough to fix just mremap() syscall b=
ecause at
least on x86 there are no other functions which would use do_mremap
directly. But this may not be true on others platforms (for example
ia64)...

The package contains the hotfix and a small proof of concept program which
can be used to see if kernel is vulnerable.

Use at your own risk.

Pavel Pal=E1t

--
Pavel "harry_x" Pal=E1t
harry_x@babylon5.cz
irc: #mistral.cz on IRCnet

The only way of finding the limits to the possible is by going beyond t=
hem to the impossible
Arthur C. Clark

On Thursday 19 February 2004 17:32, Pavel harry_x Pal=E1t wrote:

Hi Pavel,

> Greetings,
>
> Here (http://wizard.ath.cx/fixmremap2.tar.gz) is small hotfix for newly
> discovered mremap() vulnerability. It
> doesn't directly change do_mremap() code, it just overwrites syscall
> handler with LKM. In my opinion it is enough to fix just mremap() syscall
> because at least on x86 there are no other functions which would use
> do_mremap directly. But this may not be true on others platforms (for
> example ia64)...
> The package contains the hotfix and a small proof of concept program which
> can be used to see if kernel is vulnerable.
> Use at your own risk.

=2D call the POC exploit on a vulnerable system
=2D echo "1000000" > /proc/sys/vm/max_map_count
=2D call the POC exploit again
=2D see the difference

Well, at least it prevents the POC exploit, maybe there's more though.

Kudos to the PaX team

=2D-=20
ciao, Marc