Hot answers tagged

65

The "rings" nomenclature (0-3) you usually see these days started with the requested privilege level field in segment selectors as part of the design of x86 protected mode. Back in the day, it was possible to make exclusive sections of the memory space called segments. In "real mode" it was necessary since you only had 20-bit addressable memory. When ...


55

It can't be exploited remotely without another vulnerability. You need to be able to execute commands on the system already. A classic example would be a web shell. Say the server is running a web application which has a vulnerability allowing you to upload a web shell or otherwise execute system commands. These commands will typically be executed as a low-...


28

The dirty cow vulnerability, is a a privilege escalation vulnerability in Linux kernel versions 2.6.22 and higher; it has existed since 2007 and was fixed on Oct 18, 2016. What is the possible impact of dirtyc0w bug? An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their ...


22

Running code in "kernel space" means running it in the ring 0 space. In other words, it is the strict definition of "having total control". The only exception would be if you are running a hypervisor. In such a case, running code in ring 0 of the virtualized OS would "only" give you full control of the virtualized device, not the hypervisor (which is said ...


18

Would that give an attacker complete control over the phone? For example, could they install a keylogger or other malware? This is possible. Since any permission checks (i.e. file access, access to keyboard...) are done inside the kernel, code running inside the kernel could invoke the needed actions simply directly without executing these checks. Would ...


15

You and 3 other people are studying for a test, using the same notes. You say "I gotta go, I need to make a copy of these notes for myself that I can mark up... let me go make a copy!" You take the notes to the photocopier, copy them, alter the original, and then take the modified original back to the rest of the group. That modified version is bad; you'...


14

One simple answer is bugs in the code that implements those security features. For example, the recently-released CVE-2015-2552 allows loading unsigned (well, test-signed, which is almost the same thing) drivers on a system that has Secure Boot enabled. There have also been a number of bugs in UEFI implementations (and other low-level code) that allowed ...


14

I'm not a linux kernel expert, but I am familiar with the concepts involved and I read Linus' comment and the diff. I'll give it a go - perhaps people can correct me if I get it wrong and we'll hash things out together. Copy On Write is an internal memory concept where, primarily for performance reasons, operations that make a copy of a section of memory ...


13

The performance impact will vary greatly depending on what the program does. After the Meltdown patch (KPTI) whenever there is a context switch from user-space to kernel-space there is a significant overhead because of the frequent flushing of the kernel page tables. So this means that a program that relies on frequent context switching (like a database ...


12

OpenVZ containers do not have their own kernels. In OpenVZ, there is only one kernel for the host OS and all of the containers. Successfully exploiting that kernel from within a container means potential impact to the OpenVZ host and all of its containers. If you want to avoid this vulnerability, you need a real hypervisor that boots in independent kernel ...


12

CVE-2016-5195 is a so-called privilege escalation exploit. It allows you to elevate the privilege level from a normal Linux user to root. But privilege escalation exploits are usually local exploits (which means they run locally on a box), which means you already need to be logged on to the operating system. The public exploit I was checking allows to write ...


11

No, there is nothing all kernel exploits have in common. Or at least, there is nothing unique to them and not present in standard, legal interaction with the kernel (such as using syscalls or accessing special filesystems). Typically, a kernel exploit involves making a syscall (an interface that allows userspace processes to communicate with the kernel) ...


10

It can be used to display CPU registers (which could contain bits of confidential information), forcibly unmount filesystems or reboot the computer, among other things (denial of service vulnerability). I wouldn't say it is dangerous though. If you have physical access to the server there so much you can do without even using the "magic" key. A lot of ...


9

Ring -1 is the hypervisor, implemented as Intel VT-x ("Vanderpool") [Wikipedia] or AMD-V ("Pacifica") [Wikipedia].


9

In order to understand the threat from Meltdown, you need to understand how memory is organized in modern computers. The naive view of memory is that each memory address corresponds to a specific set of cells in RAM. This is called "physical addressing", and until about the early 1990s, was the most common way of handling memory in a computer. Under ...


9

Binary exploitation does not require you understand the Linux kernel in depth, unless you are exploiting the kernel itself. You only need to know the basics such as how signal handlers are registered, how syscalls work, and how Linux manages process-specific attributes that can be relevant to exploitation. A solid understanding of Linux is very useful, but ...


7

I'm root@anapnea.net, and grsec is the reason I can sleep at night. As an example of an exploit blocked by grsec, you can look at almost any of the recent kernel vulnerabilities. Stock exploits simply don't work against a grsec kernel. As an example of a vulnerability blocked by grsec, and in particular UDEREF, you have the recent x86_32 local root. Grsec ...


7

At least it does affect Android 5.0.1 (Kernel Version 3.10.54+). I just tried out this code on a device using Termux and editing a file owned by root works flawlessly. I like that, because there is no root available for that device. On the other hand, it surprises me, because Android uses SELinux and I thought SELinux would prevent writing to /proc/self/mem....


7

Your considerations Using dm-verity is a very good idea, especially if you are able to fuse a key in hardware to reduce the TCB further. This can greatly help prevent a system from being persistently compromised, as well as ensure integrity, making tampering highly evident. A quick web search shows several TPM implementations for Raspberry Pi, which will ...


6

The exploit uses a combination of three vulnerabilities. Each vulnerability is a bug in an iOS component that allows the attacker to do things that are not supposed to be possible. Stage 1 (CVE-2016-4657) is a bug in WebKit, a library of code used to render web pages. WebKit code is executed in the context of the Safari web browser of iOS. No details have ...


6

Linux Mint founder and lead developer Clement Lefebvre responded to these accusations with a blog post on segfault.linuxmint.com in 2013. I hear [Oliver Grawert, a Canonical-employed Ubuntu developer] was more opinionated than knowledgeable and the press blew what he said out of proportion. I wouldn’t mind too much, if we weren’t finding ourselves ...


6

How scary is it? In principle, a privilege escalation is quite scary since it more or less renders all access control meaningless. In practice, it hopefully matters little. You first have to have limited user access. For servers, it will mean that not-so-well maintained server systems that are somewhat exploitable now will be trivially rootable. It's not ...


6

This is far from being a simple task thanks to memory protection techniques. In the old times of MS-DOS, Windows 9x and equivalent home computing systems, the memory was indeed equally shared amongst all the running process. In such conditions your feeling is right: any user process can access and modify memory from other processes, even the operating ...


5

The disadvantage would be that the TCP sequence could wrap. This is a risk on very high speed networks. You can randomize the initial timestamp, however, just as you asked. It's a very simple patch, so any rejects will be trivial to fix. It requires the grsecurity patchset to already be applied. From https://grsecurity.net/~spender/random_timestamp.diff: ...


5

It's world-readable now because it was made world-readable when it was created twenty years ago or so. I haven't researched the history (which probably exists only in Linus Torvalds's head anyway) but it's likely that this file is world-readable because there's no obvious reason to make it so. After all, it doesn't contain any confidential information: just ...


5

If an attacker gets root, don't they pretty much own the machine even without kernel access, by doing things like modifying binaries? Maybe, maybe not. With SELinux, you can restrict access to block devices, even for the root user. So, if your root partition is read-only (and the system is running with OverlayFS to provide for non-persistent modifications), ...


5

As a performance optimization, the kernel memory was mapped within the memory space of the application. The pages are protected, but the page tables were (before KPTI) mapped in so they did not have to load them from memory on each system call. Now each system call incurs additional overhead to load the kernel page tables.


5

This will prevent two out of three ways of running a Meltdown attack. Unfortunately for you, it does nothing for the third. The simplest way to do a Meltdown attack is to perform an illegal read with a sufficiently long pipeline delay that the CPU speculatively acts on the read before the page fault is triggered, then catch the fault. Your proposal will ...


5

I'm asking myself if the function printk() is a security issue on Linux. This depends on whether or not there are any printk() calls which may print unsanitized pointers. Generally, pointers will be sanitized when kernel.kptr_restrict is non-zero. This works because the identifier for pointers is %pK, which sanitizes pointers by default. However, there seem ...


4

It seems that the issue has been reported back in 2011. In addition, a patch proposed to make /proc/interrupts readable by root only. By reading the thread, it seems that they consider the distributions should change the permission of /proc/interrupts if they wanted to. An issue was raised about the fact that it can be cumbersome to force everyone mounting ...


Only top voted, non community-wiki answers of a minimum length are eligible